# AWOOOI RBAC - 最小權限原則 (Principle of Least Privilege)
# ============================================================
# Phase 7: 絕對領域防禦
#
# 設計原則:
# - 僅賦予 K8sExecutor 必要操作權限
# - 禁止 cluster-admin 等無敵權限
# - 限定操作範圍至特定資源類型
#
# 允許的操作:
# 1. 讀取 Events (告警觀測)
# 2. 刪除 Pods (故障排除)
# 3. Rollout Restart Deployments (服務重啟)
# 4. 讀取 Deployments/Pods 狀態 (健康檢查)
#
# 禁止的操作:
# - 刪除 Deployments/Services/Namespaces
# - 修改 RBAC 權限
# - 存取 Secrets (除非明確需要)
# - 執行任何 cluster-admin 操作

apiVersion: v1
kind: ServiceAccount
metadata:
  name: awoooi-executor
  namespace: awoooi-prod
  labels:
    app: awoooi
    component: executor
    system: awoooi
  annotations:
    description: "AWOOOI K8sExecutor - Minimal Permissions for AIOps Operations"

---
# ClusterRole: 跨命名空間操作權限 (僅限必要資源)
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: awoooi-executor-role
  labels:
    app: awoooi
    component: executor
rules:
  # ============================================================================
  # 讀取權限 (Read-Only) - 告警觀測與狀態檢查
  # ============================================================================
  - apiGroups: [""]
    resources: ["pods", "pods/status", "pods/log"]
    verbs: ["get", "list", "watch"]

  - apiGroups: [""]
    resources: ["events"]
    verbs: ["get", "list", "watch"]

  - apiGroups: [""]
    resources: ["namespaces"]
    verbs: ["get", "list"]

  # drift_detector: 讀取 services/configmaps/ingresses 做 Git vs K8s 漂移比對
  # 2026-04-10 Claude Sonnet 4.6 Asia/Taipei: 補齊 drift scan 所需 RBAC
  - apiGroups: [""]
    resources: ["services", "configmaps"]
    verbs: ["get", "list", "watch"]

  # 2026-05-01: backup/disk diagnostics need PVC visibility; read-only only.
  - apiGroups: [""]
    resources: ["persistentvolumeclaims"]
    verbs: ["get", "list"]

  - apiGroups: ["networking.k8s.io"]
    resources: ["ingresses"]
    verbs: ["get", "list", "watch"]

  - apiGroups: ["apps"]
    resources: ["deployments", "deployments/status", "replicasets"]
    verbs: ["get", "list", "watch"]

  # 2026-04-18 Claude Opus 4.7: 補齊 L5/L6 斷鏈 — executor.py 需讀 nodes + HPA + metrics
  # 根因: 修 P0.1 — 99% EXECUTION_FAILED 因 RBAC 不足(Forbidden),連 evidence gathering 都斷
  # 2026-04-18 評估: P1 安全 — 純讀取,無寫入,cluster-scope 限定特定資源
  - apiGroups: [""]
    resources: ["nodes", "nodes/status"]
    verbs: ["get", "list", "watch"]

  - apiGroups: ["autoscaling"]
    resources: ["horizontalpodautoscalers"]
    verbs: ["get", "list", "watch"]

  - apiGroups: ["metrics.k8s.io"]
    resources: ["nodes", "pods"]
    verbs: ["get", "list"]

  - apiGroups: ["apps"]
    resources: ["statefulsets", "daemonsets"]
    verbs: ["get", "list", "watch"]

  # 2026-05-01: HostBackupFailed / VeleroBackupFailed diagnosis needs backup job status.
  - apiGroups: ["batch"]
    resources: ["jobs", "cronjobs"]
    verbs: ["get", "list", "watch"]

  # 2026-05-01: Velero backup status is read-only evidence for backup_failure alerts.
  - apiGroups: ["velero.io"]
    resources:
      - backups
      - backupstoragelocations
      - backuprepositories
      - podvolumebackups
      - podvolumerestores
      - restores
      - schedules
    verbs: ["get", "list", "watch"]

  # ============================================================================
  # 寫入權限 (Write) - 僅限故障排除操作
  # ============================================================================

  # 刪除 Pod (故障排除: 重啟卡死 Pod)
  - apiGroups: [""]
    resources: ["pods"]
    verbs: ["delete"]

  # Rollout Restart (patch deployments 觸發滾動更新)
  # 使用 kubectl rollout restart 等效操作
  - apiGroups: ["apps"]
    resources: ["deployments"]
    verbs: ["patch"]

  # 2026-05-01: allow the same safe rollout restart primitive on controller types.
  - apiGroups: ["apps"]
    resources: ["statefulsets", "daemonsets"]
    verbs: ["patch"]

  # Scale Deployments (擴縮容)
  - apiGroups: ["apps"]
    resources: ["deployments/scale"]
    verbs: ["get", "patch", "update"]

---
# ClusterRoleBinding: 將權限綁定至 ServiceAccount
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: awoooi-executor-binding
  labels:
    app: awoooi
    component: executor
subjects:
  - kind: ServiceAccount
    name: awoooi-executor
    namespace: awoooi-prod
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: awoooi-executor-role

---
# 可選: 限定特定命名空間的 RoleBinding (更嚴格)
# 如果只想讓 AWOOOI 操作特定命名空間，使用此 RoleBinding 取代 ClusterRoleBinding
#
# apiVersion: rbac.authorization.k8s.io/v1
# kind: RoleBinding
# metadata:
#   name: awoooi-executor-binding
#   namespace: default  # 僅限 default namespace
# subjects:
#   - kind: ServiceAccount
#     name: awoooi-executor
#     namespace: awoooi-prod
# roleRef:
#   apiGroup: rbac.authorization.k8s.io
#   kind: ClusterRole
#   name: awoooi-executor-role
