b4c5c846b4
Some checks failed
CD Pipeline / workflow-shape (push) Successful in 1s
CD Pipeline / cancel-stale-cd (push) Has been skipped
CD Pipeline / tests (push) Successful in 2m40s
CD Pipeline / build-and-deploy (push) Successful in 4m49s
E2E Health Check / e2e-health (push) Failing after 1m3s
CD Pipeline / post-deploy-checks (push) Successful in 3m35s
37 lines
1015 B
YAML
37 lines
1015 B
YAML
# k8s/rbac/api-velero-reader.yaml
|
||
# API Pod 讀取 Velero backup 資源的 RBAC
|
||
# Sprint 5.1 K-001 / 2026-04-08 Asia/Taipei
|
||
# 說明: awoooi-api ServiceAccount 需要讀取 velero namespace 的 backup 資源
|
||
# 用於 Pre-flight Check 查詢最近備份時間（Q7 決策：kubectl 方式）
|
||
# 注意: executor 與 public API identity 已分離；此 binding 只給 API read-only。
|
||
---
|
||
apiVersion: rbac.authorization.k8s.io/v1
|
||
kind: ClusterRole
|
||
metadata:
|
||
name: awoooi-velero-backup-reader
|
||
labels:
|
||
app: awoooi
|
||
component: api
|
||
sprint: "5.1"
|
||
rules:
|
||
- apiGroups: ["velero.io"]
|
||
resources: ["backups"]
|
||
verbs: ["get", "list"]
|
||
---
|
||
apiVersion: rbac.authorization.k8s.io/v1
|
||
kind: ClusterRoleBinding
|
||
metadata:
|
||
name: awoooi-velero-backup-reader
|
||
labels:
|
||
app: awoooi
|
||
component: api
|
||
sprint: "5.1"
|
||
subjects:
|
||
- kind: ServiceAccount
|
||
name: awoooi-api
|
||
namespace: awoooi-prod
|
||
roleRef:
|
||
kind: ClusterRole
|
||
name: awoooi-velero-backup-reader
|
||
apiGroup: rbac.authorization.k8s.io
|