apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: {{ include "rise.fullname" . }}
  labels:
    {{- include "rise.labels" . | nindent 4 }}
  annotations:
    description: |
      ClusterRole for Rise backend when Kubernetes deployment is enabled.

      SECURITY NOTE: This grants cluster-wide permissions to manage namespaces and
      deploy applications. Kubernetes RBAC does not support namespace wildcard patterns.

      To limit scope:
      1. Configure namespace_format with a consistent prefix (e.g., "rise-{project_name}")
      2. Use admission controllers (OPA/Gatekeeper) to enforce namespace naming policies
      3. Monitor namespace creation via audit logs
      4. Consider network policies to isolate Rise-managed namespaces
rules:
# Namespace management
- apiGroups: [""]
  resources: ["namespaces"]
  verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]

# Deployment management (creates and manages application workloads)
- apiGroups: ["apps"]
  resources: ["deployments"]
  verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]

# ReplicaSet management (Deployments create ReplicaSets internally; kept for visibility)
- apiGroups: ["apps"]
  resources: ["replicasets"]
  verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]

# Service management
- apiGroups: [""]
  resources: ["services"]
  verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]

# Endpoints management (for ClusterIP services pointing to IP addresses)
- apiGroups: [""]
  resources: ["endpoints"]
  verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]

# Ingress management
- apiGroups: ["networking.k8s.io"]
  resources: ["ingresses"]
  verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]

# NetworkPolicy management (for network isolation)
- apiGroups: ["networking.k8s.io"]
  resources: ["networkpolicies"]
  verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]

# ConfigMap management (for application configs)
- apiGroups: [""]
  resources: ["configmaps"]
  verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]

# Secret management (for application secrets)
- apiGroups: [""]
  resources: ["secrets"]
  verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]

# Pod management (for status checking and logs)
- apiGroups: [""]
  resources: ["pods"]
  verbs: ["get", "list", "watch"]

# Pod logs (for debugging)
- apiGroups: [""]
  resources: ["pods/log"]
  verbs: ["get"]

# Events (for monitoring and debugging)
- apiGroups: [""]
  resources: ["events"]
  verbs: ["get", "list", "watch"]
