feat(rbac): bundle rbac-proxy + validator-task-submitter ClusterRoles

config/rbac/kustomization.yaml

@@ -6,4 +6,6 @@ resources:
   - role_binding.yaml
   - leader_election_role.yaml
   - leader_election_role_binding.yaml
+  - task_submitter_role.yaml
   - task_submitter_role_binding.yaml
+  - rbac_proxy_role.yaml

config/rbac/rbac_proxy_role.yaml

@@ -0,0 +1,11 @@
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: rbac-proxy
+rules:
+  - apiGroups: ["authentication.k8s.io"]
+    resources: ["tokenreviews"]
+    verbs: ["create"]
+  - apiGroups: ["authorization.k8s.io"]
+    resources: ["subjectaccessreviews"]
+    verbs: ["create"]

config/rbac/task_submitter_role.yaml

@@ -0,0 +1,8 @@
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: validator-task-submitter
+rules:
+  - apiGroups: ["sei.io"]
+    resources: ["seinodetasks"]
+    verbs: ["create", "get"]

config/rbac/task_submitter_role_binding.yaml

@@ -1,9 +1,3 @@
-# Binds the controller SA to sei-validator-task-submitter so the
-# controller can submit sidecar tasks via kube-rbac-proxy in TLS mode.
-# Cluster-wide grant — assumes the controller is the single trust
-# authority for all SeiNodes in the cluster. Multi-tenant deployments
-# (operators-other-than-platform creating SeiNodes) require a
-# different scoping model; see #224 follow-ups.
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRoleBinding
 metadata:
@@ -14,7 +8,7 @@ metadata:
 roleRef:
   apiGroup: rbac.authorization.k8s.io
   kind: ClusterRole
-  name: sei-validator-task-submitter
+  name: validator-task-submitter
 subjects:
 - kind: ServiceAccount
   name: controller-manager

manifests/samples/clusterrolebinding-rbac-proxy.yaml

@@ -1,16 +1,12 @@
-# Example binding for the kube-rbac-proxy ClusterRole. Substitute the
-# ServiceAccount name and namespace for the deployment running SeiNode
-# pods (this is the same SA the seictl sidecar container uses — see
-# platform.Config.ServiceAccount).
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRoleBinding
 metadata:
-  name: sei-rbac-proxy
+  name: sei-k8s-rbac-proxy
 subjects:
   - kind: ServiceAccount
     name: <seinode-service-account>
     namespace: <seinode-namespace>
 roleRef:
   kind: ClusterRole
-  name: sei-rbac-proxy
+  name: sei-k8s-rbac-proxy
   apiGroup: rbac.authorization.k8s.io

manifests/samples/clusterrolebinding-task-submitter.yaml

@@ -1,8 +1,3 @@
-# Example binding for the sei-validator-task-submitter ClusterRole —
-# grants a human-operator group access to submit sidecar tasks. The
-# controller SA itself is bound automatically via the kustomize chart
-# (config/rbac/task_submitter_role_binding.yaml); only third-party
-# identities need their own bindings.
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRoleBinding
 metadata:
@@ -13,5 +8,5 @@ subjects:
     apiGroup: rbac.authorization.k8s.io
 roleRef:
   kind: ClusterRole
-  name: sei-validator-task-submitter
+  name: sei-k8s-validator-task-submitter
   apiGroup: rbac.authorization.k8s.io