Repository navigation

feat(rbac)!: least-privilege RBAC, a strict chart values schema, and informers that stop on 403 - #223

Merged

sunib merged 8 commits into

mainfrom

feat/least-privilege-rbac-and-forbidden-triggers

Jul 10, 2026

Merged

feat(rbac)!: least-privilege RBAC, a strict chart values schema, and informers that stop on 403#223
sunib merged 8 commits into
mainfrom
feat/least-privilege-rbac-and-forbidden-triggers

Commits on Jul 10, 2026
- fix(watch): stop an API-surface trigger informer RBAC denies
  
  sunib
  and
  claude
  committed
  fff9286
- feat(rbac): make the wildcard cluster read an opt-out ClusterRole
  
  sunib
  and
  claude
  committed
  1a12159
- fix(watch): a watch closed by shutdown is not a watch error
  
  sunib
  and
  claude
  committed
  ccd1cdd
- docs(review): align help text, chart docs and the f8 doc with what the code does
  
  sunib
  and
  claude
  committed
  cd3feb3
- feat(rbac): choose watched types with rbac.watchTypes.mode any|selected
  
  sunib
  and
  claude
  committed
  3a49109
- feat(chart): validate rbac.watchTypes with values.schema.json, not template guards
  
  sunib
  and
  claude
  committed
  b6364ee
- feat(chart): a full values.schema.json, and two things it found
  
  sunib
  and
  claude
  committed
  a04b568
- docs: stop overclaiming, refresh the security model, and prune the stale future plans
  
  sunib
  and
  claude
  committed
  6f1913f