fix(rbac): isolate signing authority and narrow administrative permissions #883

Production readiness audit of Gameplane v0.4.0, commit 07bee47b. Tracking issue and PR merge order: #867.

Finding

The v0.4.0 API mount projects the public CA certificate. The API identity still has broad Secret access and cluster-scoped catalog/registration permissions, and the operator grants snapshot-content reclamation authority. These capabilities have different operational owners.

Work

Adopt the issuer isolation and namespace boundaries from the existing Critical work. Use that work’s issuer-denial test. Scope catalog administration, remote kubeconfig authority, namespace Secrets/pod attach and cluster-wide CSI reclamation to supported operating modes. Preserve required API-to-agent mTLS and cluster management.

Acceptance criteria

Publish and run an identity-by-resource allow/deny matrix for the native API, operator, game agent, waker and optional administration/reclamation identities in combined, standalone and multi-namespace setups as applicable. Verify issuer key denial and isolation between two named servers alongside positive certificate rotation, catalog and snapshot-path checks.

PR ownership and prior work

Build on the active Critical remediation’s identity and RBAC layout. Own the privilege matrix and use it to close L01 in the same RBAC PR. M05 consumes the documented trust inputs. Operator Secret scoping from #712/#757 is already present. The active Critical work owns issuer separation. The residual permissions and remote credential review belong here.

API cluster Role · Public-certificate-only projection · CA Secret · CSI privileges