Repository navigation
refactor(rbac): align API ClusterRole names with their permissions #884
Description
Production readiness audit of Gameplane v0.4.0, commit 07bee47b. Tracking issue and PR merge order: #867.
Finding
The role named *-api-read also grants mutation of cluster-scoped administrative resources. Its name and comment can mislead operators during a permission review.
Work
Make names/comments and documented bindings match the effective read and administrative capabilities. Account for upgrades from existing Role and binding names and preserve the intended identity’s legitimate access.
Acceptance criteria
Compare chart render and authorization results before and after upgrade. Show representative allowed reads, intended writes and denied writes for each identity using the M06 matrix.
PR ownership and prior work
Deliver this documentation/naming change in the M06 RBAC PR. One set of permission fixtures covers both issues. Coordinate the rename with the RBAC work to handle immutable roleRef bindings and upgrade cleanup.
Activity
[-][Low L01] Align API ClusterRole names and documentation with the verbs they grant[/-][+]refactor(rbac): align API ClusterRole names with their permissions[/+]Baylem commentedon Nov 11, 2026
The populated upgrade on #900 commit
cb71cb83retained the UID and role reference of the existinggameplane-api-readClusterRoleBinding. The Kubernetes authorizer allowed catalog reads under both profiles and rejected a real server-side dry-run catalog mutation after the separate administrative grant was disabled. The checks passed on both runner architectures. amd64 upgrade · arm64 upgrade