[Baylem]

Closes #883.
Closes #884.

Part of #867. This PR targets #886’s fix/native-api-credential-boundary branch and uses its issuer-denial checks. After #886 merges, retarget this PR to master, review the RBAC-only diff and run CI before merging.

Native permissions

The existing native dashboard keeps its administrative capabilities on upgrade. The documented least-privilege profile lets administrators turn off catalog writes, remote cluster registration and kubeconfig access, game Secret management, pod attach and cluster-wide CSI content deletion. It can restrict the API to named runtime Secrets and explicitly selected additional game namespaces. Standalone mode installs no native Kubernetes permissions.

The read ClusterRole keeps its existing binding and immutable role reference. Optional mutations move into separately named Roles and bindings. The operator’s graceful-stop attach and snapshot reclamation privileges can be controlled independently.

Verification

The populated Kind upgrade fixture checks the old read binding’s UID and effective permissions before and after upgrade. It exercises authorizer checks across two game identities and managed namespaces, catalog and CSI server-side dry runs, and a standalone installation. The existing credential-boundary and certificate-rotation suites cover issuer denial and positive agent access.

The Linux API and operator compiled, as did the tagged E2E sources. Helm rendered full native, least-privilege and standalone profiles and rejected invalid configurations. On 28507b9a, the populated Kind RBAC upgrade passed on amd64 and arm64. The full workflow completed with 63 successful jobs and five intentional skips. CI report

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

Run configuration

• Source mode: Auto
• Repository: GameplanePanel/Gameplane
• Branch: fix/883-884-mode-scoped-rbac
• File: .coderabbit.yaml
• Commit: c957d23
• Layers: Repository YAML
• Review profile: CHILL
• Plan: Advanced
• Run ID: 0b3bd12a-e957-4500-8c76-dbecd9d25c86

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• Trigger review

Pre-merge checks: 1 · 1

Failed checks: 1 inconclusive

Check name	Status	Explanation	Resolution
Title check		This assessment has not completed. The check will be retried on the next pre-merge check run.

Passed checks: 1 passed

Check name	Status	Explanation
Description Check		Check skipped - CodeRabbit’s high-level summary is enabled.

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

• X
• Mastodon
• Reddit
• LinkedIn

[github-actions]

CI Report - 28507b9

run 43136994290 - attempt 1

0 failed - 28 passed - 5 skipped - 85m12s elapsed

Test selection: partial - per-suite table

Coverage

no coverage/* commit statuses found on 28507b9

Changed

Area	Files	+/-
test/	4	+254/-4
charts/	8	+184/-33
api/	4	+58/-3
docs/	2	+46/-0
operator/	5	+21/-20
changelog/	1	+5/-0
.github/	1	+1/-1

Slowest jobs

Job	Duration
e2e telemetry / arm64 (kind)	23m54s
e2e telemetry / amd64 (kind)	22m49s
build e2e images	16m15s
e2e restricted-workloads / arm64 (kind)	14m59s
e2e restricted-workloads / amd64 (kind)	14m35s

e2e buckets run

api-agent, api-auth, api-mods, api-rbac, api-roles, backup-preparation, bot-fast, management-placement, monitoring, multicluster, network-isolation, operator, optional-components, postgres-availability, ratelimit, recovery, restricted-workloads, telemetry, upgrade, wake-hostport

[ValgulNecron]

Hey, could you please add changelog entry?

[Baylem]

Added the requested unreleased changelog entry.

CI passed on cb71cb83. The diff through 2f2226a7 changes only the changelog entry and its index link. I canceled the repeat CI run because this update changes only Markdown.