# Minimal RBAC for the cron-seed Job ONLY.
#
# The Hermes agent itself has NO k8s RBAC — it manages the cluster via git
# commits (→ ArgoCD sync) and reads state via Loki / Prometheus / ArgoCD APIs.
#
# The cron-seed Job needs to `kubectl exec` into the hermes pod to run
# `hermes cron create ...` (the only way to seed Hermes' internal cron).
# Scoped to this namespace, pods/exec on the hermes pod only.
---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: cron-seeder
  namespace: platform-engineer
---
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: cron-seeder
  namespace: platform-engineer
rules:
  - apiGroups: [""]
    resources: ["pods"]
    verbs: ["get", "list"]
  - apiGroups: [""]
    resources: ["pods/exec"]
    verbs: ["create"]