# Minimal RBAC for the cron-seed Job ONLY.
#
# The Hermes home-manager agent itself has NO k8s RBAC — it manages the home
# via the Home Assistant REST API (http://home-assistant.home-assistant:80).
#
# The cron-seed Job needs to `kubectl exec` into the hermes pod to run
# `hermes cron create ...` (the only way to seed Hermes' internal cron).
# Scoped to this namespace, pods/exec on the hermes pod only.
---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: cron-seeder
  namespace: home-manager
---
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: cron-seeder
  namespace: home-manager
rules:
  - apiGroups: [""]
    resources: ["pods"]
    verbs: ["get", "list"]
  - apiGroups: [""]
    resources: ["pods/exec"]
    verbs: ["create"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: cron-seeder
  namespace: home-manager
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: cron-seeder
subjects:
  - kind: ServiceAccount
    name: cron-seeder
    namespace: home-manager