feat(rbac)!: least-privilege RBAC, a strict chart values schema, and informers that stop on 403 - #223

Merged

sunib merged 8 commits into

mainfrom

feat/least-privilege-rbac-and-forbidden-triggers

Jul 10, 2026

Commits on Jul 10, 2026

fix(watch): stop an API-surface trigger informer RBAC denies

sunib
and
claude
committed
fff9286
feat(rbac): make the wildcard cluster read an opt-out ClusterRole

sunib
and
claude
committed
1a12159
fix(watch): a watch closed by shutdown is not a watch error

sunib
and
claude
committed
ccd1cdd
docs(review): align help text, chart docs and the f8 doc with what the code does

sunib
and
claude
committed
cd3feb3
feat(rbac): choose watched types with rbac.watchTypes.mode any|selected

sunib
and
claude
committed
3a49109
feat(chart): validate rbac.watchTypes with values.schema.json, not template guards

sunib
and
claude
committed
b6364ee
feat(chart): a full values.schema.json, and two things it found

sunib
and
claude
committed
a04b568
docs: stop overclaiming, refresh the security model, and prune the stale future plans

sunib
and
claude
committed
6f1913f