opencode agent RBAC applied — follow-ups #55

New issue

Open

opened 2026-08-30 17:50:07 +00:00 by lab · 0 comments

lab commented

2026-08-30 17:50:07 +00:00

Owner

Milestone: Security Hardening
Effort: 1-2 hours

Done (2026-08-30)

The always-on opencode server (LXC ct-253, lab-pve2) no longer uses the
personal cluster-admin kubeconfig. Applied from manifests/opencode-agent/:

Namespace opencode-agent
ServiceAccount opencode-agent
Secret opencode-agent-token (long-lived SA token via annotation)
ClusterRoleBinding opencode-agent-view — cluster-wide read via the
built-in view role (no Secrets, Roles, RoleBindings, or nodes)
RoleBinding opencode-agent-edit in media and monitoring — write
access restricted to those namespaces

The LXC's kubeconfig was regenerated with lxc/opencode/generate-kubeconfig.sh
and re-provisioned; the old cluster-admin kubeconfig is gone from the LXC.

Verified from inside the LXC:

kubectl get secrets -A -> Forbidden
kubectl get nodes -> Forbidden (view role excludes nodes)
kubectl -n media get pods -> works
kubectl auth can-i --list -> read-only view verbs only

Open follow-ups

Read access to nodes — view cannot get/list nodes, which limits
agent debugging (e.g. kubectl get nodes -o wide). Add a small custom
ClusterRole with nodes get/list/watch bound to the same SA if wanted.
More writable namespaces — copy
manifests/opencode-agent/rolebinding-<ns>-edit.yaml per namespace as the
agent earns trust. auth/, db/, forgejo/, security/, caddy/
deliberately excluded for now.
Token rotation — the SA token never expires on its own; rotate by
deleting opencode-agent-token and regenerating the kubeconfig. Consider
a yearly calendar reminder.
Revoke path — documented in manifests/opencode-agent/README.md:
delete the token Secret, the LXC loses cluster access immediately.

Keep

The workstation kubeconfig remains cluster-admin (personal tool, not the
agent).
The lxc/opencode/bootstrap-opencode-lxc.sh comment marked TEMPORARY can be
updated once this issue is closed — the default KUBECONFIG_SRC swap is
complete already. Note: suggestions.md item 4 was the original backlog
entry for this work (file was never tracked in git, so it may be gone).

Milestone: Security Hardening Effort: 1-2 hours ## Done (2026-08-30) The always-on opencode server (LXC ct-253, lab-pve2) no longer uses the personal cluster-admin kubeconfig. Applied from `manifests/opencode-agent/`: - `Namespace` `opencode-agent` - `ServiceAccount` `opencode-agent` - `Secret` `opencode-agent-token` (long-lived SA token via annotation) - `ClusterRoleBinding` `opencode-agent-view` — cluster-wide read via the built-in `view` role (no Secrets, Roles, RoleBindings, or nodes) - `RoleBinding` `opencode-agent-edit` in `media` and `monitoring` — write access restricted to those namespaces The LXC's kubeconfig was regenerated with `lxc/opencode/generate-kubeconfig.sh` and re-provisioned; the old cluster-admin kubeconfig is gone from the LXC. Verified from inside the LXC: - `kubectl get secrets -A` -> Forbidden - `kubectl get nodes` -> Forbidden (view role excludes nodes) - `kubectl -n media get pods` -> works - `kubectl auth can-i --list` -> read-only view verbs only ## Open follow-ups 1. **Read access to nodes** — `view` cannot `get/list` nodes, which limits agent debugging (e.g. `kubectl get nodes -o wide`). Add a small custom ClusterRole with `nodes` get/list/watch bound to the same SA if wanted. 2. **More writable namespaces** — copy `manifests/opencode-agent/rolebinding-<ns>-edit.yaml` per namespace as the agent earns trust. `auth/`, `db/`, `forgejo/`, `security/`, `caddy/` deliberately excluded for now. 3. **Token rotation** — the SA token never expires on its own; rotate by deleting `opencode-agent-token` and regenerating the kubeconfig. Consider a yearly calendar reminder. 4. **Revoke path** — documented in `manifests/opencode-agent/README.md`: delete the token Secret, the LXC loses cluster access immediately. ## Keep - The workstation kubeconfig remains cluster-admin (personal tool, not the agent). - The `lxc/opencode/bootstrap-opencode-lxc.sh` comment marked TEMPORARY can be updated once this issue is closed — the default `KUBECONFIG_SRC` swap is complete already. Note: `suggestions.md` item 4 was the original backlog entry for this work (file was never tracked in git, so it may be gone).