paperclip: RBAC and scoped kubeconfigs for ops and deploy agents #63

New issue

Open

opened 2026-10-25 12:06:20 +00:00 by lab · 0 comments

lab commented

2026-10-25 12:06:20 +00:00

Owner

Context

Two agents with different cluster powers, both narrower than the workstation
kubeconfig.

Steps

lxc/paperclip/manifests/paperclip-agent/
- namespace.yaml
- serviceaccount.yaml for ops and deploy
- token-secret.yaml for each SA (type kubernetes.io/service-account-token)
- clusterrolebinding-ops-view.yaml: ops -> built-in view
- rolebindings for deploy: edit in media, monitoring, opengym
lxc/paperclip/generate-kubeconfig.sh: copy of the opencode script,
parameterised by NAMESPACE, SA_NAME, SECRET_NAME, and CONTEXT
Generate temp/paperclip-ops.kubeconfig and
temp/paperclip-deploy.kubeconfig (gitignored)

Done when

kubectl auth can-i --list --kubeconfig temp/paperclip-ops.kubeconfig
shows read verbs everywhere and no writes
the deploy kubeconfig shows edit in the three namespaces and nothing else
kubectl auth can-i delete nodes --kubeconfig ... is no for both

## Context Two agents with different cluster powers, both narrower than the workstation kubeconfig. ## Steps 1. `lxc/paperclip/manifests/paperclip-agent/` - `namespace.yaml` - `serviceaccount.yaml` for `ops` and `deploy` - `token-secret.yaml` for each SA (type `kubernetes.io/service-account-token`) - `clusterrolebinding-ops-view.yaml`: `ops` -> built-in `view` - rolebindings for `deploy`: `edit` in `media`, `monitoring`, `opengym` 2. `lxc/paperclip/generate-kubeconfig.sh`: copy of the opencode script, parameterised by `NAMESPACE`, `SA_NAME`, `SECRET_NAME`, and `CONTEXT` 3. Generate `temp/paperclip-ops.kubeconfig` and `temp/paperclip-deploy.kubeconfig` (gitignored) ## Done when - `kubectl auth can-i --list --kubeconfig temp/paperclip-ops.kubeconfig` shows read verbs everywhere and no writes - the deploy kubeconfig shows `edit` in the three namespaces and nothing else - `kubectl auth can-i delete nodes --kubeconfig ...` is `no` for both