unkin/argocd-apps
3
0
Fork 0
Code Issues 7 Pull Requests 6 Actions Packages Projects Releases Wiki Activity

Add agent-observability service account and namespace-scoped RBAC #497

Closed
unkin-agent wants to merge 1 commits from benvin/agent-observability-rbac into main
pull from: benvin/agent-observability-rbac
merge into: unkin:main
Conversation 1 Commits 1 Files Changed 6
+85
unkin-agent commented 2026-09-27 00:38:51 +10:00
Member
Copy Link
Copy Source

The VictoriaMetrics/VictoriaLogs stack has no agent service account, so fixing a stale operator-managed Deployment there needs an admin context. This supplies the identity the agent-observability Vault role mints tokens for.

  • add the agent-observability service account in vm-system
  • add an agent-observability ClusterRole: patch/update on workloads and VictoriaMetrics CRs, pod delete for rolling restarts, read-only on services, configmaps, endpoints, events and Gateway API routes
  • bind the service account to it per namespace in vm-system, observability and logging

Requires terraform-vault #156 for the creds path.

The VictoriaMetrics/VictoriaLogs stack has no agent service account, so fixing a stale operator-managed Deployment there needs an admin context. This supplies the identity the agent-observability Vault role mints tokens for. - add the agent-observability service account in vm-system - add an agent-observability ClusterRole: patch/update on workloads and VictoriaMetrics CRs, pod delete for rolling restarts, read-only on services, configmaps, endpoints, events and Gateway API routes - bind the service account to it per namespace in vm-system, observability and logging Requires terraform-vault #156 for the creds path.
unkin-agent added 1 commit 2026-09-27 00:38:51 +10:00
add agent-observability service account and namespace-scoped RBAC
ci/woodpecker/pr/vector-test Pipeline was successful
Details
ci/woodpecker/pr/pre-commit Pipeline was successful
Details
ci/woodpecker/pr/kubeconform Pipeline was successful
Details
d4a39c44e6
unkin-agent commented 2026-09-27 10:04:02 +10:00
Author
Member
Copy Link
Copy Source

Closing: the agent-observability RBAC is generated by Vault in terraform-vault #156, so no in-cluster ServiceAccount or bindings are needed.

Closing: the agent-observability RBAC is generated by Vault in terraform-vault #156, so no in-cluster ServiceAccount or bindings are needed.
unkin-agent closed this pull request 2026-09-27 10:04:02 +10:00
All checks were successful
ci/woodpecker/pr/vector-test Pipeline was successful
Details
ci/woodpecker/pr/pre-commit Pipeline was successful
Required
Details
ci/woodpecker/pr/kubeconform Pipeline was successful
Required
Details

Pull request closed

Please reopen this pull request to perform a merge.
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
No items
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
benvin (BenVincent) unkin-agent (Unkin Agent) unkinben (Ben Vincent)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: unkin/argocd-apps#497
Delete Branch "benvin/agent-observability-rbac"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?