From 6c68057e73ae5180f484860fc0d78e9f88dd68f0 Mon Sep 17 00:00:00 2001
From: Unkin Agent <unkin-agent@unkin.net>
Date: Sun, 23 Aug 2026 12:29:02 +1000
Subject: [PATCH] operator RO creds: read operator CRD API groups (#135)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

## Why

The `operator` kube context is a Vault-minted, read-only credential (Kubernetes
secret engine role `cluster-operator`, bound to a `get/list/watch`-only
ClusterRole). It is currently RBAC-forbidden from listing operator-owned CRDs —
the immediate breakage is `valkeyclusters.valkey.io` — and likewise every other
operator CRD group deployed via `argocd-apps`. This extends the RO ruleset so the
context can read those CRDs. Still strictly read-only: no create/update/delete.

## Change

- Extend the `cluster-operator` generated_role_rules
  (`resources/secret_backend/kubernetes/au/syd1/roles/cluster-operator.yaml`)
  with `get/list/watch` on the CRD API groups of the operators deployed via
  `argocd-apps` (verbs and `resources: "*"` unchanged; same single rule block).

## API groups added

- `valkey.io` (valkey-operator — immediate need)
- `ceph.unkin.net` (cephrgw-operator)
- `bind.unkin.net` (bind-operator)
- `kea.unkin.net` (kea/dhcp operator)
- `k8up.io` (k8up)
- `grafana.integreatly.org` (grafana-operator)
- `operator.victoriametrics.com` (VictoriaMetrics operator)
- `clickhouse.altinity.com`, `clickhouse-keeper.altinity.com` (altinity clickhouse-operator)
- `acme.cert-manager.io` (cert-manager companion CRD group)
- `deviceplugin.intel.com`, `fpga.intel.com` (intel device plugins operator)
- `autoscaling.k8s.io` (VPA)
- `apm.k8s.elastic.co`, `beat.k8s.elastic.co`, `agent.k8s.elastic.co`,
  `maps.k8s.elastic.co`, `enterprisesearch.k8s.elastic.co`,
  `autoscaling.k8s.elastic.co`, `stackconfigpolicy.k8s.elastic.co` (ECK — the
  `elasticsearch`/`kibana`/`logstash` ECK groups were already granted)
- `snapshot.storage.k8s.io`, `groupsnapshot.storage.k8s.io` (CSI external-snapshotter, deployed via csi-cephfs/csi-cephrbd)

Groups already present (`postgresql.cnpg.io`, `cert-manager.io`,
`externaldns.k8s.io`, `secrets.hashicorp.com`, `purelb.io`, `nfd.k8s-sigs.io`,
`elasticsearch/kibana/logstash.k8s.elastic.co`, `gateway.networking.k8s.io`,
etc.) are unchanged. Rancher/RKE/Calico/cluster-api/fleet management-layer CRD
groups are intentionally excluded — they are not `argocd-apps` operators.

---------

Co-authored-by: unkin-agent <agent@unkin.net>
Reviewed-on: https://git.unkin.net/unkin/terraform-vault/pulls/135
Co-authored-by: Unkin Agent <unkin-agent@unkin.net>
Co-committed-by: Unkin Agent <unkin-agent@unkin.net>
---
 .../au/syd1/roles/cluster-operator.yaml       | 22 +++++++++++++++++++
 1 file changed, 22 insertions(+)

diff --git a/resources/secret_backend/kubernetes/au/syd1/roles/cluster-operator.yaml b/resources/secret_backend/kubernetes/au/syd1/roles/cluster-operator.yaml
index f42fc8b..ddda80b 100644
--- a/resources/secret_backend/kubernetes/au/syd1/roles/cluster-operator.yaml
+++ b/resources/secret_backend/kubernetes/au/syd1/roles/cluster-operator.yaml
@@ -22,6 +22,28 @@ rules:
       - "elasticsearch.k8s.elastic.co"
       - "kibana.k8s.elastic.co"
       - "gateway.networking.k8s.io"
+      - "apm.k8s.elastic.co"
+      - "beat.k8s.elastic.co"
+      - "agent.k8s.elastic.co"
+      - "maps.k8s.elastic.co"
+      - "enterprisesearch.k8s.elastic.co"
+      - "autoscaling.k8s.elastic.co"
+      - "stackconfigpolicy.k8s.elastic.co"
+      - "valkey.io"
+      - "ceph.unkin.net"
+      - "bind.unkin.net"
+      - "kea.unkin.net"
+      - "k8up.io"
+      - "grafana.integreatly.org"
+      - "operator.victoriametrics.com"
+      - "clickhouse.altinity.com"
+      - "clickhouse-keeper.altinity.com"
+      - "acme.cert-manager.io"
+      - "deviceplugin.intel.com"
+      - "fpga.intel.com"
+      - "autoscaling.k8s.io"
+      - "snapshot.storage.k8s.io"
+      - "groupsnapshot.storage.k8s.io"
     resources:
       - "*"
     verbs: