From 1887727a04af7472d0ebbbb432fa86bba7b60bab Mon Sep 17 00:00:00 2001
From: unkin-agent <unkin-agent@unkin.net>
Date: Sun, 27 Sep 2026 00:36:28 +1000
Subject: [PATCH 1/3] add agent-observability kubernetes creds role and policy

---
 .../kubernetes/au/syd1/agent-observability.yaml      |  6 ++++++
 .../au/syd1/creds/agent-observability.yaml           | 12 ++++++++++++
 2 files changed, 18 insertions(+)
 create mode 100644 config/kubernetes_secret_backend_role/kubernetes/au/syd1/agent-observability.yaml
 create mode 100644 policies/kubernetes/au/syd1/creds/agent-observability.yaml

diff --git a/config/kubernetes_secret_backend_role/kubernetes/au/syd1/agent-observability.yaml b/config/kubernetes_secret_backend_role/kubernetes/au/syd1/agent-observability.yaml
new file mode 100644
index 0000000..d588b8f
--- /dev/null
+++ b/config/kubernetes_secret_backend_role/kubernetes/au/syd1/agent-observability.yaml
@@ -0,0 +1,6 @@
+allowed_kubernetes_namespaces:
+  - "vm-system"
+  - "observability"
+  - "logging"
+service_account_name: "agent-observability"
+extra_labels: {}
diff --git a/policies/kubernetes/au/syd1/creds/agent-observability.yaml b/policies/kubernetes/au/syd1/creds/agent-observability.yaml
new file mode 100644
index 0000000..b5ff35a
--- /dev/null
+++ b/policies/kubernetes/au/syd1/creds/agent-observability.yaml
@@ -0,0 +1,12 @@
+# Allow access to agent-observability Kubernetes credentials
+---
+rules:
+  - path: "kubernetes/au/syd1/creds/agent-observability"
+    capabilities:
+      - update
+
+auth:
+  ldap:
+    - kubernetes_au_syd1_cluster_operator
+  approle:
+    - agents
-- 
2.47.3


From 2feb24ac8868078cc82cf82ffa99e29cbdc832db Mon Sep 17 00:00:00 2001
From: unkin-agent <unkin-agent@unkin.net>
Date: Sun, 27 Sep 2026 00:43:36 +1000
Subject: [PATCH 2/3] scope agent-observability creds role to vm-system

---
 .../kubernetes/au/syd1/agent-observability.yaml                 | 2 --
 1 file changed, 2 deletions(-)

diff --git a/config/kubernetes_secret_backend_role/kubernetes/au/syd1/agent-observability.yaml b/config/kubernetes_secret_backend_role/kubernetes/au/syd1/agent-observability.yaml
index d588b8f..f9ffd63 100644
--- a/config/kubernetes_secret_backend_role/kubernetes/au/syd1/agent-observability.yaml
+++ b/config/kubernetes_secret_backend_role/kubernetes/au/syd1/agent-observability.yaml
@@ -1,6 +1,4 @@
 allowed_kubernetes_namespaces:
   - "vm-system"
-  - "observability"
-  - "logging"
 service_account_name: "agent-observability"
 extra_labels: {}
-- 
2.47.3


From 0d66106cd5744276b82a0647857abdb145241a32 Mon Sep 17 00:00:00 2001
From: unkin-agent <unkin-agent@unkin.net>
Date: Sun, 27 Sep 2026 10:03:25 +1000
Subject: [PATCH 3/3] generate agent-observability role rules in vault instead
 of static RBAC

---
 .../au/syd1/agent-observability.yaml          |  4 +-
 .../au/syd1/roles/agent-observability.yaml    | 62 +++++++++++++++++++
 2 files changed, 65 insertions(+), 1 deletion(-)
 create mode 100644 resources/secret_backend/kubernetes/au/syd1/roles/agent-observability.yaml

diff --git a/config/kubernetes_secret_backend_role/kubernetes/au/syd1/agent-observability.yaml b/config/kubernetes_secret_backend_role/kubernetes/au/syd1/agent-observability.yaml
index f9ffd63..2451cca 100644
--- a/config/kubernetes_secret_backend_role/kubernetes/au/syd1/agent-observability.yaml
+++ b/config/kubernetes_secret_backend_role/kubernetes/au/syd1/agent-observability.yaml
@@ -1,4 +1,6 @@
 allowed_kubernetes_namespaces:
   - "vm-system"
-service_account_name: "agent-observability"
+  - "observability"
+  - "logging"
+kubernetes_role_type: "Role"
 extra_labels: {}
diff --git a/resources/secret_backend/kubernetes/au/syd1/roles/agent-observability.yaml b/resources/secret_backend/kubernetes/au/syd1/roles/agent-observability.yaml
new file mode 100644
index 0000000..0ae5174
--- /dev/null
+++ b/resources/secret_backend/kubernetes/au/syd1/roles/agent-observability.yaml
@@ -0,0 +1,62 @@
+---
+rules:
+  # Verbs are listed explicitly rather than "*": delete on a VLCluster reclaims
+  # its cephrbd-fast-delete PVCs, destroying the log store.
+  - apiGroups:
+      - "operator.victoriametrics.com"
+    resources:
+      - "*"
+    verbs:
+      - "get"
+      - "list"
+      - "watch"
+      - "create"
+      - "patch"
+      - "update"
+  - apiGroups:
+      - "apps"
+    resources:
+      - "deployments"
+      - "statefulsets"
+      - "daemonsets"
+    verbs:
+      - "get"
+      - "list"
+      - "watch"
+      - "patch"
+      - "update"
+  - apiGroups:
+      - ""
+    resources:
+      - "pods"
+    verbs:
+      - "get"
+      - "list"
+      - "watch"
+      - "delete"
+  - apiGroups:
+      - ""
+    resources:
+      - "pods/log"
+    verbs:
+      - "get"
+  - apiGroups:
+      - ""
+    resources:
+      - "services"
+      - "configmaps"
+      - "endpoints"
+      - "events"
+    verbs:
+      - "get"
+      - "list"
+      - "watch"
+  - apiGroups:
+      - "gateway.networking.k8s.io"
+    resources:
+      - "gateways"
+      - "httproutes"
+    verbs:
+      - "get"
+      - "list"
+      - "watch"
-- 
2.47.3