# spring-cloud-kubernetes 是在 Pod 里调 K8s API 去读 ConfigMap 的，
# 默认的 default ServiceAccount 没有这个权限——漏了这份清单，应用启动时读配置会 403，
# 而且 reload 的轮询会每 15 秒报一次错（见 07-config-governance.md「关键规则」）。
#
# 权限严格收敛到"读所在 namespace 的 ConfigMap"这一件事：
#  - 不给 secrets 的 get/list：Secret 是通过 envFrom 由 kubelet 注入的，应用自己不需要读；
#    给了反而等于让一次 RCE 直接拿到 JWT 签名密钥。
#  - 用 Role 而不是 ClusterRole：跨 namespace 读不到，UAT 的 Pod 看不见 Prod 的配置。
#  - reload 用的是 mode: polling 而不是 event，所以不需要 watch 权限。
#
# 三个 namespace 各一份，内容相同。
apiVersion: v1
kind: ServiceAccount
metadata:
  name: conti-backend
  namespace: retailapp-dev
---
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: conti-backend-config-reader
  namespace: retailapp-dev
rules:
  - apiGroups: [""]
    resources: ["configmaps"]
    verbs: ["get", "list"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: conti-backend-config-reader
  namespace: retailapp-dev
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: conti-backend-config-reader
subjects:
  - kind: ServiceAccount
    name: conti-backend
    namespace: retailapp-dev
---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: conti-backend
  namespace: retailapp-uat
---
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: conti-backend-config-reader
  namespace: retailapp-uat
rules:
  - apiGroups: [""]
    resources: ["configmaps"]
    verbs: ["get", "list"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: conti-backend-config-reader
  namespace: retailapp-uat
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: conti-backend-config-reader
subjects:
  - kind: ServiceAccount
    name: conti-backend
    namespace: retailapp-uat
---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: conti-backend
  namespace: retailapp-prod
---
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: conti-backend-config-reader
  namespace: retailapp-prod
rules:
  - apiGroups: [""]
    resources: ["configmaps"]
    verbs: ["get", "list"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: conti-backend-config-reader
  namespace: retailapp-prod
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: conti-backend-config-reader
subjects:
  - kind: ServiceAccount
    name: conti-backend
    namespace: retailapp-prod