# MCP::K8s Full Operations Service Account
#
# Full access to all resources EXCEPT secrets.
# Use with caution — consider readonly or deployer roles first.
#
# Usage:
#   kubectl apply -f full-ops-serviceaccount.yaml
#   MCP_K8S_TOKEN=$(kubectl create token mcp-k8s-full-ops -n mcp-k8s) \
#   MCP_K8S_SERVER=https://<your-cluster> mcp-k8s

apiVersion: v1
kind: Namespace
metadata:
  name: mcp-k8s
---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: mcp-k8s-full-ops
  namespace: mcp-k8s
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: mcp-k8s-full-ops
rules:
  # RBAC self-discovery (required for MCP::K8s permission detection)
  - apiGroups: ["authorization.k8s.io"]
    resources: ["selfsubjectrulesreviews"]
    verbs: ["create"]
  # Core resources: full access (except secrets)
  - apiGroups: [""]
    resources:
      - pods
      - services
      - configmaps
      - endpoints
      - events
      - namespaces
      - nodes
      - persistentvolumes
      - persistentvolumeclaims
      - resourcequotas
      - limitranges
      - serviceaccounts
    verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
  # Pod logs and exec
  - apiGroups: [""]
    resources: ["pods/log"]
    verbs: ["get"]
  # Apps resources: full access
  - apiGroups: ["apps"]
    resources:
      - deployments
      - replicasets
      - statefulsets
      - daemonsets
    verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
  # Batch resources: full access
  - apiGroups: ["batch"]
    resources: ["jobs", "cronjobs"]
    verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
  # Networking: full access
  - apiGroups: ["networking.k8s.io"]
    resources: ["ingresses", "networkpolicies"]
    verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
  # Autoscaling: full access
  - apiGroups: ["autoscaling"]
    resources: ["horizontalpodautoscalers"]
    verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
  # RBAC: read-only (see who has access to what)
  - apiGroups: ["rbac.authorization.k8s.io"]
    resources: ["roles", "rolebindings", "clusterroles", "clusterrolebindings"]
    verbs: ["get", "list", "watch"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: mcp-k8s-full-ops
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: mcp-k8s-full-ops
subjects:
  - kind: ServiceAccount
    name: mcp-k8s-full-ops
    namespace: mcp-k8s