# MCP::K8s Read-Only Service Account
#
# Provides read-only access to cluster resources.
# Recommended starting point for AI assistant access.
#
# Usage:
#   kubectl apply -f readonly-serviceaccount.yaml
#   MCP_K8S_TOKEN=$(kubectl create token mcp-k8s-readonly -n mcp-k8s) \
#   MCP_K8S_SERVER=https://<your-cluster> mcp-k8s

apiVersion: v1
kind: Namespace
metadata:
  name: mcp-k8s
---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: mcp-k8s-readonly
  namespace: mcp-k8s
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: mcp-k8s-readonly
rules:
  # RBAC self-discovery (required for MCP::K8s permission detection)
  - apiGroups: ["authorization.k8s.io"]
    resources: ["selfsubjectrulesreviews"]
    verbs: ["create"]
  # Core resources: read-only
  - apiGroups: [""]
    resources:
      - pods
      - services
      - configmaps
      - endpoints
      - events
      - namespaces
      - nodes
      - persistentvolumes
      - persistentvolumeclaims
      - resourcequotas
      - limitranges
      - serviceaccounts
    verbs: ["get", "list", "watch"]
  # Pod logs
  - apiGroups: [""]
    resources: ["pods/log"]
    verbs: ["get"]
  # Apps resources: read-only
  - apiGroups: ["apps"]
    resources:
      - deployments
      - replicasets
      - statefulsets
      - daemonsets
    verbs: ["get", "list", "watch"]
  # Batch resources: read-only
  - apiGroups: ["batch"]
    resources: ["jobs", "cronjobs"]
    verbs: ["get", "list", "watch"]
  # Networking: read-only
  - apiGroups: ["networking.k8s.io"]
    resources: ["ingresses", "networkpolicies"]
    verbs: ["get", "list", "watch"]
  # Autoscaling: read-only
  - apiGroups: ["autoscaling"]
    resources: ["horizontalpodautoscalers"]
    verbs: ["get", "list", "watch"]
  # RBAC: read-only (see who has access to what)
  - apiGroups: ["rbac.authorization.k8s.io"]
    resources: ["roles", "rolebindings", "clusterroles", "clusterrolebindings"]
    verbs: ["get", "list", "watch"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: mcp-k8s-readonly
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: mcp-k8s-readonly
subjects:
  - kind: ServiceAccount
    name: mcp-k8s-readonly
    namespace: mcp-k8s