# The read-only ClusterRole VirtualSutra AI scans a Kubernetes cluster with, and its binding.
#
# It can list the objects a scan looks at (namespaces, pods, the workloads that own them, network
# policies and cluster role bindings) and nothing else: no Secrets, no ConfigMaps, nothing that writes.
#
# EKS: create an access entry that maps the scan's IAM role to the group below, then apply this file:
#   aws eks create-access-entry --cluster-name <CLUSTER_NAME> --principal-arn <ROLE_ARN> --kubernetes-groups vsutra-readonly
#   kubectl apply -f vsutra-readonly-clusterrole.yaml
# GKE: replace the binding's subject with the scanning service account:
#   - kind: User
#     apiGroup: rbac.authorization.k8s.io
#     name: <SERVICE_ACCOUNT_EMAIL>
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: vsutra-scanner-read
rules:
  - apiGroups: [""]
    resources: ["namespaces", "pods"]
    verbs: ["list"]
  - apiGroups: ["apps"]
    resources: ["daemonsets", "deployments", "replicasets", "statefulsets"]
    verbs: ["list"]
  - apiGroups: ["batch"]
    resources: ["cronjobs", "jobs"]
    verbs: ["list"]
  - apiGroups: ["networking.k8s.io"]
    resources: ["networkpolicies"]
    verbs: ["list"]
  - apiGroups: ["rbac.authorization.k8s.io"]
    resources: ["clusterrolebindings"]
    verbs: ["list"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: vsutra-scanner-read
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: vsutra-scanner-read
subjects:
  - kind: Group
    apiGroup: rbac.authorization.k8s.io
    name: vsutra-readonly