# AI Bot Kubernetes Access Guide

## Overview
This service account provides **full access to the `ai` namespace only** on the K3s cluster at 192.168.1.2.

## Quick Start

### 1. Set Environment Variable
```bash
export KUBECONFIG=~/ai-bot-kubeconfig.yaml
```

Or add to your `~/.bashrc` or `~/.zshrc`:
```bash
echo 'export KUBECONFIG=~/ai-bot-kubeconfig.yaml' >> ~/.bashrc
source ~/.bashrc
```

### 2. Verify Access
```bash
# Check current context
kubectl config current-context

# List pods in ai namespace
kubectl get pods

# View all resources in ai namespace
kubectl get all
```

## What You Can Do

✅ **Full access in `ai` namespace:**
- Create, read, update, delete any resources (pods, deployments, services, etc.)
- View logs: `kubectl logs <pod-name>`
- Execute commands: `kubectl exec -it <pod-name> -- /bin/bash`
- Port forward: `kubectl port-forward <pod-name> 8080:80`

✅ **Read-only access to ALL other namespaces:**
- List and view resources: `kubectl get pods -n kube-system`
- Describe resources: `kubectl describe deployment -n media`
- View logs: `kubectl logs <pod-name> -n default`
- Watch resources: `kubectl get pods -n home-apps --watch`

❌ **Cannot modify other namespaces:**
- Cannot create, update, or delete resources outside `ai` namespace
- Cannot apply manifests to other namespaces
- Cannot execute commands in pods outside `ai` namespace

## Common Commands

```bash
# List all pods in ai namespace (default)
kubectl get pods

# List pods in other namespaces (read-only)
kubectl get pods -n kube-system
kubectl get pods -n media
kubectl get pods --all-namespaces

# Switch namespace context
kubens default  # View resources in default
kubens ai       # Back to ai namespace

# List available contexts
kubectx

# Create resources (only works in ai namespace)
kubectl create deployment myapp --image=nginx
kubectl apply -f myapp.yaml

# View logs (works in all namespaces)
kubectl logs -f <pod-name>
kubectl logs <pod-name> -n kube-system

# Describe resources (works in all namespaces)
kubectl describe pod <pod-name>
kubectl describe deployment <name> -n media

# Delete resources (only works in ai namespace)
kubectl delete pod <pod-name>
kubectl delete deployment <name>

# Use k9s (interactive UI)
k9s
```

## Using k9s

K9s is an interactive terminal UI for Kubernetes:
```bash
k9s
```

Key shortcuts:
- `:pods` - View pods
- `:deploy` - View deployments
- `:svc` - View services
- `Ctrl+A` - Show all namespaces (but you'll only see `ai`)
- `?` - Help menu
- `Ctrl+C` - Exit

## Troubleshooting

### "Forbidden" or "Access Denied" errors
You're trying to access resources outside the `ai` namespace. Check your namespace:
```bash
kubectl config get-contexts
```

### Connection issues
Ensure you can reach the cluster:
```bash
curl -k https://192.168.1.2:6443
```

## Files Location
- **Kubeconfig**: `~/ai-bot-kubeconfig.yaml`
- **This guide**: `~/AI-BOT-USAGE.md`

## Service Account Details
- **Name**: `ai-bot`
- **Namespace**: `ai`
- **Cluster**: `https://192.168.1.2:6443`
- **Token**: Embedded in kubeconfig (long-lived secret)
