# Kubernetes Configuration Files

This directory contains Kubernetes configuration files and documentation that are **not** deployed by ArgoCD. These are infrastructure-level configurations, service account setups, and reference materials.

## 📁 Contents

### Service Account Configuration

- **`ai-bot-serviceaccount.yaml`** - ServiceAccount, Secret, Role, and RoleBinding for ai-bot
  - Creates `ai-bot` service account in `ai` namespace
  - Grants full access to `ai` namespace only
  
- **`ai-bot-clusterrole.yaml`** - ClusterRole and ClusterRoleBinding for read-only access
  - Grants read-only access (get, list, watch) to all namespaces
  - Combined with the Role above, ai-bot has:
    - Full access in `ai` namespace
    - Read-only access in all other namespaces

- **`ai-bot-kubeconfig.yaml`** - Kubeconfig file for ai-bot service account
  - Pre-configured for 192.168.1.10
  - Contains embedded token and CA certificate
  - ⚠️ **Do not commit to Git** (contains credentials)

### Documentation

- **`AI-BOT-USAGE.md`** - User guide for ai-bot service account
  - How to use kubectl, k9s, kubectx, kubens
  - Permission examples and limitations
  - Common commands and troubleshooting

### Backups

- **`home-cluster-admin-backup.yaml`** - Backup of removed ClusterRoleBinding
  - Original binding that granted cluster-admin to all service accounts
  - Removed for security reasons (Feb 13, 2026)
  - Keep for reference in case restoration is needed

## 🚀 Usage

### Apply Service Account Configuration

```bash
kubectl apply -f ai-bot-serviceaccount.yaml
kubectl apply -f ai-bot-clusterrole.yaml
```

### Deploy Kubeconfig to 192.168.1.10

```bash
scp ai-bot-kubeconfig.yaml 192.168.1.10:~/
scp AI-BOT-USAGE.md 192.168.1.10:~/
```

## 🔐 Security Notes

1. **ai-bot-kubeconfig.yaml** contains sensitive credentials
   - Should be in `.gitignore`
   - Only deploy to trusted machines
   - Rotate token if compromised

2. **Service Account Permissions**
   - ai-bot has full access only in `ai` namespace
   - Read-only access in all other namespaces
   - Cannot escalate privileges

3. **ClusterRoleBinding Removal**
   - Removed `home-cluster-admin` binding that granted cluster-admin to all service accounts
   - Individual service accounts now need explicit permissions
   - Improves security posture significantly

## 📋 Related

- **AI Namespace Manifests**: `/ai/` directory (monitored by ArgoCD)
- **Terraform Configuration**: `/terraform/` directory
- **ArgoCD Values**: `/argocd-values.yaml`

## 🔄 Setup History

### 2026-02-13
- Created ai-bot service account with restricted permissions
- Removed blanket cluster-admin access from all service accounts
- Set up ai-bot user on 192.168.1.10 with kubectl, k9s, kubectx, kubens
- Configured zsh with KUBECONFIG environment variable and aliases

---

**Maintainer**: junv (wahyd4)  
**Cluster**: K3s on 192.168.1.2  
**Management Host**: 192.168.1.10 (ai-bot user)
