Kubernetes Configuration Files

This directory contains Kubernetes configuration files and documentation that are not deployed by ArgoCD. These are infrastructure-level configurations, service account setups, and reference materials.

📁 Contents

Service Account Configuration

ai-bot-serviceaccount.yaml - ServiceAccount, Secret, Role, and RoleBinding for ai-bot
- Creates ai-bot service account in ai namespace
- Grants full access to ai namespace only
ai-bot-clusterrole.yaml - ClusterRole and ClusterRoleBinding for read-only access
- Grants read-only access (get, list, watch) to all namespaces
- Combined with the Role above, ai-bot has:
  - Full access in ai namespace
  - Read-only access in all other namespaces
ai-bot-kubeconfig.yaml - Kubeconfig file for ai-bot service account
- Pre-configured for 192.168.1.10
- Contains embedded token and CA certificate
- ⚠️ Do not commit to Git (contains credentials)

Documentation

AI-BOT-USAGE.md - User guide for ai-bot service account
- How to use kubectl, k9s, kubectx, kubens
- Permission examples and limitations
- Common commands and troubleshooting

Backups

home-cluster-admin-backup.yaml - Backup of removed ClusterRoleBinding
- Original binding that granted cluster-admin to all service accounts
- Removed for security reasons (Feb 13, 2026)
- Keep for reference in case restoration is needed

🚀 Usage

Apply Service Account Configuration

kubectl apply -f ai-bot-serviceaccount.yaml
kubectl apply -f ai-bot-clusterrole.yaml

Deploy Kubeconfig to 192.168.1.10

scp ai-bot-kubeconfig.yaml 192.168.1.10:~/
scp AI-BOT-USAGE.md 192.168.1.10:~/

🔐 Security Notes

ai-bot-kubeconfig.yaml contains sensitive credentials
- Should be in .gitignore
- Only deploy to trusted machines
- Rotate token if compromised
Service Account Permissions
- ai-bot has full access only in ai namespace
- Read-only access in all other namespaces
- Cannot escalate privileges
ClusterRoleBinding Removal
- Removed home-cluster-admin binding that granted cluster-admin to all service accounts
- Individual service accounts now need explicit permissions
- Improves security posture significantly

AI Namespace Manifests: /ai/ directory (monitored by ArgoCD)
Terraform Configuration: /terraform/ directory (includes ArgoCD's Helm values in terraform/argocd.tf)

🔄 Setup History

2026-02-13

Created ai-bot service account with restricted permissions
Removed blanket cluster-admin access from all service accounts
Set up ai-bot user on 192.168.1.10 with kubectl, k9s, kubectx, kubens
Configured zsh with KUBECONFIG environment variable and aliases

Maintainer: junv (wahyd4) Cluster: K3s on 192.168.1.2 Management Host: 192.168.1.10 (ai-bot user)

2.9 KiB Raw Blame History