chore(KFLUXSPRT-3001): add production policies for konflux-support read access #8841
Conversation
introduces a ClusterPolicy to automatically generate the konflux-read-only-binding RoleBinding in all application namespaces, granting konflux-sre and ai-konflux-user-support view access via the konflux-viewer-user-actions ClusterRole. - The policy explicitly uses synchronize: true and background: true, overriding general Kyverno performance best practices. This is intentional to ensure non-negotiable support access: - background: true: Required for immediate retroactive application to all existing Konflux tenant namespaces. - synchronize: true: Required to make the RoleBinding self-healing. If an application user or process deletes the binding, Kyverno automatically reinstates it, guaranteeing persistent visibility for SRE/Support teams. Assisted-by: Cursor Signed-off-by: Omer Turner <[email protected]>
…ad access Add ClusterPolicy for production environment to automatically generate konflux-read-only-binding RoleBinding in tenant namespaces, granting konflux-sre and ai-konflux-user-support view access. Signed-off-by: Omer Turner <[email protected]>
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: Omeramsc The full list of commands accepted by this bot can be found here.
Needs approval from an approver in each of these files:
Approvers can indicate their approval by writing |
🤖 Gemini AI Assistant AvailableHi @Omeramsc! I'm here to help with your pull request. You can interact with me using the following commands: Available Commands
How to Use
PermissionsOnly OWNER, MEMBER, or COLLABORATOR users can trigger my responses. This ensures secure and appropriate usage. This message was automatically added to help you get started with the Gemini AI assistant. Feel free to delete this comment if you don't need assistance. |
|
🤖 Hi @Omeramsc, I've received your request, and I'm working on it now! You can track my progress in the logs for more details. |
1 participant
Add ClusterPolicy for production environment to automatically generate konflux-read-only-binding RoleBinding in tenant namespaces, granting konflux-sre and ai-konflux-user-support view access.