Date: 2026-03-19
Owner: ax_julian
Scope: Kubernetes cluster drg-k8s
Added a dedicated cluster-wide read-only identity for AutoCoder-Engine Kubernetes API access.
ServiceAccount/kubernetes-reader in namespace autocoder-engineClusterRole/kubernetes-readerClusterRoleBinding/kubernetes-readerSecret/kubernetes-reader-token (kubernetes.io/service-account-token)Read-only access across all namespaces for:
namespacespods, pods/log, eventsservices, endpoints, configmaps, persistentvolumeclaimsdeployments, replicasets, statefulsets, daemonsetsjobs, cronjobsAllowed verbs:
getlistwatchkubectl auth can-i list pods --all-namespaces --as=system:serviceaccount:autocoder-engine:kubernetes-reader => yeskubectl auth can-i patch deployments --all-namespaces --as=system:serviceaccount:autocoder-engine:kubernetes-reader => nokubectl auth can-i get secrets --all-namespaces --as=system:serviceaccount:autocoder-engine:kubernetes-reader => noAutoCoder-Engine/k8s/08-kubernetes-reader-rbac.yaml/home/ax_julian/temp/autocoder-kubernetes-reader.kubeconfigThe static token was created to satisfy a non-expiring authentication requirement. Treat the kubeconfig artifact as sensitive credential material.