Created the email-assistant-ci service account pattern for EmailAssistant, matching the namespace-scoped CI deployer approach already used by autocoder-engine and bodylog.
Applied the following objects in namespace email-assistant:
ServiceAccount/email-assistant-ciSecret/email-assistant-ci-tokenRole/email-assistant-ciRoleBinding/email-assistant-ciApplied the following cluster-scoped objects:
ClusterRole/email-assistant-ci-namespaceClusterRoleBinding/email-assistant-ci-namespaceNamespace-scoped apply permissions for the EmailAssistant manifests:
pods: get, list, watchconfigmaps: get, list, watch, create, update, patchservices: get, list, watch, create, update, patchpersistentvolumeclaims: get, list, watch, create, update, patchdeployments: get, list, watch, create, update, patchreplicasets: get, list, watch, create, update, patchCluster-scoped permission limited to namespace object email-assistant:
namespaces/email-assistant: get, patch, updateemail-assistant-cikubectl get pods -n email-assistant works with that kubeconfigkubectl apply --dry-run=server -k /home/ax_julian/EmailAssistant/k8s succeeds with that kubeconfigPaste the generated single-line base64 kubeconfig from /home/ax_julian/temp/email-assistant-ci.kubeconfig.base64 into the Gitea repository secret KUBECONFIG_BASE64 for ax_bechju1/EmailAssistant.