Applied a one-time RBAC update in cluster for the email-assistant namespace so the email-assistant-ci service account can manage the resources required by the M365 bridge pull workflow.
The M365 Bridge Pull workflow was failing during bridge runtime input creation because system:serviceaccount:email-assistant:email-assistant-ci could not read or update the m365-mail-bridge-client Secret. The same service account also lacked permission to create batch/v1 Jobs for the in-cluster bridge runner.
Applied the Role update with an admin-capable kubeconfig from drg-k8s using /etc/kubernetes/admin.conf.
Effective Role/email-assistant-ci additions in namespace email-assistant:
secrets: get, list, watch, create, update, patchjobs: get, list, watch, create, update, patch, deleteValidated with the CI kubeconfig identity after the change:
kubectl auth can-i get secrets -n email-assistant => yeskubectl auth can-i patch secrets -n email-assistant => yeskubectl auth can-i create jobs.batch -n email-assistant => yesM365 Bridge Pull workflow and confirm the first real bridge pull completes.