A durable, namespace-scoped read credential was added for administrator inspection of TheWell dev on the Phoeniqs Basel OpenShift cluster. This supports capacity, ownership, and rollout checks without reusing a one-hour personal token.
The pre-existing ServiceAccount thewell-readonly-audit and RoleBinding thewell-readonly-audit-view already bound it to the view ClusterRole in d03849-skan-ag-dev. This change created Secret thewell-readonly-audit-access of type kubernetes.io/service-account-token for that account. No role or role binding was changed.
The credential is stored only in /home/ax_julian/.codex/secrets/thewell-phoeniqs-dev-readonly.kubeconfig (owner ax_julian, mode 0600). Operators can use /home/ax_julian/.local/bin/thewell-dev-kubectl to select this context explicitly. No token value is stored in this page or a repository.
The new credential authenticated as system:serviceaccount:d03849-skan-ag-dev:thewell-readonly-audit and read compute-resources-quota. Access checks returned no for getting Secrets, creating Deployments, and deleting PVCs in the namespace. Its JWT had no expiry claim; the Secret remains the revocation point. The temporary personal-token kubeconfig was removed after verification.
At inspection, the namespace had 7/10 pods, 1275m/1500m CPU limit, 7624Mi/8Gi memory limit, and 101852Mi/100Gi storage requests. This is an observation, not approval to delete data or workloads.
Owner: ax_julian administrator profile. Purpose: TheWell dev read-only inspection. Local credential growth is bounded to one small kubeconfig; retain while the authorized work needs it and review/revoke afterward. To revoke access, delete Secret thewell-readonly-audit-access in d03849-skan-ag-dev, then remove the local kubeconfig and wrapper. Preserve the pre-existing ServiceAccount and RoleBinding unless their owner separately retires them.