# RBAC for the signing-service's K8s TokenReview path (DEV-609).
#
# The signing-service verifies the caller's workload identity by handing the
# `X-Workload-Token` header to the Kubernetes API server as a TokenReview.
# That requires create on `tokenreviews.authentication.k8s.io`, which is
# NOT part of any default role, so we grant it via a dedicated ClusterRole.
#
# The ClusterRole is intentionally narrow: `tokenreviews` + `subjectaccessreviews`
# so the service can also diagnose "the token authenticated as X, is X allowed
# Y?" patterns in Phase 2 without a second RBAC update.
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: signing-service-tokenreview
  labels:
    app.kubernetes.io/name: signing-service
    app.kubernetes.io/part-of: proofedmesh
    app.kubernetes.io/component: trust-core
rules:
  - apiGroups: ["authentication.k8s.io"]
    resources: ["tokenreviews"]
    verbs: ["create"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: signing-service-tokenreview
  labels:
    app.kubernetes.io/name: signing-service
    app.kubernetes.io/part-of: proofedmesh
    app.kubernetes.io/component: trust-core
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: signing-service-tokenreview
subjects:
  - kind: ServiceAccount
    name: signing-service
    namespace: agent-trust