# Additional, OPT-IN RBAC for `landlock-genprof trace --history`
# (internal/history/store.go) — see docs/policy-synthesis.md.
#
# Deliberately NOT folded into deploy/rbac.yaml: that manifest is
# read-only (`get` on pods only). --history needs to create/update its
# own TrainingHistory objects — real write access the base manifest
# doesn't have, even though its blast radius is far smaller than
# --restart's (it can only touch objects of a kind this project itself
# defines, never pods or Deployments).
#
# Requires deploy/crd-traininghistory.yaml already applied. Binds to the
# same ServiceAccount as deploy/rbac.yaml (landlock-genprof-tracer,
# namespace landlock-genprof) — apply deploy/rbac.yaml first.
#
# Apply with: kubectl apply -f deploy/rbac-history.yaml

# internal/history/store.go:
#   - Get: traininghistories(ns).Get(...)
#   - Save: traininghistories(ns).Get(...) (to carry over
#     resourceVersion), then Create(...) or Update(...)
# Cluster-wide (ClusterRole, not Role): --namespace is chosen
# dynamically at runtime, same reasoning as deploy/rbac.yaml's
# pod-reader rule.
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: landlock-genprof-history-writer
rules:
  - apiGroups: ["landlockgenprof.io"]
    resources: ["traininghistories"]
    verbs: ["get", "create", "update"]
  - apiGroups: ["landlockgenprof.io"]
    resources: ["observationcontributionreceipts"]
    verbs: ["get", "create", "update"]
  - apiGroups: ["landlockgenprof.io"]
    resources: ["observationcontributionreceipts/status"]
    verbs: ["update"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: landlock-genprof-history-writer
subjects:
  - kind: ServiceAccount
    name: landlock-genprof-tracer
    namespace: landlock-genprof
roleRef:
  kind: ClusterRole
  name: landlock-genprof-history-writer
  apiGroup: rbac.authorization.k8s.io