# Additional, REQUIRED RBAC for every `landlock-genprof trace` run
# (internal/proposal/store.go) — see docs/roadmap.md's "Unified review
# report" / "SecurityProfileProposal" entries. Publishing the
# SecurityProfileProposal is mandatory, not opt-in: `trace` fails
# outright if it can't (missing CRD or this RBAC), rather than silently
# producing only local files.
#
# Deliberately NOT folded into deploy/rbac.yaml, same reasoning as
# deploy/rbac-history.yaml: this needs to create/update its own
# SecurityProfileProposal objects — real write access the base manifest
# doesn't have, even though its blast radius is small (it can only touch
# objects of a kind this project itself defines, never pods or
# Deployments). Still its own manifest for the same traceability reason
# as every other capability here, even though it's no longer optional.
#
# Requires deploy/crd-securityprofileproposal.yaml already applied.
# Binds to the same ServiceAccount as deploy/rbac.yaml
# (landlock-genprof-tracer, namespace landlock-genprof) — apply
# deploy/rbac.yaml first.
#
# Apply with: kubectl apply -f deploy/rbac-proposal.yaml

# internal/proposal/store.go:
#   - Get: securityprofileproposals(ns).Get(...)
#   - Save: securityprofileproposals(ns).Get(...) (to carry over
#     resourceVersion), then Create(...) or Update(...)
# Cluster-wide (ClusterRole, not Role): --namespace is chosen
# dynamically at runtime, same reasoning as deploy/rbac.yaml's
# pod-reader rule and deploy/rbac-history.yaml's history-writer rule.
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: landlock-genprof-proposal-writer
rules:
  - apiGroups: ["landlockgenprof.io"]
    resources: ["securityprofileproposals"]
    verbs: ["get", "create", "update"]
  # Separate resource under Kubernetes RBAC, even though it's the same
  # object — the status subresource (v0.2's approval-state field,
  # internal/proposal.Status) needs its own rule. Only `trace` itself
  # needs this (to stamp the initial Draft state on Create,
  # internal/proposal/store.go's Save) — the `approve`/`reject`/`review`
  # CLI commands run under the invoking user's own kubectl RBAC instead,
  # same as apply-proposal, so they need this granted separately by
  # whoever administers the cluster, not by this manifest.
  - apiGroups: ["landlockgenprof.io"]
    resources: ["securityprofileproposals/status"]
    verbs: ["update"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: landlock-genprof-proposal-writer
subjects:
  - kind: ServiceAccount
    name: landlock-genprof-tracer
    namespace: landlock-genprof
roleRef:
  kind: ClusterRole
  name: landlock-genprof-proposal-writer
  apiGroup: rbac.authorization.k8s.io