From 82973b58fc4c490ff890a60e76e515fdd0f40269 Mon Sep 17 00:00:00 2001
From: Marcus Noble <github@marcusnoble.co.uk>
Date: Wed, 28 Oct 2026 20:36:48 +0000
Subject: [PATCH] Added sre-agent

Signed-off-by: Marcus Noble <github@marcusnoble.co.uk>
---
 manifests/_apps/sre-agent.yaml     |  25 ++++++
 manifests/sre-agent/sre-agent.yaml | 131 +++++++++++++++++++++++++++++
 2 files changed, 156 insertions(+)
 create mode 100644 manifests/_apps/sre-agent.yaml
 create mode 100644 manifests/sre-agent/sre-agent.yaml

diff --git a/manifests/_apps/sre-agent.yaml b/manifests/_apps/sre-agent.yaml
new file mode 100644
index 0000000..4830dd8
--- /dev/null
+++ b/manifests/_apps/sre-agent.yaml
@@ -0,0 +1,25 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: sre-agent
+  namespace: argocd
+  finalizers:
+  - resources-finalizer.argocd.argoproj.io
+spec:
+  project: cluster.fun
+  destination:
+    namespace: default
+    name: cluster-fun (v2)
+  source:
+    path: manifests/sre-agent
+    repoURL: "https://git.cluster.fun/AverageMarcus/cluster.fun.git"
+    targetRevision: HEAD
+  syncPolicy:
+    automated: {}
+    syncOptions:
+      - CreateNamespace=true
+  ignoreDifferences:
+  - kind: Secret
+    jsonPointers:
+    - /data
+
diff --git a/manifests/sre-agent/sre-agent.yaml b/manifests/sre-agent/sre-agent.yaml
new file mode 100644
index 0000000..c343ea0
--- /dev/null
+++ b/manifests/sre-agent/sre-agent.yaml
@@ -0,0 +1,131 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: sre-agent
+  namespace: default
+
+---
+
+apiVersion: v1
+kind: Secret
+metadata:
+  name: sre-agent
+  namespace: default
+  annotations:
+    kubernetes.io/service-account.name: sre-agent
+type: kubernetes.io/service-account-token
+
+---
+
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: sre-agent
+  labels:
+    app.kubernetes.io/name: sre-agent
+rules:
+  # Node-level diagnostics
+  - apiGroups: [""]
+    resources: ["nodes"]
+    verbs: ["get", "list", "watch"]
+  - apiGroups: [""]
+    resources: ["nodes/proxy", "nodes/metrics", "nodes/stats"]
+    verbs: ["get", "list"]
+
+  # Pod diagnostics
+  - apiGroups: [""]
+    resources: ["pods", "pods/log", "pods/status", "pods/ephemeralcontainers"]
+    verbs: ["get", "list", "watch"]
+
+  # Services, endpoints, networking
+  - apiGroups: [""]
+    resources: ["services", "endpoints", "endpointslices", "namespaces"]
+    verbs: ["get", "list", "watch"]
+  - apiGroups: [""]
+    resources: ["persistentvolumeclaims", "persistentvolumes"]
+    verbs: ["get", "list", "watch"]
+  - apiGroups: [""]
+    resources: ["events"]
+    verbs: ["get", "list", "watch"]
+  - apiGroups: [""]
+    resources: ["configmaps", "secrets"]
+    verbs: ["get", "list"]    # readable only, no modify/delete
+  - apiGroups: [""]
+    resources: ["resourcequotas", "limitranges"]
+    verbs: ["get", "list"]
+
+  # Network policies
+  - apiGroups: ["networking.k8s.io"]
+    resources: ["*"]
+    verbs: ["get", "list", "watch"]
+  - apiGroups: ["discovery.k8s.io"]
+    resources: ["*"]
+    verbs: ["get", "list", "watch"]
+
+  # Workloads
+  - apiGroups: ["apps"]
+    resources: ["*"]
+    verbs: ["get", "list", "watch"]
+  - apiGroups: ["apps"]
+    resources: ["deployments/scale", "replicasets/scale"]
+    verbs: ["get"]
+
+  # Jobs & cronjobs
+  - apiGroups: ["batch"]
+    resources: ["*"]
+    verbs: ["get", "list", "watch"]
+  - apiGroups: ["batch"]
+    resources: ["jobs/log"]
+    verbs: ["get", "list"]
+
+  # Autoscaling
+  - apiGroups: ["autoscaling"]
+    resources: ["*"]
+    verbs: ["get", "list", "watch"]
+
+  # RBAC visibility (diagnose who owns what)
+  - apiGroups: ["rbac.authorization.k8s.io"]
+    resources: ["*"]
+    verbs: ["get", "list", "watch"]
+
+  # Custom Resource Definitions (so we can inspect custom resources)
+  - apiGroups: ["apiextensions.k8s.io"]
+    resources: ["customresourcedefinitions"]
+    verbs: ["get", "list", "watch"]
+
+  # Priority classes
+  - apiGroups: ["scheduling.k8s.io"]
+    resources: ["priorityclasses"]
+    verbs: ["get", "list"]
+
+  # Certificate rotation
+  - apiGroups: ["certificates.k8s.io"]
+    resources: ["certificatesigningrequests", "certificatesigningrequests/approval"]
+    verbs: ["get", "list", "watch"]
+
+  # Metrics Server (if installed)
+  - apiGroups: ["metrics.k8s.io"]
+    resources: ["*"]
+    verbs: ["get", "list"]
+
+  # Admission controllers / pod security (diagnostic)
+  - apiGroups: ["policy"]
+    resources: ["*"]
+    verbs: ["get", "list", "watch"]
+
+---
+
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: sre-agent-binding
+  labels:
+    app.kubernetes.io/name: sre-agent
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: sre-agent
+subjects:
+  - kind: ServiceAccount
+    name: sre-agent
+    namespace: default