apiVersion: v1
kind: ServiceAccount
metadata:
  name: sre-agent
  namespace: default

---

apiVersion: v1
kind: Secret
metadata:
  name: sre-agent
  namespace: default
  annotations:
    kubernetes.io/service-account.name: sre-agent
type: kubernetes.io/service-account-token

---

apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: sre-agent
  labels:
    app.kubernetes.io/name: sre-agent
rules:
  # Node-level diagnostics
  - apiGroups: [""]
    resources: ["nodes"]
    verbs: ["get", "list", "watch"]
  - apiGroups: [""]
    resources: ["nodes/proxy", "nodes/metrics", "nodes/stats"]
    verbs: ["get", "list"]

  # Pod diagnostics
  - apiGroups: [""]
    resources: ["pods", "pods/log", "pods/status", "pods/ephemeralcontainers"]
    verbs: ["get", "list", "watch"]

  # Services, endpoints, networking
  - apiGroups: [""]
    resources: ["services", "endpoints", "endpointslices", "namespaces"]
    verbs: ["get", "list", "watch"]
  - apiGroups: [""]
    resources: ["persistentvolumeclaims", "persistentvolumes"]
    verbs: ["get", "list", "watch"]
  - apiGroups: [""]
    resources: ["events"]
    verbs: ["get", "list", "watch"]
  - apiGroups: [""]
    resources: ["configmaps", "secrets"]
    verbs: ["get", "list"]    # readable only, no modify/delete
  - apiGroups: [""]
    resources: ["resourcequotas", "limitranges"]
    verbs: ["get", "list"]

  # Network policies
  - apiGroups: ["networking.k8s.io"]
    resources: ["*"]
    verbs: ["get", "list", "watch"]
  - apiGroups: ["discovery.k8s.io"]
    resources: ["*"]
    verbs: ["get", "list", "watch"]

  # Workloads
  - apiGroups: ["apps"]
    resources: ["*"]
    verbs: ["get", "list", "watch"]
  - apiGroups: ["apps"]
    resources: ["deployments/scale", "replicasets/scale"]
    verbs: ["get"]

  # Jobs & cronjobs
  - apiGroups: ["batch"]
    resources: ["*"]
    verbs: ["get", "list", "watch"]
  - apiGroups: ["batch"]
    resources: ["jobs/log"]
    verbs: ["get", "list"]

  # Autoscaling
  - apiGroups: ["autoscaling"]
    resources: ["*"]
    verbs: ["get", "list", "watch"]

  # RBAC visibility (diagnose who owns what)
  - apiGroups: ["rbac.authorization.k8s.io"]
    resources: ["*"]
    verbs: ["get", "list", "watch"]

  # Custom Resource Definitions (so we can inspect custom resources)
  - apiGroups: ["apiextensions.k8s.io"]
    resources: ["customresourcedefinitions"]
    verbs: ["get", "list", "watch"]

  # Priority classes
  - apiGroups: ["scheduling.k8s.io"]
    resources: ["priorityclasses"]
    verbs: ["get", "list"]

  # Certificate rotation
  - apiGroups: ["certificates.k8s.io"]
    resources: ["certificatesigningrequests", "certificatesigningrequests/approval"]
    verbs: ["get", "list", "watch"]

  # Metrics Server (if installed)
  - apiGroups: ["metrics.k8s.io"]
    resources: ["*"]
    verbs: ["get", "list"]

  # Admission controllers / pod security (diagnostic)
  - apiGroups: ["policy"]
    resources: ["*"]
    verbs: ["get", "list", "watch"]

---

apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: sre-agent-binding
  labels:
    app.kubernetes.io/name: sre-agent
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: sre-agent
subjects:
  - kind: ServiceAccount
    name: sre-agent
    namespace: default