The jobrunner Role gets its RoleBinding — a Role without one is furniture - #2070
The jobrunner Role gets its RoleBinding — a Role without one is furniture#2070rbuergi wants to merge 2 commits into
Conversation
…ture Applied live on the cluster 2026-08-22 during the first operator enablement, where the gap surfaced: SubjectAccessReview for create-jobs answered false until the binding existed (true after; delete-namespaces stays false — the boundary the three-principal design promises). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
There was a problem hiding this comment.
Pull request overview
Adds the missing Kubernetes RoleBinding for the hosting-jobrunner ServiceAccount so the portal-held token can actually exercise the existing namespaced Role permissions in memex-ops (fixing the observed 403 on the first CreateJob during operator enablement).
Changes:
- Add a namespaced
RoleBindingthat bindsServiceAccount/hosting-jobrunnertoRole/hosting-jobrunnerinmemex-ops.
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
…ps placement was unmountable A pod can only mount Secrets from its own namespace. The RoleBinding in memex-ops names the foreign SA, which is exactly what scopes the portal-held credential to jobs-only power in memex-ops while staying mountable in the portal's namespace. Both defects (no binding; wrong namespace) were found in the first live enablement, 2026-08-22, and verified fixed with SubjectAccessReviews. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Test Results (shard 4)2 109 tests ±0 1 809 ✅ - 2 9m 17s ⏱️ -1s For more details on these failures, see this check. Results for commit aa0a6fc. ± Comparison against base commit d9effcd. |
Test Results 55 files ±0 55 suites ±0 51m 20s ⏱️ +40s For more details on these failures, see this check. Results for commit aa0a6fc. ± Comparison against base commit d9effcd. |
Found during the first live operator enablement (2026-08-22):
jobrunner.yamlships the ServiceAccount, the token Secret and the Role — and no RoleBinding, so the portal's token 403s on its first CreateJob. From the mesh that reads as a misconfigured operator, not a missing binding.Verified on the cluster with SubjectAccessReview: create-jobs-in-memex-ops
falsebefore,trueafter; delete-namespaces staysfalse(the boundary the three-principal design promises). Applied live already; this lands the same binding in the manifest so the next cluster doesn't rediscover it.