Automate tenant-scoped service accounts & kubeconfigs #46

New issue

Open

opened 2025-09-01 14:20:02 +00:00 by chris · 0 comments

chris commented

2025-09-01 14:20:02 +00:00

Owner

Description

Provide a script or controller that creates a namespace, a serviceaccount limited to that namespace, and generates a short-lived kubeconfig token for runner jobs.

Priority: P0
Estimate: 6 hours
Acceptance criteria

A generated kubeconfig can only perform operations inside the tenant namespace.
Attempts to access other namespaces fail.

Description - Provide a script or controller that creates a namespace, a serviceaccount limited to that namespace, and generates a short-lived kubeconfig token for runner jobs. Priority: P0 Estimate: 6 hours Acceptance criteria - A generated kubeconfig can only perform operations inside the tenant namespace. - Attempts to access other namespaces fail.