# Permisos para el workflow "Uptime Kuma -> K8s Auto-Restart" (2026-07-30,
# acotado el 2026-07-31 tras una review adversarial de Codex).
#
# El nodo Code lee el token proyectado de la ServiceAccount y hace un PATCH
# contra kubernetes.default.svc. Nunca habia existido ningun Role ni RoleBinding
# para n8n: el API devolvia 403 y el workflow se iba por la rama de "reinicio
# fallido". Los 23 "exitos" de workflow_statistics eran eso -- el aviso de fallo
# enviandose bien. La integracion jamas reinicio nada.
#
# SA propia y no la "default" del namespace: cualquier pod que se despliegue en
# n8n sin pedir SA hereda la default, y estos permisos cruzan namespaces.
#
# ⚠️ Esta SA va montada en el pod ENTERO de n8n, no solo en este workflow: los
# nodos Code leen el token de /var/run/secrets/..., asi que CUALQUIER workflow
# con un nodo Code hereda lo que aqui se conceda. Por eso el permiso no es
# "deployments del namespace" sino resourceNames con los 12 workloads EXACTOS
# del SERVICE_MAP. Si se anade un servicio al mapa, hay que anadirlo aqui o
# dara 403 -- deliberado: que el mapa y el permiso se muevan juntos.
#
# Antes habia un ClusterRole sin resourceNames + un RoleBinding por namespace.
# Eso permitia reiniciar CUALQUIER deployment de esos 10 namespaces. Ahora son
# Roles por namespace, cada uno con su lista cerrada.
apiVersion: v1
kind: ServiceAccount
metadata:
  name: n8n-restarter
  namespace: n8n
---
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: n8n-restarter
  namespace: n8n
rules:
  - apiGroups: ["apps"]
    resources: ["deployments"]
    resourceNames: ["n8n"]
    verbs: ["get", "patch"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: n8n-restarter
  namespace: n8n
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: n8n-restarter
subjects:
  - kind: ServiceAccount
    name: n8n-restarter
    namespace: n8n
---
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: n8n-restarter
  namespace: monitoring
rules:
  - apiGroups: ["apps"]
    resources: ["deployments"]
    resourceNames: ["kube-prometheus-stack-grafana", "uptime-kuma"]
    verbs: ["get", "patch"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: n8n-restarter
  namespace: monitoring
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: n8n-restarter
subjects:
  - kind: ServiceAccount
    name: n8n-restarter
    namespace: n8n
---
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: n8n-restarter
  namespace: homarr
rules:
  - apiGroups: ["apps"]
    resources: ["deployments"]
    resourceNames: ["homarr"]
    verbs: ["get", "patch"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: n8n-restarter
  namespace: homarr
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: n8n-restarter
subjects:
  - kind: ServiceAccount
    name: n8n-restarter
    namespace: n8n
---
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: n8n-restarter
  namespace: gitea
rules:
  - apiGroups: ["apps"]
    resources: ["statefulsets"]
    resourceNames: ["gitea"]
    verbs: ["get", "patch"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: n8n-restarter
  namespace: gitea
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: n8n-restarter
subjects:
  - kind: ServiceAccount
    name: n8n-restarter
    namespace: n8n
---
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: n8n-restarter
  namespace: authentik
rules:
  - apiGroups: ["apps"]
    resources: ["deployments"]
    resourceNames: ["authentik-server"]
    verbs: ["get", "patch"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: n8n-restarter
  namespace: authentik
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: n8n-restarter
subjects:
  - kind: ServiceAccount
    name: n8n-restarter
    namespace: n8n
---
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: n8n-restarter
  namespace: vaultwarden
rules:
  - apiGroups: ["apps"]
    resources: ["deployments"]
    resourceNames: ["vaultwarden"]
    verbs: ["get", "patch"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: n8n-restarter
  namespace: vaultwarden
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: n8n-restarter
subjects:
  - kind: ServiceAccount
    name: n8n-restarter
    namespace: n8n
---
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: n8n-restarter
  namespace: ollama
rules:
  - apiGroups: ["apps"]
    resources: ["deployments"]
    resourceNames: ["ollama"]
    verbs: ["get", "patch"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: n8n-restarter
  namespace: ollama
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: n8n-restarter
subjects:
  - kind: ServiceAccount
    name: n8n-restarter
    namespace: n8n
---
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: n8n-restarter
  namespace: ghost-en
rules:
  - apiGroups: ["apps"]
    resources: ["deployments"]
    resourceNames: ["ghost-en"]
    verbs: ["get", "patch"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: n8n-restarter
  namespace: ghost-en
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: n8n-restarter
subjects:
  - kind: ServiceAccount
    name: n8n-restarter
    namespace: n8n
---
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: n8n-restarter
  namespace: zona-exclusion
rules:
  - apiGroups: ["apps"]
    resources: ["deployments"]
    resourceNames: ["zona-exclusion"]
    verbs: ["get", "patch"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: n8n-restarter
  namespace: zona-exclusion
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: n8n-restarter
subjects:
  - kind: ServiceAccount
    name: n8n-restarter
    namespace: n8n
---
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: n8n-restarter
  namespace: argocd
rules:
  - apiGroups: ["apps"]
    resources: ["deployments"]
    resourceNames: ["argocd-repo-server", "argocd-server"]
    verbs: ["get", "patch"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: n8n-restarter
  namespace: argocd
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: n8n-restarter
subjects:
  - kind: ServiceAccount
    name: n8n-restarter
    namespace: n8n