chemavxandClaude Fable 5
e9eb8c4ae2
El k3s.yaml del host apunta a 127.0.0.1:6443 (inalcanzable desde el pod). El script antiguo solo funcionaba porque su KUBECONFIG apuntaba a un fichero inexistente y kubectl caia en fallback al SA. Se hace explicito: unset KUBECONFIG + RBAC con apps/deployments,statefulsets get (para kubectl exec deploy/...) y se retira el mount del kubeconfig. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
24 lines
462 B
YAML
24 lines
462 B
YAML
apiVersion: rbac.authorization.k8s.io/v1
|
|
kind: ClusterRole
|
|
metadata:
|
|
name: backup-role
|
|
rules:
|
|
- apiGroups: [""]
|
|
resources:
|
|
- pods
|
|
- pods/exec
|
|
- persistentvolumeclaims
|
|
- persistentvolumes
|
|
verbs:
|
|
- get
|
|
- list
|
|
- create
|
|
# kubectl exec deploy/<nombre> resuelve el Deployment antes de elegir pod
|
|
- apiGroups: ["apps"]
|
|
resources:
|
|
- deployments
|
|
- statefulsets
|
|
verbs:
|
|
- get
|
|
- list
|