add temporary credential recovery job

2026-10-15 23:09:09 +00:00
parent 2ba48aa313
commit e9574e3317
4 changed files with 119 additions and 0 deletions
@@ -0,0 +1,16 @@
+---
+# TEMPORARY: this binding exists only long enough to replace the lost
+# administrator kubeconfig. The recovery Application's cascading finalizer
+# removes it when apps/recovery.yaml is deleted from Git.
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: credential-recovery-admin
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: cluster-admin
+subjects:
+  - kind: ServiceAccount
+    name: credential-recovery
+    namespace: credential-recovery