From 01ef191482eb38d43b48b8cc37c6e240004d546f Mon Sep 17 00:00:00 2001
From: Vaibhav Pathak <vaibhav.pathak@Vaibhavs-MacBook-Air.local>
Date: Sat, 17 Jan 2026 19:09:33 +0530
Subject: [PATCH] Add comprehensive RBAC for Backstage Kubernetes plugin

Adds read access for:
- statefulsets, daemonsets (apps)
- jobs, cronjobs (batch)
- horizontalpodautoscalers (autoscaling)
- ingresses (networking.k8s.io)
- pod metrics (metrics.k8s.io)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
---
 environment-provisioner/backstage-rbac.yaml | 25 +++++++++++++++++----
 1 file changed, 21 insertions(+), 4 deletions(-)

diff --git a/environment-provisioner/backstage-rbac.yaml b/environment-provisioner/backstage-rbac.yaml
index 68b19bd..82aadf3 100644
--- a/environment-provisioner/backstage-rbac.yaml
+++ b/environment-provisioner/backstage-rbac.yaml
@@ -10,17 +10,34 @@ rules:
     resources: ["namespaces"]
     verbs: ["get", "list", "watch", "delete"]
 
-  # Read access to environment resources for display
+  # Read access to core resources for Kubernetes plugin
   - apiGroups: [""]
-    resources: ["resourcequotas", "limitranges", "pods", "services"]
+    resources: ["resourcequotas", "limitranges", "pods", "services", "configmaps", "secrets"]
     verbs: ["get", "list", "watch"]
 
+  # Apps - deployments, replicasets, statefulsets, daemonsets
   - apiGroups: ["apps"]
-    resources: ["deployments", "replicasets"]
+    resources: ["deployments", "replicasets", "statefulsets", "daemonsets"]
     verbs: ["get", "list", "watch"]
 
+  # Batch - jobs and cronjobs
+  - apiGroups: ["batch"]
+    resources: ["jobs", "cronjobs"]
+    verbs: ["get", "list", "watch"]
+
+  # Autoscaling - HorizontalPodAutoscalers
+  - apiGroups: ["autoscaling"]
+    resources: ["horizontalpodautoscalers"]
+    verbs: ["get", "list", "watch"]
+
+  # Networking - networkpolicies and ingresses
   - apiGroups: ["networking.k8s.io"]
-    resources: ["networkpolicies"]
+    resources: ["networkpolicies", "ingresses"]
+    verbs: ["get", "list", "watch"]
+
+  # Metrics - for pod metrics
+  - apiGroups: ["metrics.k8s.io"]
+    resources: ["pods"]
     verbs: ["get", "list", "watch"]
 
   # ArgoCD Applications - for cleanup when deleting environments