From c6167d369f6b55642f8d2fbf55095909ef5477cd Mon Sep 17 00:00:00 2001 From: Aleksandr Albekov Date: Mon, 12 Oct 2026 21:23:01 +0200 Subject: [PATCH] Let the read-only AI account query VictoriaMetrics Writing alert rules and dashboards needs checking metric names and thresholds against real data. The read-only ServiceAccount may now GET through the service proxy to VMSingle, vmalert and Alertmanager in monitoring; nothing else, and no writes (get on services/proxy allows GET only). Co-Authored-By: Claude Opus 5.5 --- .../access/claude-readonly-monitoring.yaml | 30 +++++++++++++++++++ .../configs/access/kustomization.yaml | 1 + 2 files changed, 31 insertions(+) create mode 100644 infrastructure/configs/access/claude-readonly-monitoring.yaml diff --git a/infrastructure/configs/access/claude-readonly-monitoring.yaml b/infrastructure/configs/access/claude-readonly-monitoring.yaml new file mode 100644 index 0000000..945033d --- /dev/null +++ b/infrastructure/configs/access/claude-readonly-monitoring.yaml @@ -0,0 +1,30 @@ +# Lets the AI read metrics, alert rules and alerts: GET through the API server's service proxy to VMSingle, vmalert +# and Alertmanager only. `get` on services/proxy allows GET requests only, so nothing can be written or silenced. +# Names carry the port because the proxy URL does (/services/vmsingle-vm:8428/proxy/...). +apiVersion: rbac.authorization.k8s.io/v1 +kind: Role +metadata: + name: claude-readonly-monitoring + namespace: monitoring +rules: + - apiGroups: [""] + resources: [services/proxy] + resourceNames: + - vmsingle-vm:8428 + - vmalert-vm:8080 + - vmalertmanager-vm:9093 + verbs: [get] +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: RoleBinding +metadata: + name: claude-readonly-monitoring + namespace: monitoring +subjects: + - kind: ServiceAccount + name: claude-readonly + namespace: access +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: Role + name: claude-readonly-monitoring diff --git a/infrastructure/configs/access/kustomization.yaml b/infrastructure/configs/access/kustomization.yaml index 1a5f6b4..bb59ec7 100644 --- a/infrastructure/configs/access/kustomization.yaml +++ b/infrastructure/configs/access/kustomization.yaml @@ -9,3 +9,4 @@ labels: resources: - claude-readonly.yaml - claude-readonly-extra.yaml + - claude-readonly-monitoring.yaml