---
id: w6/m8/t002
title: "Implement: split lego/operator/config/api/rbac.yaml into a ClusterRole (apps-only) + Role/RoleBinding(s)"
worker: worker6
status: done
estimate: 1h
depends_on: [w6/m8/t001]
---

## Objective

Implement the RBAC split designed in t001.

## Context

- `lego/operator/config/api/rbac.yaml`
- kustomize wiring for the api RBAC (check `lego/operator/config/` for how this is assembled into the deployed manifest).

## Steps

1. Replace the single cluster-wide grant with: a `ClusterRole` scoped to `app.bex.co` resources only, plus a `Role` (or `Role`s) for `secrets`/`pods`/`pods/log` bound only in the served namespace(s) per t001's design.
2. If tenant namespaces are dynamic and a static `RoleBinding` list can't cover them, implement the label/resourceName-filtered alternative from t001.
3. Update kustomize/config wiring so the new resources are applied.

## Files

- `lego/operator/config/api/rbac.yaml`
- any kustomize `kustomization.yaml` referencing it

## Acceptance criteria

- [ ] `kubectl auth can-i get secrets --as=system:serviceaccount:<ns>:bex-api -n auth` returns `no` after applying.
- [ ] `kubectl auth can-i get secrets --as=system:serviceaccount:<ns>:bex-api -n <served-ns>` returns `yes`.
- [ ] `app.bex.co` verbs still work cluster-wide.

## Out of scope

- Verification against real running services — that's t003.
