---
id: w6/m8/t003
title: "Verify logs API, env-vars API, and managed-DB Secret reads still work against a live/mock cluster after the split"
worker: worker6
status: done
estimate: 45m
depends_on: [w6/m8/t002]
---

## Objective

Confirm the RBAC split doesn't break any bex-api feature that legitimately needs secrets/pods/pods-log access.

## Context

- `scripts/mock-cluster.sh` — local mock cluster for verification.
- Features touching these resources: logs API (`internal/logs`), env-vars API (`internal/secrets`), managed Postgres/KV connection-info (`internal/postgres`, `internal/keyvalue`).

## Steps

1. Stand up (or use an existing) mock cluster with the new RBAC applied.
2. Exercise: logs query/stream for a real App, env-vars get/set, managed-Postgres connection-info read.
3. Confirm all three still succeed; confirm a request against a platform-namespace Secret (e.g. `auth`) is denied.

## Files

- none (verification task)

## Acceptance criteria

- [ ] Logs, env-vars, and managed-DB connection-info all work end-to-end against the new RBAC.
- [ ] A direct attempt to read a platform-namespace Secret via the bex-api SA is denied.

## Out of scope

- Load/performance testing.
