Andrew Stoltz a77fbd0381 security(agent-zero): remove cluster RBAC entirely + no token mount (operator directive — MCP only) ...

Operator: agent-zero must reach the cluster ONLY through gated MCP tools, not a
service account with cluster roles for raw kubectl. Removed the read-only
ClusterRole/ClusterRoleBinding entirely (SA now has zero cluster perms) and set
automountServiceAccountToken: false so no K8s API token is mounted at all.
Applied live (SA secrets/exec/pods/namespaces -> all Forbidden); this makes it
durable so ArgoCD selfHeal won't re-create any role.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

2026-06-18 14:46:07 -05:00

..

agent-zero.yaml

security(agent-zero): remove cluster RBAC entirely + no token mount (operator directive — MCP only)

2026-06-18 14:46:07 -05:00

configmaps-bluejay.yaml

agent-zero: GX10 system prompt rewrite (tool-calling + RAG rules, strip dead lanes)

2026-06-14 13:40:25 -05:00