# Orchestrator Role
# Permissions for spawning and managing agent Jobs
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: roboco-orchestrator
  namespace: roboco
  labels:
    app.kubernetes.io/name: roboco-orchestrator
    app.kubernetes.io/component: orchestrator
rules:
  # Create/manage agent Jobs
  - apiGroups: ["batch"]
    resources: ["jobs"]
    verbs: ["create", "delete", "get", "list", "watch", "patch"]
  # Watch pods for job status
  - apiGroups: [""]
    resources: ["pods"]
    verbs: ["get", "list", "watch"]
  # Read pod logs for debugging
  - apiGroups: [""]
    resources: ["pods/log"]
    verbs: ["get"]
  # Manage ConfigMaps for agent configs (MCP configs, prompts)
  - apiGroups: [""]
    resources: ["configmaps"]
    verbs: ["create", "delete", "get", "list", "update", "patch"]
  # Read secrets for agent environment (API keys)
  - apiGroups: [""]
    resources: ["secrets"]
    verbs: ["get"]