# AI VM read-only identity (Terraform design 6.11): built-in ClusterRole view.
apiVersion: v1
kind: ServiceAccount
metadata:
  name: ai-reader
  namespace: demo
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: selfheal-ai-reader-view
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: view
subjects:
  - kind: ServiceAccount
    name: ai-reader
    namespace: demo
---
# nodes are cluster-scoped and outside ClusterRole view; the agent's get_k8s(nodes) tool needs read access (WP-12 selfcheck 2026-10-08)
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: selfheal-ai-reader-nodes
rules:
  - apiGroups: [""]
    resources: ["nodes"]
    verbs: ["get", "list", "watch"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: selfheal-ai-reader-nodes
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: selfheal-ai-reader-nodes
subjects:
  - kind: ServiceAccount
    name: ai-reader
    namespace: demo