# AI VM read-only identity (Terraform design 6.11): built-in ClusterRole view.
apiVersion: v1
kind: ServiceAccount
metadata:
  name: ai-reader
  namespace: demo
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: selfheal-ai-reader-view
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: view
subjects:
  - kind: ServiceAccount
    name: ai-reader
    namespace: demo