Scope rule engine rollout permissions

2026-10-20 11:35:18 +02:00
parent b4349b49c4
commit b9f832858a
3 changed files with 90 additions and 1 deletions
@@ -21,3 +21,13 @@ For source development, the Rust commands are `cargo fmt --all -- --check`,
 `cargo test --workspace`, and `cargo clippy --workspace --all-targets -- -D warnings`.
 Production builds, tests, image builds, and executable verification for this
 project are run by Gitea Actions on the existing `large` runner and Kubernetes.
+
+## Release deployment boundary
+
+The API repository owns first-time NATS and Argo Application provisioning. The
+worker release pipeline publishes this repository's versioned image and chart,
+then updates the existing `ai-spel-rule-engine` Argo Application. It uses the
+`AI_SPEL_TEST_KUBECONFIG` repository action secret, scoped to patch that one
+Argo Application and read rollout health in namespace `ai-spel`. The one-time
+service-account roles are described in `deploy/ci/namespace-scoped-rbac.yaml`;
+they do not grant database, secret, workload-write, or cluster-wide access.