svcforge: reference implementation

Complete working build of the system learn-python/ teaches. 164 tests, mypy --strict clean, domain coverage 99%.
2026-07-17 10:44:54 +00:00
commit 50c2fe2a1e
102 changed files with 12018 additions and 0 deletions
@@ -0,0 +1,52 @@
+{{- if .Values.rbac.create }}
+{{/*
+Hand-written, and deliberately short.
+
+Why ClusterRole and not Role: the worker's job is to `helm upgrade --install` a tenant
+release into a namespace it creates. `namespaces` is a cluster-scoped resource — a
+namespaced Role cannot grant `create` on it, and cannot grant anything inside the tenant
+namespaces either, because they do not exist when the chart is installed.
+
+What keeps this least-privilege is not the scope, it is the contents: every resource and
+verb is named, there is no `*`, no cluster-admin, and no rbac.authorization.k8s.io group.
+That last omission is the load-bearing one — the worker cannot escalate itself, because it
+cannot create a RoleBinding at all.
+
+The reconciler binds to the same role but only ever reads; it enqueues tasks, it does not
+provision, and it never deletes an orphan.
+*/}}
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: {{ include "svcforge.fullname" . }}-provisioner
+  labels:
+    {{- include "svcforge.labels" . | nindent 4 }}
+rules:
+  - apiGroups: [""]
+    resources: [namespaces]
+    verbs: [get, list, create]
+  - apiGroups: [""]
+    resources: [secrets, services, configmaps, persistentvolumeclaims, serviceaccounts]
+    verbs: [get, list, watch, create, update, patch, delete]
+  - apiGroups: [apps]
+    resources: [deployments, statefulsets]
+    verbs: [get, list, watch, create, update, patch, delete]
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: {{ include "svcforge.fullname" . }}-provisioner
+  labels:
+    {{- include "svcforge.labels" . | nindent 4 }}
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: {{ include "svcforge.fullname" . }}-provisioner
+subjects:
+  - kind: ServiceAccount
+    name: {{ include "svcforge.serviceAccountName" (dict "ctx" $ "component" "worker") }}
+    namespace: {{ .Release.Namespace }}
+  - kind: ServiceAccount
+    name: {{ include "svcforge.serviceAccountName" (dict "ctx" $ "component" "reconciler") }}
+    namespace: {{ .Release.Namespace }}
+{{- end }}