[pmoust]

The ClusterRole now grants get, list and watch on mutatingwebhookconfigurations and validatingwebhookconfigurations (admissionregistration.k8s.io). The change is in templates/rbac.yaml and manifests.yaml. The edge agent needs watch to run informers for both kinds.

brain-go#5349 adds these configurations to the investigation's namespace scan. The scan lists the ones that cover pod CREATE in the namespace and checks which of them fire for the scanned pods' labels. On SREGym this let the agent name the webhook that changed the pods' resources: mutating_webhook went from 0 of 3 passes to 3 of 3 (run-20261106-1558-df2d6341 and run-20261106-2206-ea47b274). Without list on both kinds, the scan only says it could not read them.

A webhook configuration holds a public CA bundle and a service or URL reference. It holds no credential, and brain-go does not show the CA bundle or URL paths to the model.

brain-go's direct Kubernetes connection uses its own credentials, not this ServiceAccount. For an edge-only install, the edge agent will watch both kinds and push them to brain-go; that agent change is tracked separately. Until it ships, this grant has no reader.

Tests: a new case in tests/rbac_test.yaml, a new check in tests/manifests/check.sh (passes locally), and helm lint passes. I couldn't run helm unittest locally (plugin not installed); CI runs it.

[pmoust]

@claude-fleet review

[claude-fleet]

Review task queued.

Task: 01b725fc-5459-42f2-adfc-fdcb45875569
Commit: bc2fab3
Model: claude-opus-5 (effort medium)
Executor: rp1
Status: done. Review posted.

[claude-fleet]

No findings.

Approve: no blocking or should_fix finding.

Verified:

• Both grant sites carry the identical rule, inserted after the Calico rule — templates/rbac.yaml:33-35, manifests.yaml:106-108
• New helm unittest case asserts the full rule (both kinds, all three verbs) — tests/rbac_test.yaml:45-55
• The new check.sh assertion is tight in both directions, not just presence — tests/manifests/check.sh:37-40
• Description claim "the change is in templates/rbac.yaml and manifests.yaml" matches the diff; no other file grants or documents RBAC (README has no permission list, values.yaml:210-222 lists only agent-collectable opt-in kinds)
• Not adding a values.yaml entry is correct here: that list names config.kube.resources kinds the agent can collect, and the description says the agent change ships separately

Checks run:

• Replayed the new jq filter against a hand-built ClusterRole document (jq only; no yq/helm in this workspace): passes as written; fails when the rule is absent, when watch is dropped, when only mutatingwebhookconfigurations is listed, and when the verbs are reordered. index() returning 0 for a first-position match is truthy in jq, so the first-element case is not a false negative.

Smaller things:

• The PR title still says "get and list"; the head commit bc2fab3 adds watch and the body describes it. Retitle before merge so the squash message is accurate.
• The branch is based on ce8453e; main has since merged #22, which appends gateway.networking.k8s.io and traefik.io rules at the same spot (origin/main:templates/rbac.yaml:33-38) and the same spot in manifests.yaml. Expect a conflict on rebase — the resolution should keep all three rule blocks, and tests/manifests/check.sh likewise.
• The grant is cluster-wide read on both webhook kinds with no values gate. That matches how the Calico and routing grants are handled, and the role already grants cluster-wide read on secrets (templates/rbac.yaml:8-10), so this adds no meaningful reach. Noting it only so the pattern stays a deliberate choice.

Not checked:

• helm lint, helm unittest and an end-to-end tests/manifests/check.sh run — no helm or yq in this workspace. CI covers all three.
• brain-go#5349, the namespace-scan behavior, and the SREGym run results (run-20261106-1558-df2d6341, run-20261106-2206-ea47b274) — outside this repository.
• The claim that brain-go does not surface the CA bundle or webhook URL to the model.

Not checked:

• helm lint, helm unittest and a full tests/manifests/check.sh run (helm and yq are not installed in this workspace; CI runs them)
• brain-go#5349, the namespace scan behavior and the cited SREGym runs — outside this repository
• the claim that brain-go does not show the CA bundle or webhook URL paths to the model

Task 01b725fc-5459-42f2-adfc-fdcb45875569 on rp1, model claude-opus-5, effort medium.

[pmoust]

@claude-fleet review

[claude-fleet]

Review task queued.

Task: 5cbb21d2-65ee-4e04-a161-188c9c9d4222
Commit: 0175464
Model: claude-opus-5 (effort medium)
Executor: rp1
Status: done. Review posted.

[claude-fleet]

Previous round at bc2fab3: no findings.

No findings.

Review complete.

Approve: no findings.

The PR diff against the merge base (61293e1) is four files and 24 added lines. Previous review was at bc2fab3, a pre-rebase head; that commit is reachable, but the diff from it to HEAD is dominated by main's 0.8.0 release and the routing-kinds PR (#22), so I classified against the current head. The previous review had no findings, so there is nothing to carry forward.

Verified:

• The ClusterRole rule is identical in the template and the standalone manifest — templates/rbac.yaml:39-41 and manifests.yaml:112-114; same apiGroup, same two resources, verbs get, list, watch.
• The rule sits before {{- with .Values.rbac.extraRules }}, so operator-supplied rules still append after it — templates/rbac.yaml:42-44.
• No pre-existing admissionregistration.k8s.io rule anywhere, so this is not a second copy: a tree-wide grep hits only the four changed files.
• The grant is read-only. No create/update/patch/delete, so the agent cannot install or alter a webhook — templates/rbac.yaml:41.
• The new helm-unittest case matches the file's existing shape (documentSelector on kind: ClusterRole, contains with a full rule map) — tests/rbac_test.yaml:68-78.
• tests/render/ only renders templates/configmap.yaml (tests/render/run.sh:50), so no render case needed updating for a ClusterRole change.
• No Chart.yaml bump, matching the repo's pattern: #22 added routing kinds with no bump and 0ac25c2 chore(chart): release 0.8.0 did the bump separately.

Checks run:

• helm, helm unittest and yq are not installed here, so tests/manifests/check.sh cannot run end to end. Instead I extracted the ClusterRole from manifests.yaml and ran the new check's jq program against it verbatim: prints true, exit 0. With the admissionregistration.k8s.io rule deleted from that JSON, the same program exits 4 (no output), so the check does fail without the change rather than passing vacuously.
• Confirmed the index(...) conjunction is not a false pass: index("mutatingwebhookconfigurations") is 0 for the first element, and 0 is truthy in jq, so the and chain is sound.

Smaller things:

• The PR title says "get and list" while the grant, the commit subject and the body all say get, list, watch. The title is the stale one.
• The values.yaml opt-in comment block (values.yaml:222-237) says "The ClusterRole already grants get, list and watch on them" and lists each opt-in kind; the two webhook kinds are now granted but not listed. That matches the body's statement that the grant has no reader yet — worth adding to that block when the edge agent change ships, so the comment stays true about what the ClusterRole covers.

Not checked:

• helm lint and helm unittest (helm not installed in this workspace); CI covers them.
• tests/manifests/check.sh as a whole (yq not installed) — only the new jq assertion, as described above.
• brain-go#5349 and the SREGym run results cited in the description; neither is reachable from this repo.

Not checked:

• helm lint and helm unittest (helm not installed in the review workspace; CI runs them)
• tests/manifests/check.sh end to end (yq not installed); only the new jq assertion was exercised, against a ClusterRole extracted from manifests.yaml
• brain-go#5349 and the cited SREGym run results, not reachable from this repository

Task 5cbb21d2-65ee-4e04-a161-188c9c9d4222 on rp1, model claude-opus-5, effort medium.