demo seed change 3

infrastructure/kubernetes/base/kustomization.yaml

@@ -41,6 +41,7 @@ resources:
   - migrations/orchestrator-migration-job.yaml
   - migrations/ai-insights-migration-job.yaml
   - migrations/distribution-migration-job.yaml
+  - migrations/demo-seed-rbac.yaml
 
   # External data initialization job (v2.0)
   - jobs/external-data-init-job.yaml

infrastructure/kubernetes/base/migrations/demo-seed-rbac.yaml

@@ -0,0 +1,32 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: demo-seed-sa
+  namespace: bakery-ia
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: demo-seed-role
+  namespace: bakery-ia
+rules:
+- apiGroups: [""]
+  resources: ["secrets"]
+  verbs: ["get", "list"]
+- apiGroups: [""]
+  resources: ["pods"]
+  verbs: ["get", "list", "watch"]
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: demo-seed-rolebinding
+  namespace: bakery-ia
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: demo-seed-role
+subjects:
+- kind: ServiceAccount
+  name: demo-seed-sa
+  namespace: bakery-ia