fix: add namespaces, pods/exec, pods/log to operator RBAC (#33)

The operator needs to hold all permissions it grants via the sandbox
ClusterRole. Without namespaces, pods/exec, and pods/log in the
operator's own ClusterRole, Kubernetes RBAC escalation prevention
blocks sandbox ClusterRole creation.

Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: stubbi

charts/paperclip-operator/templates/rbac.yaml

@@ -25,6 +25,15 @@ rules:
   - apiGroups: [""]
     resources: ["pods"]
     verbs: ["create", "delete", "get", "list", "patch", "watch"]
+  - apiGroups: [""]
+    resources: ["pods/exec"]
+    verbs: ["create", "get"]
+  - apiGroups: [""]
+    resources: ["pods/log"]
+    verbs: ["get"]
+  - apiGroups: [""]
+    resources: ["namespaces"]
+    verbs: ["create", "get", "list", "delete"]
   - apiGroups: [""]
     resources: ["events"]
     verbs: ["create", "patch"]

config/rbac/role.yaml

@@ -26,6 +26,15 @@ rules:
   verbs:
   - create
   - patch
+- apiGroups:
+  - ""
+  resources:
+  - namespaces
+  verbs:
+  - create
+  - delete
+  - get
+  - list
 - apiGroups:
   - ""
   resources:
@@ -37,6 +46,19 @@ rules:
   - list
   - patch
   - watch
+- apiGroups:
+  - ""
+  resources:
+  - pods/exec
+  verbs:
+  - create
+  - get
+- apiGroups:
+  - ""
+  resources:
+  - pods/log
+  verbs:
+  - get
 - apiGroups:
   - ""
   resources:

internal/controller/instance_controller.go

@@ -85,6 +85,9 @@ type InstanceReconciler struct {
 // +kubebuilder:rbac:groups="",resources=secrets,verbs=get;list;watch;create;update;patch
 // +kubebuilder:rbac:groups="",resources=serviceaccounts,verbs=get;list;watch;create;update;patch;delete
 // +kubebuilder:rbac:groups="",resources=pods,verbs=create;delete;get;list;patch;watch
+// +kubebuilder:rbac:groups="",resources=pods/exec,verbs=create;get
+// +kubebuilder:rbac:groups="",resources=pods/log,verbs=get
+// +kubebuilder:rbac:groups="",resources=namespaces,verbs=create;get;list;delete
 // +kubebuilder:rbac:groups="",resources=events,verbs=create;patch
 // +kubebuilder:rbac:groups=networking.k8s.io,resources=ingresses,verbs=get;list;watch;create;update;patch;delete
 // +kubebuilder:rbac:groups=networking.k8s.io,resources=networkpolicies,verbs=get;list;watch;create;update;patch;delete