From 9a544010fbc66811c8875d45d7d27635a7f024ba Mon Sep 17 00:00:00 2001
From: Brad Stein <Brad.Stein@gmail.com>
Date: Thu, 8 Jan 2026 02:31:54 -0300
Subject: [PATCH] comms: grant MAS secret bootstrap cluster role

---
 services/comms/mas-secrets-ensure-rbac.yaml | 14 ++++----------
 1 file changed, 4 insertions(+), 10 deletions(-)

diff --git a/services/comms/mas-secrets-ensure-rbac.yaml b/services/comms/mas-secrets-ensure-rbac.yaml
index 11f59c3..22ff987 100644
--- a/services/comms/mas-secrets-ensure-rbac.yaml
+++ b/services/comms/mas-secrets-ensure-rbac.yaml
@@ -1,26 +1,20 @@
 # services/comms/mas-secrets-ensure-rbac.yaml
 apiVersion: rbac.authorization.k8s.io/v1
-kind: Role
+kind: ClusterRole
 metadata:
   name: mas-secrets-ensure
-  namespace: comms
 rules:
   - apiGroups: [""]
     resources: ["secrets"]
-    verbs: ["create"]
-  - apiGroups: [""]
-    resources: ["secrets"]
-    resourceNames: ["mas-secrets-runtime"]
-    verbs: ["get", "patch", "update"]
+    verbs: ["get", "create", "patch", "update"]
 ---
 apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
+kind: ClusterRoleBinding
 metadata:
   name: mas-secrets-ensure
-  namespace: comms
 roleRef:
   apiGroup: rbac.authorization.k8s.io
-  kind: Role
+  kind: ClusterRole
   name: mas-secrets-ensure
 subjects:
   - kind: ServiceAccount