From c55c866b0893488a632356b39c2d2ae1f21ddfc4 Mon Sep 17 00:00:00 2001
From: jenkins <jenkins@bstein.dev>
Date: Wed, 5 Aug 2026 22:25:52 -0300
Subject: [PATCH] feat(hermes-triage-demo): least-privilege ConfigMap patch for
 in-process repair

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---
 services/hermes-triage-demo/rbac.yaml | 32 +++++++++++++++++++++++++++
 1 file changed, 32 insertions(+)

diff --git a/services/hermes-triage-demo/rbac.yaml b/services/hermes-triage-demo/rbac.yaml
index 5a2608c09..2adb94f6e 100644
--- a/services/hermes-triage-demo/rbac.yaml
+++ b/services/hermes-triage-demo/rbac.yaml
@@ -83,3 +83,35 @@ subjects:
   - kind: ServiceAccount
     name: hermes-demo-repair
     namespace: hermes-triage-demo
+---
+# The fixture repair runs in-process inside Ariadne rather than as a spawned
+# Kubernetes Job, so Ariadne's own service account needs to patch exactly one
+# ConfigMap in this namespace — nothing else.
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: ariadne-fixture-repair
+  namespace: hermes-triage-demo
+  labels:
+    app.kubernetes.io/part-of: hermes-triage-demo
+rules:
+  - apiGroups: [""]
+    resources: ["configmaps"]
+    resourceNames: ["hermes-triage-demo-fixture"]
+    verbs: ["get", "patch"]
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: ariadne-fixture-repair
+  namespace: hermes-triage-demo
+  labels:
+    app.kubernetes.io/part-of: hermes-triage-demo
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: ariadne-fixture-repair
+subjects:
+  - kind: ServiceAccount
+    name: ariadne
+    namespace: maintenance