backup: scope Soteria permissions to Longhorn mode

services/maintenance/apps/kustomization.yaml

@@ -6,6 +6,7 @@ resources:
   - metis-configmap.yaml
   - metis-data-pvc.yaml
   - soteria-configmap.yaml
+  - soteria-state-secrets.yaml
   - ariadne-serviceaccount.yaml
   - soteria-serviceaccount.yaml
   - ariadne-rbac.yaml

services/maintenance/apps/soteria-rbac.yaml

@@ -13,12 +13,9 @@ rules:
   - apiGroups: [""]
     resources: ["pods/log"]
     verbs: ["get"]
-  - apiGroups: [""]
-    resources: ["secrets"]
-    verbs: ["get", "list", "create", "update", "delete"]
   - apiGroups: ["batch"]
     resources: ["jobs"]
-    verbs: ["get", "list", "create", "delete"]
+    verbs: ["get", "list"]
   - apiGroups: ["longhorn.io"]
     resources: ["backups"]
     verbs: ["get", "list"]
@@ -35,3 +32,33 @@ subjects:
   - kind: ServiceAccount
     name: soteria
     namespace: maintenance
+---
+# Longhorn mode needs only the existing policy/usage records and B2 credential.
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: soteria-state
+  namespace: maintenance
+rules:
+  - apiGroups: [""]
+    resources: ["secrets"]
+    resourceNames: ["soteria-policies", "soteria-backup-usage"]
+    verbs: ["get", "update"]
+  - apiGroups: [""]
+    resources: ["secrets"]
+    resourceNames: ["soteria-restic"]
+    verbs: ["get"]
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: soteria-state
+  namespace: maintenance
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: soteria-state
+subjects:
+  - kind: ServiceAccount
+    name: soteria
+    namespace: maintenance

services/maintenance/apps/soteria-state-secrets.yaml

@@ -0,0 +1,19 @@
+# services/maintenance/apps/soteria-state-secrets.yaml
+# No data field: Soteria owns these values; Flux only provisions missing records.
+apiVersion: v1
+kind: Secret
+metadata:
+  name: soteria-policies
+  namespace: maintenance
+  annotations:
+    kustomize.toolkit.fluxcd.io/prune: disabled
+type: Opaque
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: soteria-backup-usage
+  namespace: maintenance
+  annotations:
+    kustomize.toolkit.fluxcd.io/prune: disabled
+type: Opaque