soteria/deploy/NOTES.md

Default deployment permissions

This deployment uses the Longhorn backend. It reads inventory across namespaces and updates only soteria-policies and soteria-backup-usage in its own namespace. The empty Secret declarations create those records on first deployment; they deliberately contain no data field, so application-written state is preserved. The optional soteria-restic credential is readable by exact name only.

Changing the state or credential names also requires updating the Role. Do not restore cluster-wide Secret access to accommodate another deployment.

The optional restic backend needs additional, explicitly approved Roles and RoleBindings in each backup/restore target namespace: Job creation and the credential-copy operations in internal/k8s/jobs.go. Those grants are not part of this Longhorn deployment. Review credential distribution before enabling restic; Kubernetes RBAC cannot restrict Secret creation by resource name.