initial scaffold

apps/kubernetes-dashboard/rbac.yaml

@@ -0,0 +1,32 @@
+# Cluster-admin ServiceAccount + long-lived token, used both to log in to
+# the Dashboard (docs/SETUP.md step 12) and as the client identity for
+# direct LAN kubectl access if you'd rather not manage the SSH-fetched
+# kubeconfig from step 6. Fine for a single-user homelab; split into
+# narrower-scoped accounts if more people get access later.
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: admin-user
+  namespace: kubernetes-dashboard
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: admin-user
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: cluster-admin
+subjects:
+  - kind: ServiceAccount
+    name: admin-user
+    namespace: kubernetes-dashboard
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: admin-user-token
+  namespace: kubernetes-dashboard
+  annotations:
+    kubernetes.io/service-account.name: admin-user
+type: kubernetes.io/service-account-token