apiVersion: v1
kind: ServiceAccount
metadata:
  name: backup-sa
  labels:
    app: vibecarbon-backup
    component: backup
---
# The backup CronJob runs `kubectl exec` into the supabase-db pod to invoke
# wal-g backup-push (wal-g needs local PGDATA access). That requires
# pods/exec in the vibecarbon namespace. `pods` get/list is needed so
# `kubectl exec statefulset/...` can resolve the pod.
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: backup-exec
  namespace: vibecarbon
  labels:
    app: vibecarbon-backup
    component: backup
rules:
  - apiGroups: [""]
    resources: ["pods"]
    verbs: ["get", "list"]
  - apiGroups: [""]
    resources: ["pods/exec"]
    verbs: ["create"]
  - apiGroups: ["apps"]
    resources: ["statefulsets"]
    verbs: ["get"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: backup-exec
  namespace: vibecarbon
  labels:
    app: vibecarbon-backup
    component: backup
subjects:
  - kind: ServiceAccount
    name: backup-sa
    namespace: vibecarbon
roleRef:
  kind: Role
  name: backup-exec
  apiGroup: rbac.authorization.k8s.io