Metadata-Version: 2.4
Name: floe-rbac-k8s
Version: 0.1.0a1
Summary: Kubernetes RBAC plugin for the floe data platform
Project-URL: Homepage, https://github.com/Obsidian-Owl/floe
Project-URL: Documentation, https://github.com/Obsidian-Owl/floe/tree/main/docs
Project-URL: Repository, https://github.com/Obsidian-Owl/floe
Author-email: Obsidian Owl <team@obsidianowl.dev>
License-Expression: Apache-2.0
Classifier: Development Status :: 3 - Alpha
Classifier: Intended Audience :: Developers
Classifier: License :: OSI Approved :: Apache Software License
Classifier: Programming Language :: Python :: 3
Classifier: Programming Language :: Python :: 3.10
Classifier: Programming Language :: Python :: 3.11
Classifier: Programming Language :: Python :: 3.12
Classifier: Typing :: Typed
Requires-Python: >=3.10
Requires-Dist: floe-core<0.2.0,>=0.1.0a1
Requires-Dist: kubernetes<36.0,>=35.0.0
Requires-Dist: pydantic<3.0,>=2.12.5
Requires-Dist: pyyaml>=6.0
Requires-Dist: structlog>=24.0
Provides-Extra: dev
Requires-Dist: mypy>=1.8; extra == 'dev'
Requires-Dist: pytest-cov>=4.0; extra == 'dev'
Requires-Dist: pytest>=8.0; extra == 'dev'
Requires-Dist: ruff>=0.3; extra == 'dev'
Description-Content-Type: text/markdown

# floe-rbac-k8s

Kubernetes RBAC plugin for the floe data platform.

## Overview

This plugin implements the `RBACPlugin` interface from floe-core, providing Kubernetes-native
RBAC manifest generation for:

- ServiceAccounts with least-privilege configurations
- Roles with constrained permissions (no wildcards)
- RoleBindings including cross-namespace access patterns
- Namespaces with Pod Security Standards labels

## Installation

```bash
pip install floe-rbac-k8s
```

## Usage

```python
from floe_rbac_k8s import K8sRBACPlugin
from floe_core.schemas.rbac import ServiceAccountConfig

plugin = K8sRBACPlugin()

# Generate a ServiceAccount manifest
config = ServiceAccountConfig(
    name="floe-job-runner",
    namespace="floe-jobs",
    automount_token=False
)
manifest = plugin.generate_service_account(config)
```

## Entry Point

This plugin registers under the `floe.rbac` entry point group:

```toml
[project.entry-points."floe.rbac"]
k8s = "floe_rbac_k8s:K8sRBACPlugin"
```

## Requirements

- Python 3.11+
- Kubernetes 1.28+ (for Pod Security Standards support)
- floe-core 0.1.0+

## License

Apache-2.0
