RBAC configuration for tech collective VPN mesh members who have been granted access to the k3s cluster. Each peer gets a dedicated namespace with admin access plus cluster-wide read access (no secrets outside their own namespace).
Manifests: kubernetes/apps/mesh-peers/
Related: WireGuard Collective Mesh — VPN transport layer, kubeconfig generation
Each collective peer gets:
restrictedhamilton-cluster-reader — cluster-wide read access, excludes secrets in other namespacesadmin ClusterRole scoped to their own namespaceThe hamilton-cluster-reader ClusterRole is defined in kubernetes/apps/ham/hamilton-rbac.yaml.
| Peer | Namespace | Cluster Access | Namespace Access |
|---|---|---|---|
| Bryce | bryce |
hamilton-cluster-reader (read-only, no cross-ns secrets) |
admin |
| Jake | jake |
hamilton-cluster-reader (read-only, no cross-ns secrets) |
admin |
| Steve | steve |
hamilton-cluster-reader (read-only, no cross-ns secrets) |
admin |
All peer namespaces use restricted Pod Security Standards.
Kubeconfigs are generated via Ansible:
ansible-playbook playbooks/hamilton-wireguard.yml
This playbook:
wg1 interface.wg-output/playbooks/hamilton-wireguard.ymlcollective-mesh.yamlansible-playbook playbooks/hamilton-wireguard.yml to generate kubeconfigkubectl apply -f kubernetes/apps/mesh-peers/collective-mesh.yaml.wg-output/ to the peer (never commit to git)The peer-observability.yaml manifest and Grafana dashboard grafana-dashboard-collective-mesh.yaml provide WireGuard peer monitoring (handshake timestamps, bytes transferred, latency).