%% RHOAI Build Config - RBAC Matrix Diagram
%% Generated by: Claude Opus 4.6

graph TD
    subgraph "Service Accounts"
        SA1["redhat-ods-operator-<br/>controller-manager<br/>(redhat-ods-operator ns)"]
        SA2["prometheus-k8s<br/>(openshift-monitoring ns)"]
    end

    subgraph "ClusterRole Bindings"
        CRB1["redhat-ods-operator-<br/>controller-manager binding"]
        CRB2["prometheus-k8s-viewer<br/>binding (Cluster-scoped)"]
        CRB3["redhat-ods-operator-<br/>metrics-reader binding"]
    end

    subgraph "ClusterRoles"
        CR1["redhat-ods-operator-<br/>controller-manager"]
        CR2["prometheus-k8s-viewer"]
        CR3["redhat-ods-operator-<br/>metrics-reader"]
    end

    subgraph "Core & Apps Resources"
        Deployments["apps<br/>deployments, replicasets"]
        Services["core<br/>services"]
        ConfigMaps["core<br/>configmaps"]
        Secrets["core<br/>secrets"]
        Namespaces["core<br/>namespaces"]
        ServiceAccounts["core<br/>serviceaccounts"]
        Events["core<br/>events"]
    end

    subgraph "RHOAI Platform CRDs"
        DSC["datasciencecluster.opendatahub.io<br/>DataScienceCluster<br/>+ finalizers + status"]
        DSCI["dscinitialization.opendatahub.io<br/>DSCInitialization<br/>+ finalizers + status"]
        Components["components.platform.opendatahub.io<br/>CodeFlare, Dashboard, DSP, Feast,<br/>Kserve, Kueue, ModelController,<br/>ModelMesh, ModelRegistry, Ray,<br/>TrainingOperator, TrustyAI, Workbenches"]
        PlatformSvc["services.platform.opendatahub.io<br/>Auth, Monitoring"]
    end

    subgraph "K8s Infrastructure"
        CRDs["apiextensions.k8s.io<br/>customresourcedefinitions"]
        Webhooks["admissionregistration.k8s.io<br/>mutatingwebhookconfigurations<br/>validatingwebhookconfigurations<br/>validatingadmissionpolicies"]
        SCC["security.openshift.io<br/>securitycontextconstraints"]
        Routes["route.openshift.io<br/>routes"]
        OAuth["oauth.openshift.io<br/>oauthclients"]
    end

    subgraph "Service Mesh & Serving"
        Istio["networking.istio.io<br/>envoyfilters, gateways,<br/>virtualservices"]
        IstioSec["security.istio.io<br/>authorizationpolicies"]
        Maistra["maistra.io<br/>servicemeshcontrolplanes,<br/>servicemeshmemberrolls"]
        KServe["serving.kserve.io<br/>inferenceservices,<br/>servingruntimes,<br/>clusterservingruntimes"]
        KnativeServ["serving.knative.dev<br/>services"]
        KnativeOp["operator.knative.dev<br/>knativeservings"]
        Ray["ray.io<br/>rayclusters, rayjobs,<br/>rayservices"]
    end

    subgraph "Monitoring"
        Prometheus["monitoring.coreos.com<br/>prometheusrules,<br/>servicemonitors,<br/>podmonitors"]
        MetricsURL["/metrics<br/>(nonResourceURL)"]
        PodsSvcEndpoints["core<br/>pods, services, endpoints"]
    end

    %% SA1 bindings
    SA1 -->|"bound via"| CRB1
    CRB1 -->|"grants"| CR1

    %% CR1 permissions
    CR1 -->|"* (full CRUD)"| Deployments
    CR1 -->|"* (full CRUD)"| Services
    CR1 -->|"CRUD + watch"| ConfigMaps
    CR1 -->|"CRUD + watch"| Secrets
    CR1 -->|"CRUD + watch"| Namespaces
    CR1 -->|"CRUD + watch"| ServiceAccounts
    CR1 -->|"CRUD + watch"| Events
    CR1 -->|"CRUD + watch"| DSC
    CR1 -->|"CRUD + watch"| DSCI
    CR1 -->|"CRUD + watch"| Components
    CR1 -->|"CRUD + watch"| PlatformSvc
    CR1 -->|"CRUD + watch"| CRDs
    CR1 -->|"CRUD + watch"| Webhooks
    CR1 -->|"*"| SCC
    CR1 -->|"CRUD + watch"| Routes
    CR1 -->|"CRUD + watch"| OAuth
    CR1 -->|"*"| Istio
    CR1 -->|"*"| IstioSec
    CR1 -->|"CRUD + watch + use"| Maistra
    CR1 -->|"CRUD + watch"| KServe
    CR1 -->|"CRUD + watch"| KnativeServ
    CR1 -->|"*"| KnativeOp
    CR1 -->|"CRUD + patch"| Ray
    CR1 -->|"CRUD + watch"| Prometheus

    %% SA2 bindings
    SA2 -->|"bound via"| CRB2
    CRB2 -->|"grants"| CR2
    CR2 -->|"get, watch, list"| PodsSvcEndpoints

    %% Metrics reader
    SA2 -->|"bound via"| CRB3
    CRB3 -->|"grants"| CR3
    CR3 -->|"get"| MetricsURL

    style SA1 fill:#4a90e2,color:#fff
    style SA2 fill:#4a90e2,color:#fff
    style CR1 fill:#f5a623
    style CR2 fill:#f5a623
    style CR3 fill:#f5a623
    style CRB1 fill:#e8e8e8
    style CRB2 fill:#e8e8e8
    style CRB3 fill:#e8e8e8
    style DSC fill:#7ed321
    style DSCI fill:#7ed321
    style Components fill:#7ed321
    style PlatformSvc fill:#7ed321
    style KServe fill:#7ed321
