argocd and kube mcp to read-write

manifest/overlays/production/mcp-kube-rbac.yaml

@@ -7,35 +7,20 @@ metadata:
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRole
 metadata:
-  name: mcp-kubernetes-readonly
+  name: mcp-kubernetes-admin
   namespace: toolhive-system
 rules:
-  - apiGroups: [""]
-    resources:
-      - pods
-      - pods/log
-      - pods/status
-      - services
-      - endpoints
-      - events
-      - namespaces
-      - nodes
-      - configmaps
-      - persistentvolumeclaims
-      - replicationcontrollers
-    verbs: ["get", "list", "watch"]
-  - apiGroups: ["apps"]
-    resources: ["deployments", "replicasets", "statefulsets", "daemonsets"]
-    verbs: ["get", "list", "watch"]
-  - apiGroups: ["batch"]
-    resources: ["jobs", "cronjobs"]
-    verbs: ["get", "list", "watch"]
-  - apiGroups: ["networking.k8s.io"]
-    resources: ["ingresses", "networkpolicies"]
-    verbs: ["get", "list", "watch"]
-  - apiGroups: ["argoproj.io"]
-    resources: ["applications", "applicationsets", "appprojects"]
-    verbs: ["get", "list", "watch"]
+  - apiGroups: ["*"]
+    resources: ["*"]
+    verbs:
+      - get
+      - list
+      - watch
+      - create
+      - update
+      - patch
+      - delete
+      - deletecollection
   - apiGroups: ["metrics.k8s.io"]
     resources: ["pods", "nodes"]
     verbs: ["get", "list"]
@@ -43,12 +28,12 @@ rules:
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRoleBinding
 metadata:
-  name: mcp-kubernetes-readonly
+  name: mcp-kubernetes-admin
   namespace: toolhive-system
 roleRef:
   apiGroup: rbac.authorization.k8s.io
   kind: ClusterRole
-  name: mcp-kubernetes-readonly
+  name: mcp-kubernetes-admin
 subjects:
   - kind: ServiceAccount
     name: kubernetes-mcp