添加qiming-rcoder模块

qiming-rcoder/k8s/manifests/base/rcoder/serviceaccount.yaml

@@ -0,0 +1,35 @@
+# ServiceAccount + ClusterRole for RCoder to manage Pods
+# 注意: ClusterRoleBinding 由各环境 overlay 提供（避免集群级命名冲突）
+---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: rcoder-pods-sa
+  namespace: nuwax-rcoder
+---
+# ClusterRole for Pod management（集群共享，dev/prod 可复用同一个 ClusterRole）
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: rcoder-pods-clusterrole
+rules:
+# Pod 管理
+- apiGroups: [""]
+  resources: ["pods"]
+  verbs: ["create", "delete", "get", "list", "watch", "patch", "update"]
+# Pod 日志
+- apiGroups: [""]
+  resources: ["pods/log"]
+  verbs: ["get", "list"]
+# Pod 执行命令（用于调试）
+- apiGroups: [""]
+  resources: ["pods/exec"]
+  verbs: ["create"]
+# Pod 状态
+- apiGroups: [""]
+  resources: ["pods/status"]
+  verbs: ["get"]
+# PVC 管理（动态创建/删除工作空间存储）
+- apiGroups: [""]
+  resources: ["persistentvolumeclaims"]
+  verbs: ["get", "list", "watch", "create", "delete"]