feat(deploy): add rbac, compose, and helm manifests

deploy/rbac/replay-clusterrole.yaml

@@ -0,0 +1,41 @@
+# Replay ClusterRole: create/patch access for the replay identity.
+#
+# Used by `krply replay apply` against a disposable TARGET cluster only. It can
+# only create and update the declarative roots krply replays (namespaces,
+# configmaps, services, deployments, statefulsets, daemonsets); it cannot
+# delete and has no access to Secrets, Pods, or other kinds. get/list are
+# granted for the dry-run phase and to verify the plan target.
+#
+# This role is intentionally NOT cluster-admin. Never grant the replay identity
+# write access to a production/source cluster.
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: krply-replay
+  labels:
+    app.kubernetes.io/name: krply
+    app.kubernetes.io/component: replay
+rules:
+  - apiGroups: [""]
+    resources: ["namespaces", "configmaps", "services"]
+    verbs: ["create", "patch", "update", "get", "list"]
+  - apiGroups: ["apps"]
+    resources: ["deployments", "statefulsets", "daemonsets"]
+    verbs: ["create", "patch", "update", "get", "list"]
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: krply-replay
+  labels:
+    app.kubernetes.io/name: krply
+    app.kubernetes.io/component: replay
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: krply-replay
+subjects:
+  # Replace with the ServiceAccount that runs replay in the target cluster.
+  - kind: ServiceAccount
+    name: krply-replay
+    namespace: krply