[bmscomp]

Adds plans/adminless-enhancement.md: a plan to make kates deploy --adminless a first-class way to run Kates for an account with only namespaced rights. The plan rests on a code audit and on an end-to-end run on kind.

What it rests on

A code audit of the seven charts the profile installs, every CLI command, and the backend under rbac.scope=namespace, with file:line references.

A run on kind (section 2.F), as a ServiceAccount bound to admin in one namespace, on a Strimzi a cluster admin installed watching it.

What the run confirmed live:

• Apicurio is refused on its KafkaTopic in namespace kafka.
• The default Kafka (3+3) can't schedule.
• clean, deploy status, detect, doctor, ports and operators list all misbehave without cluster rights.
• cluster alerts reads "✓ 0 critical" with 0 rules scanned.

What it found that the audit missed:

• F1. The compliance Role is skipped over a PodMonitor API the cluster does not serve. That one false gap also switches off cluster topology (503) and the disruption safety guard.
• F5. kates clean reports "Cluster cleaned successfully" while the whole Kafka cluster keeps running. Its Kafka CR, node pools, topics, users, pods and PVCs are marked keep.
• F4. No flag can size the stack. --ha=false changes nothing, and MirrorMaker 2 and Connect always start 3 workers.
• F2, F3. Kind is not detected in admin-less. Deploy waits 15 minutes on Pending pods without saying why.
• F6, F7, F9, F10. Misleading messages: detect says "cluster is unreachable", the disruption guard says "no broker pods found", the version plan says "Operator → install", and doctor recommends Kyverno commands the account can't run.

What works today: the install preflight, Kafka plus Kates plus Kafka UI in one namespace, a LOAD test (40,000 records at about 35,000 records/s), and ports given the namespace flags.

The plan

1. The install succeeds on a stock namespace admin. A capability matrix, a render-then-check preflight, values-adminless.yaml per chart, the Apicurio fix, restricted Pod Security and OpenShift, real sizing knobs, and kept resources handled.
2. Every command is honest. A deployment record ConfigMap. A refusal is never reported as an answer. clean removes what the charts keep.
3. The backend knows its scope. Roles that match the features, a namespaced chaos provider, and guard reads that tell a refusal from an empty list.
4. One admin handoff. kates adminless request and verify, and an optional kates-tenant chart.
5. Proof. A CI job on kind running the whole flow as a namespace-only account (section 9 is the recipe), and a chart gate.

F1 and F5 are small, high-value fixes worth shipping first. Four decisions are left for the maintainer, in section 6.

🤖 Generated with Claude Code

https://claude.ai/code/session_011Uf5RgVD4yw8iSrbvvapWM