refactor: source codex sentinel names from yaml

scripts/src/platform-infra-sub2api-codex-sentinel.ts

@@ -14,6 +14,8 @@ export interface CodexPoolSentinelConfig {
   credentialsSecretName: string;
   stateConfigMapName: string;
   cronJobName: string;
+  roleName: string;
+  roleBindingName: string;
   model: string;
   endpoint: "responses";
   marker: {
@@ -110,6 +112,8 @@ export function defaultCodexPoolSentinelConfig(): CodexPoolSentinelConfig {
     credentialsSecretName: "sub2api-account-sentinel-profiles",
     stateConfigMapName: "sub2api-account-sentinel-state",
     cronJobName: "sub2api-account-sentinel",
+    roleName: "sub2api-account-sentinel",
+    roleBindingName: "sub2api-account-sentinel",
     model: "gpt-5.5",
     endpoint: "responses",
     marker: {
@@ -199,6 +203,8 @@ export function readCodexPoolSentinelConfig(value: unknown, defaults: CodexPoolS
     credentialsSecretName: readDnsName(valueAt(value, "credentialsSecretName"), `${sourcePath}.sentinel.credentialsSecretName`, defaults.credentialsSecretName),
     stateConfigMapName: readDnsName(valueAt(value, "stateConfigMapName"), `${sourcePath}.sentinel.stateConfigMapName`, defaults.stateConfigMapName),
     cronJobName: readDnsName(valueAt(value, "cronJobName"), `${sourcePath}.sentinel.cronJobName`, defaults.cronJobName),
+    roleName: readRequiredDnsName(valueAt(value, "roleName"), `${sourcePath}.sentinel.roleName`),
+    roleBindingName: readRequiredDnsName(valueAt(value, "roleBindingName"), `${sourcePath}.sentinel.roleBindingName`),
     model: readModelName(valueAt(value, "model"), `${sourcePath}.sentinel.model`, defaults.model),
     endpoint: "responses",
     marker: {
@@ -276,6 +282,8 @@ export function codexPoolSentinelSummary(config: CodexPoolSentinelConfig): Recor
     actionsEnabled: config.actions.enabled,
     schedule: config.schedule,
     cronJobName: config.cronJobName,
+    roleName: config.roleName,
+    roleBindingName: config.roleBindingName,
     configMapName: config.configMapName,
     credentialsSecretName: config.credentialsSecretName,
     stateConfigMapName: config.stateConfigMapName,
@@ -391,7 +399,7 @@ metadata:
 apiVersion: rbac.authorization.k8s.io/v1
 kind: Role
 metadata:
-  name: ${config.serviceAccountName}
+  name: ${config.roleName}
   namespace: ${options.namespace}
   labels:
     app.kubernetes.io/name: ${config.cronJobName}
@@ -411,7 +419,7 @@ rules:
 apiVersion: rbac.authorization.k8s.io/v1
 kind: RoleBinding
 metadata:
-  name: ${config.serviceAccountName}
+  name: ${config.roleBindingName}
   namespace: ${options.namespace}
   labels:
     app.kubernetes.io/name: ${config.cronJobName}
@@ -423,7 +431,7 @@ subjects:
     namespace: ${options.namespace}
 roleRef:
   kind: Role
-  name: ${config.serviceAccountName}
+  name: ${config.roleName}
   apiGroup: rbac.authorization.k8s.io
 ---
 apiVersion: batch/v1
@@ -2097,6 +2105,15 @@ function readDnsName(value: unknown, key: string, fallback: string): string {
   return text;
 }
 
+function readRequiredDnsName(value: unknown, key: string): string {
+  if (value === undefined || value === null) throw new Error(`${key} is required`);
+  if (typeof value !== "string" || value.trim().length === 0) throw new Error(`${key} must be a non-empty string`);
+  if (/[\r\n]/u.test(value)) throw new Error(`${key} must not contain newlines`);
+  const text = value.trim();
+  if (!/^[a-z0-9]([-a-z0-9]*[a-z0-9])?$/u.test(text)) throw new Error(`${key} must be a Kubernetes DNS label`);
+  return text;
+}
+
 function readModelName(value: unknown, key: string, fallback: string): string {
   const text = readString(value, key, fallback);
   if (!/^[A-Za-z0-9._:-]+$/u.test(text)) throw new Error(`${key} has an unsupported model name`);