[KubeKyrie]

Description

fix webterminal rbac error

Connected. Starting shell ...
exec error: unable to upgrade connection: pods "jo-89d574573bbd4a13-worker-0" is forbidden: User "system:serviceaccount:rlark-system:rlark-agent" cannot create resource "pods/exec" in API group "" in the namespace "rlark-system"
Connection closed unexpectedly (1011): terminal proxy connection closed.

[lkygithub]

Hi @KubeKyrie , thanks for the PR and sorry for the wait.

Heads-up: we just merged a large internal iteration into main (#17), so this
PR is based on an outdated baseline. We re-checked against the new main and
your finding still holds:

• apps/rlark/docs/examples/agent-rbac.yaml still omits pods/exec; grepping
  the whole tree for pods/exec returns no hits at all
• meanwhile apps/rlark/pkg/agent/terminal.go still opens three exec streams
  (terminal, file upload, file download), all via
  remotecommand.NewSPDYExecutor(..., "POST", ...)

So the RBAC gap is still real. Could you please:

1. Rebase onto the latest main (feature: runtime-neutral Task execution, Cluster resource, tenant-enforced APIs, and unified contracts #17 did not touch this file, so we don't
   expect conflicts).
2. Confirm the behaviour on the new baseline and push so CI re-runs.

While you're at it, feel free to also drop the duplicated events rule further
down in the same file — it overlaps with the core-group rule above it.

Thanks again for the report!