prod deployment

deploy/k8s/base/gateway-rbac.yaml

@@ -1,6 +1,6 @@
 # RBAC for gateway to CREATE sandbox deployments only
 # Principle of least privilege: gateway can ONLY create deployments/services/PVCs
-# in the dexorder-sandboxes namespace. Deletion is handled by the lifecycle sidecar.
+# in the sandbox namespace. Deletion is handled by the lifecycle sidecar.
 # No pods, secrets, exec, or cross-namespace access.
 ---
 apiVersion: v1
@@ -8,12 +8,12 @@ kind: ServiceAccount
 metadata:
   name: gateway
 ---
-# Role scoped to dexorder-sandboxes namespace only
+# Role scoped to sandbox namespace only
 apiVersion: rbac.authorization.k8s.io/v1
 kind: Role
 metadata:
   name: sandbox-creator
-  namespace: dexorder-sandboxes
+  namespace: sandbox
 rules:
   # Deployments: create and read only (deletion handled by sidecar)
   - apiGroups: ["apps"]
@@ -53,7 +53,7 @@ apiVersion: rbac.authorization.k8s.io/v1
 kind: RoleBinding
 metadata:
   name: gateway-sandbox-creator
-  namespace: dexorder-sandboxes
+  namespace: sandbox
 subjects:
   - kind: ServiceAccount
     name: gateway