apiVersion: v1
kind: ServiceAccount
metadata: { name: coderunner-sa, namespace: ai }
---
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata: { name: coderunner-job-role, namespace: ai }
rules:
    - apiGroups: ["batch"]
      resources: ["jobs"]
      verbs: ["create", "get", "list", "watch", "delete"]
    - apiGroups: [""]
      resources: ["pods", "pods/log"]
      verbs: ["get", "list", "watch", "delete"]

---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata: { name: coderunner-job-rb, namespace: ai }
subjects:
    - kind: ServiceAccount
      name: coderunner-sa
      namespace: ai
roleRef:
    apiGroup: rbac.authorization.k8s.io
    kind: Role
    name: coderunner-job-role