Merge PR #990: let the read-only proxy grant reach Alertmanager (REN-95)

Appends kube-prometheus-stack-alertmanager:9093 to the resourceNames of
Role paperclip-prometheus-read in namespace monitoring. Additive, get-only,
no pod template change.

Reviewed and merged by argus-bot; authored by atlas-bot (four-eyes).
Negative baseline reproduced live via SelfSubjectAccessReview before merge.

kubernetes/apps/paperclip/prometheus-read-rbac.yaml

@@ -20,16 +20,19 @@
 # `ci-diagnostics-service-proxy` Role), which has run this same path for the
 # alert-monitor since 2026-07-16.
 #
-# ONE VERB, ONE RESOURCE NAME — ON PURPOSE
+# ONE VERB, NAMED SERVICES ONLY — ON PURPOSE
 #
 # Every process in the paperclip pod can read the mounted ServiceAccount token,
-# so the token is only worth what this Role grants. It grants `get` on one
-# Service. Widening it is a new card and a new review, not an edit here.
+# so the token is only worth what this Role grants. It grants `get` on the two
+# Services named below and nothing else. Widening it is a new card and a new
+# review, not an edit here — the Alertmanager name was added that way (REN-95,
+# for read-only alert-delivery checks; parent REN-94).
 #
 # `resourceNames` is matched verbatim by the authorizer, not as a selector:
 # `svc`, `svc:9090` and `http:svc:9090` are three different strings. Only the
-# port-qualified form is granted, so the one URL that works is
+# port-qualified forms are granted, so the only URLs that work are
 #   /api/v1/namespaces/monitoring/services/kube-prometheus-stack-prometheus:9090/proxy/...
+#   /api/v1/namespaces/monitoring/services/kube-prometheus-stack-alertmanager:9093/proxy/...
 # A 403 on some other form is the grant working. Do not fix it by adding a
 # string.
 apiVersion: v1
@@ -42,6 +45,11 @@ metadata:
 # Named for the only thing it is worth. If a future change gives this account a
 # second grant, the name is a lie and the review should say so. Whether the
 # token is mounted is decided on the pod (`paperclip.yaml`), not here.
+#
+# REN-95 stretched the name: it now also proxies to Alertmanager. Kept as-is
+# deliberately — `serviceAccountName` is in the pod template, so renaming it
+# would restart the paperclip Deployment and evict running agents. Read the name
+# as "read-only kube-prometheus-stack access", and read the Role for the truth.
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: Role
@@ -56,6 +64,7 @@ rules:
     verbs: ["get"]
     resourceNames:
       - "kube-prometheus-stack-prometheus:9090"
+      - "kube-prometheus-stack-alertmanager:9093"
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: RoleBinding