mirror of
https://github.com/kubeshark/kubeshark.git
synced 2026-05-10 19:26:39 +00:00
1e2288b9a8
Reorganize permissions example. Permissions for optional features are separated from those that are mandatory. Revised the list of permissions. Added and removed features to make it fit what Mizu currently requires.
38 lines
959 B
YAML
38 lines
959 B
YAML
# This example shows the permissions that are required in order to run the `mizu tap` command
|
|
kind: ClusterRole
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
metadata:
|
|
name: mizu-runner-clusterrole
|
|
rules:
|
|
- apiGroups: [""]
|
|
resources: ["pods"]
|
|
verbs: ["list", "watch", "create"]
|
|
- apiGroups: [""]
|
|
resources: ["services"]
|
|
verbs: ["get", "create"]
|
|
- apiGroups: ["apps"]
|
|
resources: ["daemonsets"]
|
|
verbs: ["create", "patch"]
|
|
- apiGroups: [""]
|
|
resources: ["namespaces"]
|
|
verbs: ["list", "watch", "create", "delete"]
|
|
- apiGroups: [""]
|
|
resources: ["services/proxy"]
|
|
verbs: ["get", "create"]
|
|
- apiGroups: [""]
|
|
resources: ["configmaps"]
|
|
verbs: ["create"]
|
|
---
|
|
kind: ClusterRoleBinding
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
metadata:
|
|
name: mizu-runner-clusterrolebindings
|
|
subjects:
|
|
- kind: User
|
|
name: user1
|
|
apiGroup: rbac.authorization.k8s.io
|
|
roleRef:
|
|
kind: ClusterRole
|
|
name: mizu-runner-clusterrole
|
|
apiGroup: rbac.authorization.k8s.io
|