Skip to main content
Version: 9.5.x

Kubernetes cluster roles and permissions

In this page are showed the roles and permissions of users which operates on Kubernetes clusters.

Mia-Platform provides two main different roles:

  • Developer: Developer users can view the majority of the Kubernetes Resources (pods, services, deployments, events, logs etc...) and exec/port-forward into pods using Kubernetes APIs
  • Admin: Admin users can also edit, delete and create most of the Kubernetes Resources using Kubernetes APIs.
info

For multi-tenant Kubernetes Clusters, the already mentioned permissions are restricted only to their relative namespaces.

Usually Mia-Platform teams have Admin and Developer roles depending on the environment on which they operate. Instead, external users such as partners and customer teams works with Developer permission.

If you are wondering which Kubernetes permissions each role has in depth, check the following table:

ResourcesDeveloper permissionsAdmin permissions
pods/execCreateCreate
pods/portforwardCreateCreate
pods.metrics.k8s.ioGet; List; WatchGet; List; Watch
configmapsGet; List; WatchGet; List; Watch
eventsGet; List; WatchGet; List; Watch
limitrangesGet; List; WatchUpdate; Delete; Create; Deletecollection; Patch; Get; List; Watch
namespaces/statusGet; List; WatchUpdate; Delete; Create; Deletecollection; Patch; Get; List; Watch
namespacesGet; List; WatchUpdate; Delete; Create; Deletecollection; Patch; Get; List; Watch
persistentvolumeclaimsGet; List; WatchGet; List; Watch
pods/logGet; List; WatchUpdate; Delete; Create; Deletecollection; Patch; Get; List; Watch
pods/proxyGet; List; WatchUpdate; Delete; Create; Deletecollection; Patch; Get; List; Watch
pods/statusGet; List; WatchUpdate; Delete; Create; Deletecollection; Patch; Get; List; Watch
podsGet; List; WatchUpdate; Delete; Create; Deletecollection; Patch; Get; List; Watch
resourcequotas/statusGet; List; WatchGet; List; Watch
resourcequotasGet; List; WatchGet; List; Watch
services/proxyGet; List; WatchUpdate; Delete; Create; Deletecollection; Patch; Get; List; Watch
servicesGet; List; WatchGet; List; Watch
challenges.acme.cert-manager.ioGet; List; WatchGet; List; Watch
deamonset.appsGet; List; WatchUpdate; Delete; Create; Deletecollection; Patch; Get; List; Watch
deployments.app/scaleGet; List; WatchUpdate; Delete; Create; Deletecollection; Patch; Get; List; Watch
deployments.appsGet; List; WatchUpdate; Delete; Create; Deletecollection; Patch; Get; List; Watch
replicasets.apps/scaleGet; List; WatchUpdate; Delete; Create; Deletecollection; Patch; Get; List; Watch
replicasets.appGet; List; WatchUpdate; Delete; Create; Deletecollection; Patch; Get; List; Watch
statefulsets.apps/scaleGet; List; WatchUpdate; Delete; Create; Deletecollection; Patch; Get; List; Watch
statefulsets.appGet; List; WatchUpdate; Delete; Create; Deletecollection; Patch; Get; List; Watch
verticalpodautoscalers.autoscaling.k8s.ioGet; List; WatchUpdate; Delete; Create; Deletecollection; Patch; Get; List; Watch
horizontalpodautoscalers.autoscalingGet; List; WatchUpdate; Delete; Create; Deletecollection; Patch; Get; List; Watch
cronjobs.batchGet; List; WatchUpdate; Delete; Create; Deletecollection; Patch; Get; List; Watch
jobs.batchGet; List; WatchUpdate; Delete; Create; Deletecollection; Patch; Get; List; Watch
certificates.cert-manager.ioGet; List; WatchUpdate; Delete; Create; Deletecollection; Patch; Get; List; Watch
sleepinfos.kube-green.comGet; List; WatchUpdate; Delete; Deletecollection; Patch; Get; List; Watch
podmonitors.monitoring.coreos.comGet; List; WatchUpdate; Delete; Create; Deletecollection; Patch; Get; List; Watch
prometheusrules.monitoring.coreos.comGet; List; WatchUpdate; Delete; Create; Deletecollection; Patch; Get; List; Watch
servicemonitors.monitoring.coreos.comGet; List; WatchUpdate; Delete; Create; Deletecollection; Patch; Get; List; Watch
ingressroutes.traefik.containo.usGet; List; WatchUpdate; Delete; Create; Deletecollection; Patch; Get; List; Watch
ingressroutetcps.traefik.containo.usGet; List; WatchUpdate; Delete; Create; Deletecollection; Patch; Get; List; Watch
middlewares.traefik.containo.usGet; List; WatchUpdate; Delete; Create; Deletecollection; Patch; Get; List; Watch
tlsoptions.traefik.containo.usGet; List; WatchUpdate; Delete; Create; Deletecollection; Patch; Get; List; Watch
secretsList,WatchUpdate; Delete; Create; Deletecollection; Patch; Get; List; Watch