From 8524931589ef04b26211483adf7f29f1f19fcb49 Mon Sep 17 00:00:00 2001 From: Lucas Teligioridis Date: Fri, 22 Jul 2022 21:47:51 +1000 Subject: [PATCH] Provide clearer documentation on correct permissions Rather than providing the objects and what permissions are required, just provide a valid Kubernetes manifest that clearly shows this to the developer setting this up. Will also prevent any ambiguity when applying this directly against a Kubernetes API. Signed-off-by: Lucas Teligioridis --- docs/features/kubernetes/configuration.md | 51 ++++++++++++++++------- 1 file changed, 35 insertions(+), 16 deletions(-) diff --git a/docs/features/kubernetes/configuration.md b/docs/features/kubernetes/configuration.md index dce4e60a87..86c6ea61b4 100644 --- a/docs/features/kubernetes/configuration.md +++ b/docs/features/kubernetes/configuration.md @@ -373,23 +373,42 @@ view the Kubernetes API docs for your Kubernetes version (e.g. ### Role Based Access Control -The current RBAC permissions required are read-only cluster wide, for the -following objects: +The current RBAC permissions required are read-only cluster wide, the below +Kubernetes manifest describes which objects are required and will ensure +the plugin functions correctly: -- pods -- services -- configmaps -- deployments -- replicasets -- horizontalpodautoscalers -- ingresses -- statefulsets - -The following RBAC permissions are required on the batch API group for the -following objects: - -- jobs -- cronjobs +```yaml +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: backstage-read-only +rules: + - apiGroups: + - '*' + resources: + - pods + - configmaps + - services + - deployments + - replicasets + - horizontalpodautoscalers + - ingresses + - statefulsets + verbs: + - get + - list + - watch + - apiGroups: + - batch + resources: + - jobs + - cronjobs + verbs: + - get + - list + - watch +``` ## Surfacing your Kubernetes components as part of an entity