phoenixai-kubernetes-operator

Least Privilege To Deploy PhoenixAI

You can install the PhoenixAI operator and PhoenixAI cluster by kubectl or helm. No matter which way you choose, you may need the following permissions:

Note: Operator will use its own service account, cluster role and cluster role binding to create and manage PhoenixAI

apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: install-phoenixai-rb
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: install-phoenixai-role
subjects:
  - kind: ServiceAccount
    name: your-sa-name
    namespace: your-namespace

---

apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: install-phoenixai-role
rules:
  - apiGroups:
      - ""
    resources:
      - secrets
      - serviceaccounts
      - configmaps
    verbs:
      - '*'
  - apiGroups:
      - rbac.authorization.k8s.io
    resources:
      - clusterrolebindings
      - rolebindings
      - clusterroles
      - roles
    verbs:
      - '*'
  - apiGroups:
      - apps
    resources:
      - deployments
    verbs:
      - '*'
  - apiGroups:
      - monitoring.coreos.com
    resources:
      - servicemonitors
    verbs:
      - '*'
  - apiGroups:
      - phoenixdata.ai
    resources:
      - phoenixaiclusters
      - phoenixaiwarehouses
    verbs:
      - '*'
  - apiGroups:
      - apiextensions.k8s.io
    resources:
      - customresourcedefinitions
    verbs:
      - '*'
  - apiGroups:
      - batch
    resources:
      - jobs
    verbs:
      - '*'
  # The operator's own ClusterRole grants policy/poddisruptionbudgets (the auto-PDB feature is
  # enabled by default in the Helm chart and the released operator.yaml). Kubernetes prevents
  # privilege escalation: to create that ClusterRole, the installing account must hold these
  # permissions as well.
  - apiGroups:
      - policy
    resources:
      - poddisruptionbudgets
    verbs:
      - '*'
  # Only needed when the PVC volume expansion feature is enabled
  # (phoenixAIOperator.enablePVCExpansion / enablePVCExpansionRBAC): the operator's RBAC then
  # additionally grants persistentvolumeclaims, storageclasses, and events.
  # - apiGroups:
  #     - ""
  #   resources:
  #     - persistentvolumeclaims
  #     - events
  #   verbs:
  #     - '*'
  # - apiGroups:
  #     - storage.k8s.io
  #   resources:
  #     - storageclasses
  #   verbs:
  #     - get
  #     - list
  #     - watch