Cluster Permission for CHAI™ Access

The following JSON file defines the minimum required permissions (role) associated with the service account on the Kubernetes cluster. CHAI™ accesses the cluster using this service account via the kubeconfig.yaml file.

{
    "apiVersion": "rbac.authorization.k8s.io/v1",
    "kind": "ClusterRole",
    "metadata": {
        "name": "chai-role"
    },
    "rules": [
        {
            "apiGroups": [
                ""
            ],
            "resources": [
                "namespaces",
                "configmaps",
                "secrets",
                "services",
                "pods",
                "persistentvolumeclaims",
                "tokenrequests"
            ],
            "verbs": [
                "get",
                "list",
                "watch",
                "create",
                "update",
                "patch",
                "delete"
            ]
        },
        {
            "apiGroups": [
                ""
            ],
            "resources": [
                "nodes",
                "persistentvolumes"
            ],
            "verbs": [
                "get",
                "list",
                "watch"
            ]
        },
        {
            "apiGroups": [
                "networking.k8s.io"
            ],
            "resources": [
                "ingresses",
                "ingressclasses"
            ],
            "verbs": [
                "get",
                "list",
                "watch",
                "create",
                "update",
                "patch",
                "delete"
            ]
        },
        {
            "apiGroups": [
                "apps"
            ],
            "resources": [
                "deployments",
                "daemonsets",
                "statefulsets",
                "replicasets"
            ],
            "verbs": [
                "get",
                "list",
                "watch",
                "create",
                "update",
                "patch",
                "delete"
            ]
        }
    ]
}

---

Important Note:
If the 'create' permission is not granted for the namespace resource, please use an existing namespace on the cluster while creating the workload.