IBM Cloud Pak foundational services cluster permissions
The IBM Cloud Pak foundational services operators and service workloads have cluster-level permissions as required for some of the operations that they perform. These permissions are closely tracked and documented so that users can understand any implications that they might have on other workloads in the cluster.
In prior releases of IBM Cloud Pak foundational services, all operators (and some workloads) had many cluster permissions, sometimes more than needed to perform their jobs. In IBM Cloud Pak foundational services version 3.6.x, these permissions are restricted. Most operator and workload permissions are limited to a namespace scope, and are selectively projected into namespaces as needed to support the requirements of dependent IBM Cloud Pak® solutions. Users can specifically determine when and where IBM Cloud Pak foundational services permissions have authority over any individual namespace in the cluster. This provides control over workload isolation to the cluster administrator.
Namespace Scope
In order to better support workload isolation, a Namespace Scope operator selectively "projects" IBM Cloud Pak foundational services operator roles and role bindings into a namespace when IBM Cloud Pak solutions or containerized software request common services from that namespace. This allows common services to perform operations in the namespace. By default, the Namespace Scope operator has cluster permissions when installed so that the role binding projections can be performed automatically when needed.
If the users are uncomfortable with these permissions or automatic projection of role bindings, they can specify that they want to manually authorize this namespace projection. This removes cluster permissions from the Namespace Scope operator and error messages are issued from the OpenShift console when authority is needed to allow IBM Cloud Pak foundational services interaction with a specific namespace. The cluster administrator can then authorize from the command line the namespace that needs to interact with the common services.
For more information, see IBM NamespaceScope Operator.
Permissions
Remaining cluster permissions that operators and service workloads have are given in the following tables:
- IBM Common Service Operator
- Operand Deployment Lifecycle Manager
- IBM Namespace Scope Operator
- IBM License Service Operator
- IBM System Healthcheck Operator
- IBM Management Ingress Operator
- IBM Management Ingress Operand
- IBM Ingress Nginx Operand
- IBM IAM (Identity and Access Management) Operator
- IBM IAM Operand
- IBM Cert-manager Operator
- IBM Common UI Operator
- IBM Metering Operator
- IBM Audit Logging Operator
- IBM Audit Policy Controller
- IBM Audit Garbage Collector
- IBM Monitoring Grafana Operator
- IBM Monitoring Grafana Operand
- IBM Monitoring Prometheus Ext Operator
- IBM Monitoring Prometheus Ext Operand
- IBM Monitoring Exporters Operator
- IBM Monitoring Exporters Operand
- IBM Platform API Operator
- IBM Platform API Operand
IBM Common Service Operator
The common service operator bootstraps common services by installing their operators into the cluster as needed.
| API group | Resources | Verbs | Description |
|---|---|---|---|
| "" | namespaces | Create Get List Watch Update |
Used only for creating the ibm-common-services namespace. This permission is required as Kubernetes ClusterRoles do not support specifying a dedicated namespace name. |
| operators.coreos.com | subscriptions operatorgroups |
Create Get List Watch Update |
Used only for managing OLM Operator Subscriptions in the ibm-common-services namespace. |
| operators.coreos.com | subscriptions clusterserviceversions |
Delete | Used only for deleting the IBM Cloud Pak foundational services from the openshift-operators and ibm-common-services namespaces when they are no longer needed in the cluster. |
| operator.ibm.com | commonservices | Get List Watch |
The IBM Common Service Operator owns the CommonService custom resource (CR) and needs cluster-level permissions to get, list, or watch the CR whenever it is created or updated in any namespace (typically during installation
of IBM Cloud Pak solutions that require common services). |
| apiextensions.k8s.io | customresourcedefinitions | Create Get Update |
Used for creating the CustomResourceDefinitions (CRDs) of the SecretShare CR and the ibm-common-service-webhook operator. - For more information about the SecretShare operator, see IBM Cloud Pak foundational services versions compatibility - For more information about the webhook operator, see IBM Cloud Pak foundational services webhook |
| "" | configmaps | Create Get List Watch Update Delete |
Used only for performing operations on the ibm-common-services-status configmap. This configmap is created in the kube-public namespace and is used by IBM Cloud Pak solutions to indicate when common
services are available. |
| rbac.authorization.k8s.io | roles role bindings |
Create Get List Watch Update Delete |
Used for creating role and role binding in the kube-public namespace for accessing ibm-common-services-status and ibmcloud-cluster-info configmaps. The ibmcloud-cluster-info configmap contains
some basic information about the cluster (such as its name) that is used by IBM Cloud Pak solutions and common services for backward compatibility with an earlier version. |
| rbac.authorization.k8s.io | clusterroles clusterrolebindings |
Create Get List Watch Update Delete |
Used for creating cluster administrator permission for Operand Deployment Lifecycle Manager when the IBM Common Service Operator is installed in all-namespaces mode. The cluster administrator permission is used to
manage IBM Cloud Pak operators. |
| admissionregistration.k8s.io | mutatingwebhookconfigurations | Create Get List Watch Update Delete Patch |
Used for managing ibm-common-service-webhook operator resources. The webhook is used to solve a known DNS issue that causes a 5-seconds DNS resolution delay in OpenShift and Kubernetes clusters. (https://github.com/kubernetes/kubernetes/issues/56903) |
| ibmcpcs.ibm.com | secretshares | Create Get List Watch Update Delete |
Used for managing SecretShare, which is the resource of ibm-secretshare-operator. The SecretShare operator watches secrets and configmaps in the ibm-common-services namespace, copying selected entries
to the kube-system, kube-public, or services namespaces for backward compatibility with older IBM Cloud Pak versions. |
| operator.ibm.com | podpresets | Create Get List Watch Update Delete |
Used for managing PodPreset, which is the resource of the ibm-common-service-webhook operator. The webhook is used to solve the known DNS issue that causes a 5-seconds DNS resolution delay in OpenShift and Kubernetes
clusters. (https://github.com/kubernetes/kubernetes/issues/56903). |
| "" | secrets configmaps |
Create Get List Watch Update Delete |
The ibm-secretshare-operator requires these permissions to perform its operations. The SecretShare operator watches secrets and configmaps in the ibm-common-services namespace, copying selected entries to the kube-system,
kube-public, or services namespaces for backward compatibility with older IBM Cloud Pak versions. |
| "" | events pods |
Create Get List Watch Update Delete |
The ibm-common-service-webhook operator requires these permissions to perform its operations. The webhook is used to solve the known DNS issue (https://github.com/kubernetes/kubernetes/issues/56903). |
Operand Deployment Lifecycle Manager
The Operand Deployment Lifecycle Manager manages OLM operator subscriptions and deployments for the IBM Cloud Pak foundational services. IBM Cloud Pak solutions request and interact with common services through Operand custom resources.
| API group | Resources | Verbs | Description |
|---|---|---|---|
| operator.ibm.com | operandbindinfos operandconfigs operandregistries operandrequests |
Create Get List Watch Update Delete Patch |
The Operand Deployment Lifecycle Manager owns the OperandBindInfo, OperandConfig, OperandRegistry, and OperandRequest resources. It requires cluster-level permissions to view
these resources in case they are created (indicating that common services are requested) in any namespace in the cluster. Common services interact only with workloads in namespaces that contain one or more of these Operand CRs. |
| operator.ibm.com | certmanagers ibmlicensings meteringreportservers auditloggings |
Create Get List Watch Update Delete Patch |
These CRs are cluster-scoped, and the common services deployed by ODLM owns them. These CRs are created only when their services are requested by IBM Cloud Pak solutions. |
| clusterhealth.ibm.com | clusterservicestatuses | Create Get List Watch Update Delete Patch |
ClusterServiceStatus is the CR of ibm-healthcheck-operator. The CR is cluster-scoped. |
| certmanager.k8s.io | clusterissuers | Create Get List Watch Update Delete Patch |
ClusterIssuer is a CR of the ibm-cert-manager-operator. The CR is cluster-scoped. |
IBM Namespace Scope Operator
| API group | Resources | Verbs | Description |
|---|---|---|---|
| "*" | "*" | "*" | The IBM Namespace Scope Operator is installed by default and has full cluster administrator permissions. This operator enables automatic authorization of role and role binding to the namespace in which an IBM Cloud Pak is installed.
If an OpenShift cluster administrator wants to restrict permissions of this operator, the administrator can set manualManagement: true in the CommonService CR to automatically uninstall this operator and
install the IBM Namespace Scope Operator Restricted instead. The IBM Namespace Scope Operator Restricted has no cluster permissions. An OpenShift cluster administrator must manually authorize role and role
binding from its namespace. For more information, see Authorizing common services to perform operations on workloads in a namespace. |
IBM License Service Operator
The license service is responsible for collecting usage information on any IBM Cloud Pak solutions or containerized offerings running in a cluster to assist customers in managing their license compliance.
| API group | Resources | Verbs | Description |
|---|---|---|---|
| " " | pods namespaces nodes |
Get List |
The cluster permissions for the ibm-license-service service account are read-only access permissions that are required to properly discover the running IBM applications to report license usage of the Virtual Processor
Core (VPC) and Processor Value Unit (PVU) metrics. |
| operator.openshift.io | servicecas | List | These permissions are required to generate the TLS certificate for License Service. |
| operator.ibm.com | ibmlicensings ibmlicenseservicereporters ibmlicensings/status ibmlicenseservicereporters/status ibmlicensings/finalizers ibmlicenseservicereporters/finalizers |
Create Delete Get List Patch Update Watch |
The cluster permissions for the ibm-licensing-operator service account are required to properly manage the status of the IBM License Service operator. |
IBM System Healthcheck Operator
The System HealthCheck Operator is responsible for collecting information on IBM Cloud Pak foundational services health, and in collecting information as requested by a cluster administrator for use in problem reporting with IBM Cloud Pak foundational services.
| API group | Resources | Verbs | Description |
|---|---|---|---|
| "" | pods nodes |
Get List |
These read-only permissions are used by the system-healthcheck-service operand to get the status of all pods in all the namespaces. |
| clusterhealth.ibm.com | clusterservicestatuses | Create Read Update Delete |
These permissions are used by the system-healthcheck-service operand only to update the service health status to the clusterservicestatuses.clusterhealth.ibm.com CRD. |
| "" | all resources in all namespaces | Get List |
These read-only permissions are used by the must-gather-job operand to get all resource and logs. |
| "" | pods and executables in all namespaces | Create | This permission is used by the must-gather-job operand to reach the network pod and gather information. |
IBM Management Ingress Operator
The Management Ingress Operator establishes endpoints for Web UI interaction with IBM Cloud Pak foundational services for use by an administrator to interact with those services.
| API group | Resources | Verbs | Description |
|---|---|---|---|
| operator.openshift.io | dnses ingresscontrollers |
Get List Watch |
Permission for DNS and ingress controllers from the openshift-ingress-operator namespace to get router application domain. |
| "" | configmaps | Get List Watch |
Permission for the console-config configmap from the openshift-console namspace to get the kube-apiserver URL. |
IBM Management Ingress Operand
The Management Ingress Operand is the workload (pods) that are deployed by the ingress operator.
| API group | Resources | Verbs | Description |
|---|---|---|---|
| "" | nodes | Get List Watch |
Permission for the node resources to update the loadBalancer IP address of ingress status. |
| "" | namespaces | Get List Watch |
Permission for the namespace resources to get the namespaces being currently watched. |
| "" | services | Get List Watch |
Permission for the service resources to get the Kubernetes backend default or Kubernetes service. |
IBM Ingress Nginx Operator
The Nginx Ingress Operator establishes endpoints for Web UI interaction with IBM Cloud Pak foundational services for use by IBM Cloud Pak solutions to interact with those services.
| API group | Resources | Verbs | Description |
|---|---|---|---|
| "" | nodes | Get List Watch |
Permission for the node resources to update the loadBalancer IP address of ingress status. |
| "" | namespaces | Get | Permission for the namespace resources to get the namespaces being currently watched. |
IBM IAM Operator
The Identity and Access Management (IAM) operator is responsible for deploying and managing user identity and access management services.
| API group | Resources | Verbs | Description |
|---|---|---|---|
| admissionregistration.k8s.io | mutatingwebhookconfigurations | Create Get List Watch Update Delete |
Permissions to intercept namespace creation by account administrator to support multitenancy (workload isolation by namespace). |
| rbac.authorization.k8s.io | clusterroles clusterrolebindings |
Create Get List Watch Update Delete |
Permissions to support console features. These permissions are also needed to create a set of default cluster roles, such as icp:accountadmin, and cluster role bindings to bind default subjects to those roles. |
| user.openshift.io | users | Create Get List Watch Update Delete |
Permissions to create the default admin user during installation. |
IBM IAM Operand (workloads)
IAM services only deal with identities and access by IBM Cloud Pak solutions through IBM Cloud Pak foundational services.
| API group | Resources | Verbs | Description |
|---|---|---|---|
| core | namespaces | Get List Watch |
Read-only permissions to support watching a set of namespaces that are created by the account administrator to support multitenancy (workload isolation by namespace). |
| rbac.authorization.k8s.io | clusterrolebindings | Create Get List Watch Update Delete |
Permissions to support cluster administrator login on a public cloud. These permissions are also needed to assign roles to account administrators to support multitenancy. |
| user.openshift.io | users groups identities |
Create Get List Watch Update Delete |
Permissions to manage the shadowed users and groups in OpenShift. |
| oauth.openshift.io | oauthclients | Create Get List Watch Update Delete |
Permissions to support client registration with the OpenID Connect (OIDC) provider. |
| oauth.openshift.io | oauthtokens | Create Get List Watch Update Delete |
Permissions to work with the authentication tokens during login flow. |
| iam.policies.ibm.com | iampolicies | Create Get List Watch Update Delete |
This is a custom resource that is created by the IBM IAM operator. The permissions are needed to watch policies that are set by IBM Cloud Pak users across namespaces. This feature is used only by the IBM Cloud Pak for Multicloud Management. |
IBM Cert-manager Operator
| API group | Resources | Verbs | Description |
|---|---|---|---|
| "" | configmaps | Create Delete List Get Watch Update Patch |
Required by cert-manager for leader election and by configmap-watcher service. |
| "" | events | Create Patch |
Required by cert-manager to create and patch events for cert-manager resources. |
| "" | pods services |
Get List Watch Create Delete |
Required by cert-manager to perform operations, such as renewal, on secrets associated with the certs. |
| "" | secrets | Get List Watch Create Update Delete |
Required by cert-manager to perform operations such as renewal on secrets associated with the certs. |
| "" | serviceaccounts | List Watch |
Required by cert-manager to list and watch service accounts. |
admission.registration.k8s.io |
mutatingwebhookconfigurationsvalidatingwebhookconfigurations |
* | Required by operator to create mutatingwebhookconfigurations and validatingwebhookconfigurations as a part of webhook resources. |
admission.certmanager.k8s.io |
certificates issuers clusterissuers certificaterequests |
* | Required by cert-manager-webhook for cert-manager resources admission. |
apiextensions.k8s.io |
customresourcedefinitions |
* | Required by operator to perform operations on all cert-manager operand CRDs. |
| apps | deployments statefulsets daemonsets |
* | Required by cert-manager service to support pod-refresh after cert renewal feature. Also needed by configmap-watcher to restart pods when configmaps change. |
authorization.k8s.io |
subjectaccessreviews | * | Required by cert-manager-webhook for API server authorization and authentication. |
certmanager.k8s.io |
certificates certificaterequests orders challenges clusterissuers issuers |
* | Required by cert-manager to perform all operations on cert-manager resources in any namespace. |
certmanager.k8s.io |
certificates/status certificaterequests/status orders/status challenges/status clusterissuers/status issuers/status certificates/finalizers challenges/finalizers ingresses/finalizers orders/finalizers |
Update | Required by cert-manager to perform all operations on cert-manager resources in any namespace. |
| extensions | ingresses | Get List Watch Create Delete Update |
Required by cert-manager to support CA bundle injection in ingresses. |
| ibmcpcs.ibm.com | secretshares | List Watch |
Required by operator to list and watch at cluster level. Operator cache requires this permission because operator is cluster-scoped. |
| operator.ibm.com | certmanagers certmanagers/status certmanager/finalizers |
Create Delete Get List Patch Update Watch |
Required by operator because certmanagers resource is cluster-scoped. The CR is cluster-scoped because the operator deploys cluster-scoped resources. |
operator.open-cluster-management.io |
multiclusterhubs | Get List Watch |
Required by operator to detect if Red Hat Advanced Cluster Management is installed. If installed, then operator does not deploy cert-manager. |
rbac.authorization.k8s.io |
clusterroles clusterrolebindings rolebindings |
Create Get List Watch Delete |
Required by operator to create clusterrole, clusterrolebinding for the cert-manager operands. Required to create rolebinding in kube-system used by cert-manager-webhook. |
security.openshift.io |
securitycontextcontstraints | Use | Required by the operator to enable or disable hostNetwork for cert-manager-webhook. Restricted to resourceNames of restricted and hostnetwork. |
IBM Common UI Operator
The following cluster permissions are installed when you install the operator.
| API group | Resources | Verbs | Description |
|---|---|---|---|
| "" | deployments configmaps statefulsets persistentvolumeclaims pods nodes events services namespaces |
Get List |
The Common UI requires this permission to collect data to display on the Administration Hub dashboard for resources that are installed in a different namespace. In addition, services are watched to add services automatically to the Common UI header. |
| apps | deployments daemonsets statefulsets |
Get List |
The Common UI requires this permission to collect data to display on the Administration Hub dashboard. |
| extensions | ingresses | Get List |
This permission is required for watching for new services to add automatically to the Common UI header. |
route.openshift.io |
routes | Get List |
This permission is required to get routes for the Administration Hub dashboard for any IBM Cloud Pak that is installed in a different namespace. |
IBM Metering Operator
Note: The metering service is deprecated and might be removed in a future release. At the time of removal, the following permissions are also removed.
The following cluster permissions are installed when you install the metering operator.
| API group | Resources | Verbs | Description |
|---|---|---|---|
| "" | namespaces pods nodes persistent volumes configmaps persistent volume claims |
Get List |
Metering needs to read these objects to capture the resources used by each type. The configmap permission is required in IBM Cloud Pak for Multicloud Management metering environments to determine the local hub name. |
The following roles are required for the metering report server. The metering report server generates reports for any namespace in the cluster and is implemented as an API server extension, which dictates that this API be cluster-scoped.
| API group | Resources | Verbs | Description |
|---|---|---|---|
apigroup:authorization.k8s.io |
subjectaccessreviews | Create | Metering requires this role to be able to create subject access reviews in support of the report API server extension. |
apigroup:apiregistration.k8s.io |
apiservices | Create List Watch |
Metering requires this role to be able to create the api service in support of the report API server extension. |
| "" | configmaps | Watch | Metering requires the ability to watch configmaps for configuration changes to the service. |
| operator.ibm.com | meteringreportservers/status finalizers |
Create Update Delete Get List Watch |
The metering operator requires these permissions to manage the metering report server type and update its status and finalizers. |
The following roles are required when metering is used in an IBM Cloud Pak for Multicloud Management environment to meter clusters and roll metering data up from managed endpoints to the hub.
| API group | Resources | Verbs | Description |
|---|---|---|---|
operator.openshift.io |
ingresscontroller | Get | Metering needs to be able to get the application domain on the hub cluster to create a route and certificate for data delivery from managed endpoints. |
| mcm.ibm.com | clusterstatuses leadervotes |
Get | - |
cluster.open-cluster-management.io and managedclusterinfosinternal.open-cluster-management.io |
managedclusters | Get | Metering needs the ability to list clusters to meter them on the IBM Cloud Pak for Multicloud Management hub. Both IBM Cloud Pak for Multicloud Management core and Red Hat Advanced Cluster Management hubs are supported. |
operator.open-cluster-management.io |
multiclusterhubs | Get List |
Metering needs to be able to determine the type of hub that is being used (IBM Cloud Pak for Multicloud Management or Red Hat Advanced Cluster Management). |
| "" | secrets | Get | Metering needs to be able to read the hub kube config secret to be able to send data back to the hub cluster. This secret resides in another namespace. |
apiextensions.k8s.io |
customresourcedefinitions | Get | The Metering sender needs to read custom resource definitions to determine the type of hub cluster it is sending data to (IBM Cloud Pak for Multicloud Management or Red Hat Advanced Cluster Management). |
IBM Audit Logging Operator
| API group | Resources | Verbs | Description |
|---|---|---|---|
| operator.ibm.com | auditlogging auditlogging/status auditlogging/finalizer |
Create Get List Watch Update Patch Delete |
AuditLogging is a cluster-scoped resource that is owned by IBM AuditLogging Operator. |
| "" | events | Create Patch |
Required to update AuditLogging CRs with useful events for debugging and deployment readiness. |
IBM Audit Policy Controller
This audit policy controller feature is used only by the IBM Cloud Pak for Multicloud Management. It sets policy for audit logging across managed clusters.
| API group | Resources | Verbs | Description |
|---|---|---|---|
| audit.policies.ibm.com | auditpolicy | Create Get List Watch Update Patch Delete |
AuditPolicy is a cluster-scoped resource. |
| audit.policies.ibm.com | auditpolicy/status | Create Update Patch |
Required to update AuditPolicy CRs with a compliance state and reason for non-compliancy. |
| "" | namespaces | Get List Watch |
Required to watch a set of namespaces declared in an Audit Policy. |
| "" | configmaps | Get List Watch |
Required to support enabling the AUDIT_ENABLED flag in service configmaps when an Audit Policy is set to enforce. |
| "" | pods | Get List Watch |
Required to get the name of the configmap that holds the audit enabled key from a service pod. |
| "" | events | Create Patch |
Required to update a parent AuditPolicy with child policy compliance details. |
IBM Audit Garbage Collector
The garbage collector cleans up cluster roles that might have been created by the audit logging operator in previous releases.
| API group | Resources | Verbs | Description |
|---|---|---|---|
rbac.authorization.k8s.io |
clusterroles | Delete | Required to remove old audit policy controller cluster roles that are no longer used as created in previous releases by the Audit Logging operator. |
rbac.authorization.k8s.io |
clusterrolebinding | Delete | Required to remove old audit policy controller cluster role bindings that are no longer used. |
IBM Monitoring Grafana Operator
| API group | Resources | Verbs | Description |
|---|---|---|---|
| "" | configmaps/cluster-monitoring-config | Get | Used to check whether OpenShift Container Platform Application Monitoring is enabled or not. |
IBM Monitoring Grafana Operand
| API group | Resources | Verbs | Description |
|---|---|---|---|
| "" | namespaces | Get | Permission to authenticate against OpenShift Container Platform interfaces to OpenShift Application Monitoring. |
IBM Monitoring Prometheus Ext Operator
Note: When you use the monitoring service in OpenShift Container Platform monitoring mode, only the Grafana operator is installed. The following permissions can be removed.
| API group | Resources | Verbs | Description |
|---|---|---|---|
storage.k8s.io |
storageclasses | List Watch |
Permission to automatically find usable storage classes in the cluster. |
security.openshift.io |
securitycontextconstraints | Create Update Get |
Permission to create custom SCCs. |
IBM Monitoring Prometheus Ext Operand
Note: When you use the monitoring service in OpenShift Container Platform monitoring mode, only the Grafana operator is installed. Therefore, the following permissions can be removed.
| API group | Resources | Verbs | Description |
|---|---|---|---|
| monitoring.coreos.com | servicemonitors podmonitors prometheusrules |
* | Permission for embedded Prometheus operator to monitor cluster and applications. |
| "" | namespaces | Get | Permission for embedded Prometheus operator to check namespaces to watch. |
| "" | services nodes nodes/proxy endpoints pods |
Get List Watch |
Permission for Prometheus service discovery. |
IBM Monitoring Exporters Operator
Note: When you use the monitoring service in OpenShift Container Platform monitoring mode, only the Grafana operator is installed. Therefore, the following permissions can be removed.
| API group | Resources | Verbs | Description |
|---|---|---|---|
security.openshift.io |
securitycontextconstraints | Create Update Get |
Permission to create custom SCCs. |
IBM Monitoring Exporters Operand
Note: When you use the monitoring service in OpenShift Container Platform monitoring mode, only the Grafana operator is installed. Therefore, the following permissions can be removed.
| API group | Resources | Verbs | Description |
|---|---|---|---|
| "" | * | List | kube-state-metrics creates metrics for them. |
| apps | * | List | kube-state-metrics creates metrics for them. |
| batch | * | List | kube-state-metrics creates metrics for them. |
| extensions | * | List | kube-state-metrics creates metrics for them. |
networking.k8s.io |
* | List | kube-state-metrics creates metrics for them. |
storage.k8s.io |
* | List | kube-state-metrics creates metrics for them. |
| autoscaling | * | List | kube-state-metrics creates metrics for them. |
| policy | * | List | kube-state-metrics creates metrics for them. |
admissionregistration.k8s.io |
* | List | kube-state-metrics creates metrics for them |
IBM Platform API Operator
The platform API is the server component for the cloudctl command line that is used for many CLI administrative tasks.
| API group | Resources | Resource names | Verbs | Description |
|---|---|---|---|---|
apiextensions.k8s.io |
customresourcedefinitions | passwordrules.icp.ibm.com |
Delete | Used only for cleaning up obsolete CRD missed out from a previous version of the operator. |
rbac.authorization.k8s.io |
clusterroles clusterrolebindings |
Create List Watch |
Used only for ibm-platform-api-operand to set up RBAC to support listing target namespaces in legacy catalog-ui service. This will be removed in a future release. | |
rbac.authorization.k8s.io |
clusterroles clusterrolebindings |
ibm-platform-api-operand |
Delete Get Patch update |
Used only for ibm-platform-api-operand to set up RBAC to support listing target namespaces in legacy catalog-ui service. This will be removed in a future release. |
policy |
podsecuritypolicies | List | Used only for ibm-platform-api-operand to grant permission to support listing target namespaces in legacy catalog-ui service. This will be removed in a future release. | |
| "" | serviceaccounts | Impersonate | Used only for ibm-platform-api-operand to grant permission to support listing target namespaces in legacy catalog-ui service. This will be removed in a future release. |
IBM Platform API Operand
| API group | Resources | Verbs | Description |
|---|---|---|---|
rbac.authorization.k8s.io |
clusterrolebindings | List | Used only to inspect if a user has access to a namespace in order to support listing target namespaces in legacy catalog-ui service. This will be removed in a future release. |
policy |
podsecuritypolicies | List | Used only to inspect if a user has access to a namespace in order to support listing target namespaces in legacy catalog-ui service. This will be removed in a future release. |
| "" | serviceaccounts | Impersonate | Used only to inspect if a user has access to a namespace in order to support listing target namespaces in legacy catalog-ui service. This will be removed in a future release. |