b88e178ec3
Dozzle running in k8s mode requires permission to list nodes at cluster scope. Without this permission, the pod fails with error: "nodes is forbidden: User \"system:serviceaccount:dozzle:dozzle\" cannot list resource \"nodes\" in API group \"\" at the cluster scope" This change adds the nodes resource with get, list, and watch verbs to the ClusterRole, allowing Dozzle to discover all nodes in the cluster when running in k8s/swarm mode. Resolves: DEV-349 Co-Authored-By: Paperclip <noreply@paperclip.ing>
48 lines
665 B
YAML
48 lines
665 B
YAML
apiVersion: v1
|
|
kind: ServiceAccount
|
|
metadata:
|
|
name: dozzle
|
|
namespace: dozzle
|
|
---
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
kind: ClusterRole
|
|
metadata:
|
|
name: dozzle
|
|
rules:
|
|
- apiGroups:
|
|
- ""
|
|
resources:
|
|
- pods
|
|
- pods/log
|
|
verbs:
|
|
- get
|
|
- list
|
|
- watch
|
|
- apiGroups:
|
|
- ""
|
|
resources:
|
|
- namespaces
|
|
verbs:
|
|
- get
|
|
- list
|
|
- apiGroups:
|
|
- ""
|
|
resources:
|
|
- nodes
|
|
verbs:
|
|
- get
|
|
- list
|
|
- watch
|
|
---
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
kind: ClusterRoleBinding
|
|
metadata:
|
|
name: dozzle
|
|
roleRef:
|
|
apiGroup: rbac.authorization.k8s.io
|
|
kind: ClusterRole
|
|
name: dozzle
|
|
subjects:
|
|
- kind: ServiceAccount
|
|
name: dozzle
|
|
namespace: dozzle
|