You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
1183 lines
35 KiB
1183 lines
35 KiB
|
|
####################################################################
|
|
##### The portion below this marker is automatically generated #####
|
|
##### DO NOT EDIT BY HAND #####
|
|
####################################################################
|
|
|
|
clusterScopedKinds:
|
|
- apiGroup: argoproj.io
|
|
resources:
|
|
- eventsources
|
|
- sensors
|
|
verbs:
|
|
- "*"
|
|
systemResources: []
|
|
- apiGroup: extensions
|
|
resources:
|
|
- ingresses
|
|
verbs:
|
|
- create
|
|
- delete
|
|
- get
|
|
- list
|
|
- patch
|
|
- update
|
|
- watch
|
|
systemResources: []
|
|
- apiGroup: ""
|
|
resources:
|
|
- persistentvolumeclaims/finalizers
|
|
verbs:
|
|
- create
|
|
- update
|
|
- delete
|
|
- get
|
|
systemResources: []
|
|
- apiGroup: ""
|
|
resources:
|
|
- configmaps/status
|
|
verbs:
|
|
- "*"
|
|
systemResources: []
|
|
- apiGroup: route.openshift.io
|
|
resources:
|
|
- "*"
|
|
verbs:
|
|
- "*"
|
|
systemResources: []
|
|
- apiGroup: nvidia.com
|
|
kind: ClusterPolicy
|
|
resources:
|
|
- clusterpolicies
|
|
- clusterpolicies/status
|
|
verbs:
|
|
- "*"
|
|
systemResources:
|
|
- cluster-policy
|
|
- apiGroup: rbac.authorization.k8s.io
|
|
kind: ClusterRole
|
|
resources:
|
|
- clusterroles
|
|
verbs:
|
|
- create
|
|
- delete
|
|
- deletecollection
|
|
- get
|
|
- list
|
|
- patch
|
|
- update
|
|
- watch
|
|
# - bind
|
|
# - escalate
|
|
systemResources:
|
|
- admin
|
|
- anet-operator-cluster-role
|
|
- antrea-agent
|
|
- antrea-controller
|
|
- antrea-cpha
|
|
- argocd-application-controller
|
|
- argocd-notifications-controller
|
|
- argocd-server
|
|
- assets-sync
|
|
- assets-sync-cluster
|
|
- ca-cr-actor
|
|
- ca-pr-beta-actor
|
|
- cert-manager-cainjector
|
|
- cert-manager-cluster-view
|
|
- cert-manager-controller-approve:cert-manager-io
|
|
- cert-manager-controller-certificates
|
|
- cert-manager-controller-certificatesigningrequests
|
|
- cert-manager-controller-challenges
|
|
- cert-manager-controller-clusterissuers
|
|
- cert-manager-controller-ingress-shim
|
|
- cert-manager-controller-issuers
|
|
- cert-manager-controller-orders
|
|
- cert-manager-edit
|
|
- cert-manager-view
|
|
- cert-manager-webhook:subjectaccessreviews
|
|
- cilium
|
|
- cilium-win
|
|
- cloud-provider
|
|
- cluster-admin
|
|
- cluster-autoscaler
|
|
- cluster-sync
|
|
- cluster-sync-project
|
|
- dgxc-admission-controller
|
|
- dgxc-customer-app-admin
|
|
- dgxc-customer-app-admin-base
|
|
- dgxc-customer-network-policy
|
|
- dgxc-exporter
|
|
- dgxc-runai-controller
|
|
- edit
|
|
- external-metrics-reader
|
|
- filestorecsi-controller-cluster-role
|
|
- filestorecsi-node-driver-cluster-role
|
|
- filestorecsi-provisioner-role
|
|
- filestorecsi-resizer-role
|
|
- filestorecsi-snapshotter-role
|
|
- fluentbit-gke-pod-label-reader
|
|
- gce:beta:kubelet-certificate-bootstrap
|
|
- gce:beta:kubelet-certificate-rotation
|
|
- gce:cloud-provider
|
|
- gce:gke-metadata-server-reader
|
|
- gcs-fuse-csi-publisher-role
|
|
- gke-oidc-envoy-impersonate
|
|
- gke-oidc-operator-role
|
|
- gke-spiffe-issuer
|
|
- gke-spiffe-user
|
|
- gmp-system:collector
|
|
- gmp-system:operator
|
|
- gpu-operator
|
|
- gpu-operator-node-feature-discovery
|
|
- gpu-operator-node-feature-discovery-gc
|
|
- gpu-operator-upgrade-crd-hook-role
|
|
- ingress-nginx
|
|
- knative-serving-activator-cluster
|
|
- knative-serving-addressable-resolver
|
|
- knative-serving-admin
|
|
- knative-serving-aggregated-addressable-resolver
|
|
- knative-serving-core
|
|
- knative-serving-namespaced-admin
|
|
- knative-serving-namespaced-edit
|
|
- knative-serving-namespaced-view
|
|
- knative-serving-podspecable-binding
|
|
- konnectivity-agent-cpha
|
|
- kratos-fluent-bit-read
|
|
- kubeflow-mpijobs-admin
|
|
- kubeflow-mpijobs-edit
|
|
- kubeflow-mpijobs-view
|
|
- kubelet-api-admin
|
|
- kyverno-cleanup-jobs
|
|
- kyverno:admission-controller
|
|
- kyverno:admission-controller:additional
|
|
- kyverno:admission-controller:core
|
|
- kyverno:background-controller
|
|
- kyverno:background-controller:additional
|
|
- kyverno:background-controller:core
|
|
- kyverno:cleanup-controller
|
|
- kyverno:cleanup-controller:core
|
|
- kyverno:dgxc-integrations
|
|
- kyverno:rbac:admin:policies
|
|
- kyverno:rbac:admin:policyreports
|
|
- kyverno:rbac:admin:reports
|
|
- kyverno:rbac:admin:updaterequests
|
|
- kyverno:rbac:view:policies
|
|
- kyverno:rbac:view:policyreports
|
|
- kyverno:rbac:view:reports
|
|
- kyverno:rbac:view:updaterequests
|
|
- kyverno:reports-controller
|
|
- kyverno:reports-controller:core
|
|
- kyverno:watch-update-namespaces
|
|
- kyverno:watch-update-services
|
|
- maintenance-handler
|
|
- metrics-exporter
|
|
- mpi-operator
|
|
- net-kourier
|
|
- netd
|
|
- node-problem-detector-cpu
|
|
- node-problem-detector-gpu
|
|
- node-scale-adjuster-ro
|
|
- nodepool-controller
|
|
- nvidia-device-plugin
|
|
- nvidia-device-plugin-mps-control-daemon
|
|
- nvidia-gpu-feature-discovery
|
|
- nvidia-mig-manager
|
|
- nvidia-operator-validator
|
|
- pdcsi-attacher-role
|
|
- pdcsi-provisioner-role
|
|
- pdcsi-resizer-role
|
|
- pdcsi-snapshotter-role
|
|
- pod-group-assigner
|
|
- pod-group-controller
|
|
- pod-group-controller-ro
|
|
- pod-grouper
|
|
- pods-list-osmo-agent
|
|
- prometheus-kube-state-metrics
|
|
- prometheus-operator
|
|
- prometheus-prometheus
|
|
- queue-controller
|
|
- read-updateinfo
|
|
- researcher-service-ro
|
|
- researcher-service-rw
|
|
- runai-accessrule-controller
|
|
- runai-accessrule-controller-project
|
|
- runai-admission-controller-project
|
|
- runai-admission-controller-ro
|
|
- runai-agent
|
|
- runai-binder-cluster-wide
|
|
- runai-binder-project
|
|
- runai-cluster-api
|
|
- runai-cluster-api-project
|
|
- runai-compute-resource-administrator
|
|
- runai-compute-resource-administrator-ns
|
|
- runai-compute-resource-administrator-runai
|
|
- runai-credentials-administrator
|
|
- runai-credentials-administrator-ns
|
|
- runai-credentials-administrator-runai
|
|
- runai-data-source-administrator
|
|
- runai-data-source-administrator-ns
|
|
- runai-data-source-administrator-runai
|
|
- runai-data-source-administrator-runai-cs
|
|
- runai-data-volume-administrator
|
|
- runai-data-volume-administrator-ns
|
|
- runai-data-volume-administrator-runai
|
|
- runai-department-administrator
|
|
- runai-department-administrator-ns
|
|
- runai-department-administrator-runai
|
|
- runai-department-viewer
|
|
- runai-department-viewer-ns
|
|
- runai-department-viewer-runai
|
|
- runai-device-plugin
|
|
- runai-editor
|
|
- runai-editor-ns
|
|
- runai-editor-runai
|
|
- runai-engine-operator
|
|
- runai-environment-administrator
|
|
- runai-environment-administrator-ns
|
|
- runai-environment-administrator-runai
|
|
- runai-external-workload-integrator
|
|
- runai-external-workload-integrator-project
|
|
- runai-inference-workload-controller
|
|
- runai-inference-workload-controller-project
|
|
- runai-init-ca
|
|
- runai-job-controller
|
|
- runai-job-controller-project
|
|
- runai-l1-researcher
|
|
- runai-l1-researcher-ns
|
|
- runai-l1-researcher-runai
|
|
- runai-l2-researcher
|
|
- runai-l2-researcher-ns
|
|
- runai-l2-researcher-runai
|
|
- runai-mig-parted
|
|
- runai-ml-engineer
|
|
- runai-ml-engineer-ns
|
|
- runai-ml-engineer-runai
|
|
- runai-operator
|
|
- runai-project-controller
|
|
- runai-project-controller-cluster-pvc
|
|
- runai-project-controller-cluster-pvc-per-project
|
|
- runai-project-controller-cluster-secret
|
|
- runai-project-controller-cluster-secret-per-project
|
|
- runai-project-controller-limit-range
|
|
- runai-project-controller-limit-range-per-project
|
|
- runai-project-controller-ns-creation
|
|
- runai-project-controller-resources-patcher
|
|
- runai-project-controller-rolebinding-creation
|
|
- runai-project-controller-servicemonitor-creation
|
|
- runai-prometheus
|
|
- runai-research-manager
|
|
- runai-research-manager-ns
|
|
- runai-research-manager-runai
|
|
- runai-resource-reservation-rw
|
|
- runai-scheduler-ro
|
|
- runai-scheduler-rw
|
|
- runai-shared-objects-controller
|
|
- runai-shared-objects-controller-project
|
|
- runai-system-administrator
|
|
- runai-system-administrator-ns
|
|
- runai-system-administrator-runai
|
|
- runai-system-administrator-runai-cs
|
|
- runai-template-administrator
|
|
- runai-template-administrator-ns
|
|
- runai-template-administrator-runai
|
|
- runai-viewer
|
|
- runai-viewer-ns
|
|
- runai-viewer-runai
|
|
- runai-workload-exporter
|
|
- secretproviderclasses-role-gke
|
|
- secrets-store-csi-driver-provider-gke-role
|
|
- skyhook-operator-manager-role
|
|
- skyhook-operator-metrics-reader
|
|
- skyhook-operator-proxy-role
|
|
- snapshot-controller-runner
|
|
- sre-cluster-scoped-access
|
|
- status-updater
|
|
- status-updater-ro
|
|
- system:aggregate-to-admin
|
|
- system:aggregate-to-edit
|
|
- system:aggregate-to-view
|
|
- system:anet-manager-cluster-role
|
|
- system:auth-delegator
|
|
- system:basic-user
|
|
- system:certificates.k8s.io:certificatesigningrequests:nodeclient
|
|
- system:certificates.k8s.io:certificatesigningrequests:selfnodeclient
|
|
- system:certificates.k8s.io:kube-apiserver-client-approver
|
|
- system:certificates.k8s.io:kube-apiserver-client-kubelet-approver
|
|
- system:certificates.k8s.io:kubelet-serving-approver
|
|
- system:certificates.k8s.io:legacy-unknown-approver
|
|
- system:cloud-controller-manager
|
|
- system:clustermetrics
|
|
- system:controller:attachdetach-controller
|
|
- system:controller:certificate-controller
|
|
- system:controller:cloud-node-controller
|
|
- system:controller:clusterrole-aggregation-controller
|
|
- system:controller:cronjob-controller
|
|
- system:controller:daemon-set-controller
|
|
- system:controller:deployment-controller
|
|
- system:controller:disruption-controller
|
|
- system:controller:endpoint-controller
|
|
- system:controller:endpointslice-controller
|
|
- system:controller:endpointslicemirroring-controller
|
|
- system:controller:ephemeral-volume-controller
|
|
- system:controller:expand-controller
|
|
- system:controller:generic-garbage-collector
|
|
- system:controller:glbc
|
|
- system:controller:horizontal-pod-autoscaler
|
|
- system:controller:job-controller
|
|
- system:controller:legacy-service-account-token-cleaner
|
|
- system:controller:namespace-controller
|
|
- system:controller:node-controller
|
|
- system:controller:persistent-volume-binder
|
|
- system:controller:pod-garbage-collector
|
|
- system:controller:pv-protection-controller
|
|
- system:controller:pvc-protection-controller
|
|
- system:controller:replicaset-controller
|
|
- system:controller:replication-controller
|
|
- system:controller:resourcequota-controller
|
|
- system:controller:root-ca-cert-publisher
|
|
- system:controller:route-controller
|
|
- system:controller:service-account-controller
|
|
- system:controller:service-controller
|
|
- system:controller:statefulset-controller
|
|
- system:controller:ttl-after-finished-controller
|
|
- system:controller:ttl-controller
|
|
- system:controller:validatingadmissionpolicy-status-controller
|
|
- system:discovery
|
|
- system:gcp-controller-manager
|
|
- system:gke-common-webhooks
|
|
- system:gke-controller
|
|
- system:gke-hpa-actor
|
|
- system:gke-hpa-service-reader
|
|
- system:gke-uas-collection-reader
|
|
- system:gke-uas-metrics-reader
|
|
- system:glbc-status
|
|
- system:heapster
|
|
- system:kube-aggregator
|
|
- system:kube-controller-manager
|
|
- system:kube-dns
|
|
- system:kube-dns-autoscaler
|
|
- system:kube-scheduler
|
|
- system:kubelet-api-admin
|
|
- system:kubestore-collector
|
|
- system:maintenance-controller-cluster-role
|
|
- system:managed-certificate-controller
|
|
- system:master-monitoring-role
|
|
- system:metrics-server
|
|
- system:metrics-server-nanny
|
|
- system:monitoring
|
|
- system:multinet-endpointslice-controller
|
|
- system:network-controller-manager
|
|
- system:node
|
|
- system:node-bootstrapper
|
|
- system:node-problem-detector
|
|
- system:node-proxier
|
|
- system:persistent-volume-provisioner
|
|
- system:public-info-viewer
|
|
- system:resource-tracker
|
|
- system:service-account-issuer-discovery
|
|
- system:service-steering
|
|
- system:slo-monitor
|
|
- system:volume-scheduler
|
|
- training-operator
|
|
- vace-role
|
|
- view
|
|
- workload-controller-ro
|
|
- workload-controller-rw
|
|
- workload-overseer
|
|
- apiGroup: rbac.authorization.k8s.io
|
|
kind: ClusterRoleBinding
|
|
resources:
|
|
- clusterrolebindings
|
|
verbs:
|
|
- "*"
|
|
systemResources:
|
|
- anet-operator-role-binding
|
|
- antrea-agent
|
|
- antrea-controller
|
|
- antrea-cpha
|
|
- argocd-application-controller
|
|
- argocd-notifications-controller
|
|
- argocd-server
|
|
- assets-sync
|
|
- ca-cr
|
|
- ca-pr-beta
|
|
- cert-manager-cainjector
|
|
- cert-manager-controller-approve:cert-manager-io
|
|
- cert-manager-controller-certificates
|
|
- cert-manager-controller-certificatesigningrequests
|
|
- cert-manager-controller-challenges
|
|
- cert-manager-controller-clusterissuers
|
|
- cert-manager-controller-ingress-shim
|
|
- cert-manager-controller-issuers
|
|
- cert-manager-controller-orders
|
|
- cert-manager-webhook:subjectaccessreviews
|
|
- cilium
|
|
- cilium-win
|
|
- cluster-admin
|
|
- cluster-autoscaler
|
|
- cluster-autoscaler-updateinfo
|
|
- cluster-sync
|
|
- dgxc-admission-controller
|
|
- dgxc-customer-app-admin
|
|
# - dgxc-customer-app-admin-access
|
|
- dgxc-exporter
|
|
- dgxc-runai-controller
|
|
- event-exporter-rb
|
|
- filestorecsi-controller-cluster-role-binding
|
|
- filestorecsi-controller-provisioner-binding
|
|
- filestorecsi-controller-resizer-binding
|
|
- filestorecsi-node-driver-cluster-role-binding
|
|
- filestorecsi-snapshotter-binding
|
|
- fluentbit-gke-pod-label-reader
|
|
- gce:beta:kubelet-certificate-bootstrap
|
|
- gce:beta:kubelet-certificate-rotation
|
|
- gce:cloud-provider
|
|
- gce:gke-metadata-server-reader
|
|
- gce:podsecuritypolicy:gcsfusecsi-node-sa
|
|
- gke-oidc-envoy-impersonate
|
|
- gke-oidc-operator-binding
|
|
- gke-spiffe-controller-is-a-gke-spiffe-issuer
|
|
- gmp-system:collector
|
|
- gmp-system:operator
|
|
- gpu-operator
|
|
- gpu-operator-node-feature-discovery
|
|
- gpu-operator-node-feature-discovery-gc
|
|
- gpu-operator-upgrade-crd-hook-binding
|
|
- ingress-nginx
|
|
- knative-serving-activator-cluster
|
|
- knative-serving-controller-addressable-resolver
|
|
- knative-serving-controller-admin
|
|
- konnectivity-agent-cpha
|
|
- kratos-fluent-bit-read
|
|
- kube-apiserver-kubelet-api-admin
|
|
- kubelet-bootstrap
|
|
- kubelet-bootstrap-certificate-bootstrap
|
|
- kubelet-bootstrap-node-bootstrapper
|
|
- kubelet-cluster-admin
|
|
- kubelet-user-npd-binding
|
|
- kyverno-cleanup-jobs
|
|
- kyverno:admission-controller
|
|
- kyverno:background-controller
|
|
- kyverno:cleanup-controller
|
|
- kyverno:reports-controller
|
|
- maintenance-controller
|
|
- maintenance-handler
|
|
- master-monitoring-role-binding
|
|
- metrics-exporter
|
|
- metrics-server-nanny:system:auth-delegator
|
|
- metrics-server:system:auth-delegator
|
|
- mpi-operator
|
|
- net-kourier
|
|
- netd
|
|
- node-problem-detector-cpu
|
|
- node-problem-detector-gpu
|
|
- node-scale-adjuster-ro
|
|
- nodepool-controller
|
|
- nodes-are-gke-spiffe-users
|
|
- npd-binding
|
|
- nvidia-device-plugin
|
|
- nvidia-device-plugin-mps-control-daemon
|
|
- nvidia-gpu-feature-discovery
|
|
- nvidia-mig-manager
|
|
- nvidia-operator-validator
|
|
- pdcsi-controller-attacher-binding
|
|
- pdcsi-controller-provisioner-binding
|
|
- pdcsi-controller-resizer-binding
|
|
- pdcsi-snapshotter-binding
|
|
- pod-group-assigner
|
|
- pod-group-controller-ro
|
|
- pod-grouper
|
|
- pods-list-osmo-agent
|
|
- prometheus-kube-state-metrics
|
|
- prometheus-operator
|
|
- prometheus-prometheus
|
|
- queue-controller
|
|
- researcher-service-ro
|
|
- runai-accessrule-controller
|
|
- runai-admission-controller-ro
|
|
- runai-agent
|
|
- runai-binder-cluster-wide
|
|
- runai-cluster-api
|
|
- runai-compute-resource-administrator
|
|
- runai-credentials-administrator
|
|
- runai-data-source-administrator
|
|
- runai-data-volume-administrator
|
|
- runai-department-administrator
|
|
- runai-department-viewer
|
|
- runai-device-plugin
|
|
- runai-editor
|
|
- runai-engine-operator
|
|
- runai-environment-administrator
|
|
- runai-external-workload-integrator
|
|
- runai-inference-workload-controller
|
|
- runai-init-ca
|
|
- runai-job-controller
|
|
- runai-l1-researcher
|
|
- runai-l2-researcher
|
|
- runai-mig-parted
|
|
- runai-ml-engineer
|
|
- runai-operator
|
|
- runai-project-controller
|
|
- runai-project-controller-cluster-pvc
|
|
- runai-project-controller-cluster-secret
|
|
- runai-project-controller-limit-range
|
|
- runai-project-controller-ns-creation
|
|
- runai-project-controller-rolebinding-creation
|
|
- runai-project-controller-servicemonitor-creation
|
|
- runai-prometheus
|
|
- runai-research-manager
|
|
- runai-scheduler-ro
|
|
- runai-shared-objects-controller
|
|
- runai-system-administrator
|
|
- runai-template-administrator
|
|
- runai-viewer
|
|
- runai-workload-exporter
|
|
- secretproviderclasses-rolebinding-gke
|
|
- secrets-store-csi-driver-provider-gke-rolebinding
|
|
- skyhook-operator-manager-rolebinding
|
|
- skyhook-operator-proxy-rolebinding
|
|
- snapshot-controller-role
|
|
- sre-cluster-scoped-access
|
|
- sre-full-access-binding
|
|
- status-updater-ro
|
|
- system:anet-manager-cluster-role-binding
|
|
- system:basic-user
|
|
- system:cloud-controller-manager
|
|
- system:clustermetrics
|
|
- system:controller:attachdetach-controller
|
|
- system:controller:certificate-controller
|
|
- system:controller:clusterrole-aggregation-controller
|
|
- system:controller:cronjob-controller
|
|
- system:controller:daemon-set-controller
|
|
- system:controller:deployment-controller
|
|
- system:controller:disruption-controller
|
|
- system:controller:endpoint-controller
|
|
- system:controller:endpointslice-controller
|
|
- system:controller:endpointslicemirroring-controller
|
|
- system:controller:ephemeral-volume-controller
|
|
- system:controller:expand-controller
|
|
- system:controller:generic-garbage-collector
|
|
- system:controller:horizontal-pod-autoscaler
|
|
- system:controller:job-controller
|
|
- system:controller:legacy-service-account-token-cleaner
|
|
- system:controller:namespace-controller
|
|
- system:controller:node-controller
|
|
- system:controller:persistent-volume-binder
|
|
- system:controller:pod-garbage-collector
|
|
- system:controller:pv-protection-controller
|
|
- system:controller:pvc-protection-controller
|
|
- system:controller:replicaset-controller
|
|
- system:controller:replication-controller
|
|
- system:controller:resourcequota-controller
|
|
- system:controller:root-ca-cert-publisher
|
|
- system:controller:route-controller
|
|
- system:controller:service-account-controller
|
|
- system:controller:service-controller
|
|
- system:controller:statefulset-controller
|
|
- system:controller:ttl-after-finished-controller
|
|
- system:controller:ttl-controller
|
|
- system:controller:validatingadmissionpolicy-status-controller
|
|
- system:discovery
|
|
- system:gcp-controller-manager
|
|
- system:gke-common-webhooks
|
|
- system:gke-controller
|
|
- system:gke-hpa-actor
|
|
- system:gke-hpa-service-reader
|
|
- system:gke-uas-collection-reader
|
|
- system:gke-uas-hpa-controller
|
|
- system:gke-uas-metrics-reader
|
|
- system:glbc-status
|
|
- system:konnectivity-server
|
|
- system:kube-controller-manager
|
|
- system:kube-dns
|
|
- system:kube-dns-autoscaler
|
|
- system:kube-proxy
|
|
- system:kube-scheduler
|
|
- system:kubestore-collector
|
|
- system:managed-certificate-controller
|
|
- system:metrics-server
|
|
- system:metrics-server-nanny
|
|
- system:monitoring
|
|
- system:multinet-endpointslice-controller
|
|
- system:network-controller-manager
|
|
- system:node
|
|
- system:node-proxier
|
|
- system:public-info-viewer
|
|
- system:resource-tracker
|
|
- system:service-account-issuer-discovery
|
|
- system:service-steering
|
|
- system:slo-monitor
|
|
- system:volume-scheduler
|
|
- training-operator
|
|
- uas-hpa-external-metrics-reader
|
|
- vace-rolebinding
|
|
- workload-controller-ro
|
|
- workload-overseer
|
|
- apiGroup: ""
|
|
kind: ComponentStatus
|
|
resources:
|
|
- componentstatuses
|
|
verbs:
|
|
- "*"
|
|
systemResources:
|
|
- scheduler
|
|
- controller-manager
|
|
- etcd-0
|
|
- etcd-1
|
|
- apiGroup: cloud.google.com
|
|
kind: ComputeClass
|
|
resources:
|
|
- computeclasses
|
|
- computeclasses/status
|
|
verbs:
|
|
- "*"
|
|
systemResources: []
|
|
- apiGroup: apiextensions.k8s.io
|
|
kind: CustomResourceDefinition
|
|
resources:
|
|
- customresourcedefinitions
|
|
- customresourcedefinitions/status
|
|
verbs:
|
|
- "*"
|
|
systemResources:
|
|
- accessrules.run.ai
|
|
- admissionreports.kyverno.io
|
|
- alertmanagerconfigs.monitoring.coreos.com
|
|
- alertmanagers.monitoring.coreos.com
|
|
# - allowlistedv2workloads.auto.gke.io GKE has a webhook that denies changes
|
|
# - allowlistedworkloads.auto.gke.io GKE has a webhook that denies changes
|
|
- applications.argoproj.io
|
|
- applicationsets.argoproj.io
|
|
- appprojects.argoproj.io
|
|
# - audits.warden.gke.io GKE has a webhook that denies changes
|
|
- backendconfigs.cloud.google.com
|
|
- backgroundscanreports.kyverno.io
|
|
- bindrequests.scheduling.run.ai
|
|
- capacityrequests.internal.autoscaling.gke.io
|
|
- certificaterequests.cert-manager.io
|
|
- certificates.cert-manager.io
|
|
- certificates.networking.internal.knative.dev
|
|
- challenges.acme.cert-manager.io
|
|
- ciliumendpoints.cilium.io
|
|
- ciliumendpointslices.cilium.io
|
|
- ciliumexternalworkloads.cilium.io
|
|
- ciliumidentities.cilium.io
|
|
- ciliumlocalredirectpolicies.cilium.io
|
|
- ciliumnodes.cilium.io
|
|
- cleanuppolicies.kyverno.io
|
|
- clientconfigs.authentication.gke.io
|
|
- clusteradmissionreports.kyverno.io
|
|
- clusterbackgroundscanreports.kyverno.io
|
|
- clustercleanuppolicies.kyverno.io
|
|
- clusterdomainclaims.networking.internal.knative.dev
|
|
- clusterissuers.cert-manager.io
|
|
- clusternodemonitorings.monitoring.googleapis.com
|
|
- clusterpodmonitorings.monitoring.googleapis.com
|
|
- clusterpolicies.kyverno.io
|
|
- clusterpolicies.nvidia.com
|
|
- clusterpolicyreports.wgpolicyk8s.io
|
|
- clusterrules.monitoring.googleapis.com
|
|
- compositecontrollerdefinitions.extensions.dgxc.nvidia.com
|
|
- computeclasses.cloud.google.com
|
|
- configs.engine.run.ai
|
|
- configurations.serving.knative.dev
|
|
- crontests.test.dgxc.nvidia.com
|
|
- datavolumes.run.ai
|
|
- departments.scheduling.run.ai
|
|
- distributedpolicies.run.ai
|
|
- distributedworkloads.run.ai
|
|
- domainmappings.serving.knative.dev
|
|
- externalworkloads.run.ai
|
|
- frontendconfigs.networking.gke.io
|
|
- gcpresourceallowlists.node.gke.io
|
|
- gitlabresources.gitlab.dgxc.nvidia.com
|
|
- gkenetworkparamsets.networking.gke.io
|
|
- globalrules.monitoring.googleapis.com
|
|
- images.caching.internal.knative.dev
|
|
- inferencepolicies.run.ai
|
|
- inferenceworkloads.run.ai
|
|
- ingresses.networking.internal.knative.dev
|
|
- interactivepolicies.run.ai
|
|
- interactiveworkloads.run.ai
|
|
- issuers.cert-manager.io
|
|
- managedcertificates.networking.gke.io
|
|
- memberships.hub.gke.io
|
|
- metrics.autoscaling.internal.knative.dev
|
|
- mpijobs.kubeflow.org
|
|
- mxjobs.kubeflow.org
|
|
- networkinterfaces.networking.gke.io
|
|
- networkloggings.networking.gke.io
|
|
- networks.networking.gke.io
|
|
- nodefeaturegroups.nfd.k8s-sigs.io
|
|
- nodefeaturerules.nfd.k8s-sigs.io
|
|
- nodefeatures.nfd.k8s-sigs.io
|
|
- nodepools.run.ai
|
|
- nvidiadrivers.nvidia.com
|
|
- operatorconfigs.monitoring.googleapis.com
|
|
- orders.acme.cert-manager.io
|
|
- paddlejobs.kubeflow.org
|
|
- podautoscalers.autoscaling.internal.knative.dev
|
|
- podgroups.scheduling.run.ai
|
|
- podlogs.monitoring.grafana.com
|
|
- podmonitorings.monitoring.googleapis.com
|
|
- podmonitors.monitoring.coreos.com
|
|
- policies.kyverno.io
|
|
- policyexceptions.kyverno.io
|
|
- policyreports.wgpolicyk8s.io
|
|
- probes.monitoring.coreos.com
|
|
- projects.run.ai
|
|
- prometheusagents.monitoring.coreos.com
|
|
- prometheuses.monitoring.coreos.com
|
|
- prometheusrules.monitoring.coreos.com
|
|
- provisioningrequests.autoscaling.x-k8s.io
|
|
- pytorchjobs.kubeflow.org
|
|
- queues.scheduling.run.ai
|
|
- redirectservices.networking.gke.io
|
|
- remotenodes.networking.gke.io
|
|
- revisions.serving.knative.dev
|
|
- routes.serving.knative.dev
|
|
- rules.monitoring.googleapis.com
|
|
- runaiaces.runai.dgxc.nvidia.com
|
|
- runaiconfigs.run.ai
|
|
- runaidgxclogexporters.runai.dgxc.nvidia.com
|
|
- runaidgxcnetworkpolicies.runai.dgxc.nvidia.com
|
|
- runaidgxcstorages.runai.dgxc.nvidia.com
|
|
- runaijobs.run.ai
|
|
- runaiplatforms.runai.dgxc.nvidia.com
|
|
- runairuntimes.runai.dgxc.nvidia.com
|
|
- schedulingshards.engine.run.ai
|
|
- scrapeconfigs.monitoring.coreos.com
|
|
- secretproviderclasses.secrets-store.csi.x-k8s.io
|
|
- secretproviderclasspodstatuses.secrets-store.csi.x-k8s.io
|
|
- serverlessservices.networking.internal.knative.dev
|
|
- serviceattachments.networking.gke.io
|
|
- servicefunctionchains.networking.gke.io
|
|
- servicemonitors.monitoring.coreos.com
|
|
- servicenetworkendpointgroups.networking.gke.io
|
|
- services.serving.knative.dev
|
|
- skyhooks.skyhook.nvidia.com
|
|
- sriovnetworknodestates.networking.gke.io
|
|
- sriovoperatorconfigs.networking.gke.io
|
|
- tfjobs.kubeflow.org
|
|
- thanosrulers.monitoring.coreos.com
|
|
- trafficselectors.networking.gke.io
|
|
- trainingpolicies.run.ai
|
|
- trainingworkloads.run.ai
|
|
- trustconfigs.security.cloud.google.com
|
|
- updateinfos.nodemanagement.gke.io
|
|
- updaterequests.kyverno.io
|
|
- volumesnapshotclasses.snapshot.storage.k8s.io
|
|
- volumesnapshotcontents.snapshot.storage.k8s.io
|
|
- volumesnapshots.snapshot.storage.k8s.io
|
|
- workloadallowlists.auto.gke.io
|
|
- workloadcertificateconfigs.security.cloud.google.com
|
|
- xgboostjobs.kubeflow.org
|
|
- apiGroup: networking.k8s.io
|
|
kind: IngressClass
|
|
resources:
|
|
- ingressclasses
|
|
verbs:
|
|
# - create
|
|
# - delete
|
|
# - deletecollection
|
|
- get
|
|
- list
|
|
# - patch
|
|
# - update
|
|
- watch
|
|
systemResources:
|
|
- nginx
|
|
- apiGroup: ""
|
|
kind: Namespace
|
|
resources:
|
|
- namespaces
|
|
- namespaces/finalize
|
|
- namespaces/status
|
|
verbs:
|
|
- "*"
|
|
systemResources:
|
|
- anthos-identity-service
|
|
- argocd
|
|
- cert-manager
|
|
- default
|
|
- dgxc-admission-controller
|
|
- dgxc-cluster-validator
|
|
- dgxc-tenant-cluster-policies
|
|
- gke-managed-filestorecsi
|
|
- gke-managed-system
|
|
- gmp-public
|
|
- gmp-system
|
|
- gpu-operator
|
|
- ingress-nginx
|
|
- knative-serving
|
|
- kourier-system
|
|
- kube-node-lease
|
|
- kube-public
|
|
- kube-system
|
|
- kubeflow
|
|
- kyverno
|
|
- lalit
|
|
- monitoring
|
|
- mpi-operator
|
|
- node-problem-detector
|
|
- nvdiag
|
|
- nvsentinel
|
|
- observability
|
|
- osmo
|
|
- prometheus
|
|
- runai
|
|
- skyhook
|
|
- test-ns
|
|
- apiGroup: ""
|
|
kind: PersistentVolume
|
|
resources:
|
|
- persistentvolumes
|
|
- persistentvolumes/status
|
|
verbs:
|
|
# - create
|
|
# - delete
|
|
# - deletecollection
|
|
- get
|
|
- list
|
|
# - patch
|
|
# - update
|
|
- watch
|
|
systemResources: []
|
|
- apiGroup: scheduling.k8s.io
|
|
kind: PriorityClass
|
|
resources:
|
|
- priorityclasses
|
|
verbs:
|
|
- "*"
|
|
systemResources:
|
|
- build
|
|
- gmp-critical
|
|
- inference
|
|
- interactive-preemptible
|
|
- runai-critical
|
|
- runai-engine-critical
|
|
- system-cluster-critical
|
|
- system-node-critical
|
|
- train
|
|
- train-critical
|
|
- train-high
|
|
- apiGroup: authorization.k8s.io
|
|
kind: SelfSubjectAccessReview
|
|
resources:
|
|
- selfsubjectaccessreviews
|
|
verbs:
|
|
- "*"
|
|
systemResources: []
|
|
- apiGroup: authentication.k8s.io
|
|
kind: SelfSubjectReview
|
|
resources:
|
|
- selfsubjectreviews
|
|
verbs:
|
|
- "*"
|
|
systemResources: []
|
|
- apiGroup: authorization.k8s.io
|
|
kind: SelfSubjectRulesReview
|
|
resources:
|
|
- selfsubjectrulesreviews
|
|
verbs:
|
|
- "*"
|
|
systemResources: []
|
|
- apiGroup: authorization.k8s.io
|
|
kind: SubjectAccessReview
|
|
resources:
|
|
- subjectaccessreviews
|
|
verbs:
|
|
- "*"
|
|
systemResources: []
|
|
- apiGroup: authentication.k8s.io
|
|
kind: TokenReview
|
|
resources:
|
|
- tokenreviews
|
|
verbs:
|
|
- "*"
|
|
systemResources: []
|
|
|
|
namespacedKinds:
|
|
- apiGroup: policy
|
|
resources:
|
|
- pods/eviction
|
|
verbs:
|
|
- create
|
|
- apiGroup: ""
|
|
kind: Binding
|
|
resources:
|
|
- bindings
|
|
verbs:
|
|
- "*"
|
|
- apiGroup: ""
|
|
kind: ConfigMap
|
|
resources:
|
|
- configmaps
|
|
verbs:
|
|
- "*"
|
|
- apiGroup: apps
|
|
kind: ControllerRevision
|
|
resources:
|
|
- controllerrevisions
|
|
verbs:
|
|
- "*"
|
|
- apiGroup: batch
|
|
kind: CronJob
|
|
resources:
|
|
- cronjobs
|
|
- cronjobs/status
|
|
verbs:
|
|
- "*"
|
|
- apiGroup: apps
|
|
kind: DaemonSet
|
|
resources:
|
|
- daemonsets
|
|
- daemonsets/status
|
|
verbs:
|
|
- "*"
|
|
- apiGroup: apps
|
|
kind: Deployment
|
|
resources:
|
|
- deployments
|
|
- deployments/scale
|
|
- deployments/status
|
|
verbs:
|
|
- "*"
|
|
- apiGroup: discovery.k8s.io
|
|
kind: EndpointSlice
|
|
resources:
|
|
- endpointslices
|
|
verbs:
|
|
- "*"
|
|
- apiGroup: ""
|
|
kind: Endpoints
|
|
resources:
|
|
- endpoints
|
|
verbs:
|
|
- "*"
|
|
- apiGroup: events.k8s.io
|
|
kind: Event
|
|
resources:
|
|
- events
|
|
verbs:
|
|
- "*"
|
|
- apiGroup: ""
|
|
kind: Event
|
|
resources:
|
|
- events
|
|
verbs:
|
|
- "*"
|
|
- apiGroup: autoscaling
|
|
kind: HorizontalPodAutoscaler
|
|
resources:
|
|
- horizontalpodautoscalers
|
|
- horizontalpodautoscalers/status
|
|
verbs:
|
|
- "*"
|
|
- apiGroup: networking.k8s.io
|
|
kind: Ingress
|
|
resources:
|
|
- ingresses
|
|
- ingresses/status
|
|
verbs:
|
|
- "*"
|
|
- apiGroup: batch
|
|
kind: Job
|
|
resources:
|
|
- jobs
|
|
- jobs/status
|
|
verbs:
|
|
- "*"
|
|
- apiGroup: coordination.k8s.io
|
|
kind: Lease
|
|
resources:
|
|
- leases
|
|
verbs:
|
|
- "*"
|
|
- apiGroup: ""
|
|
kind: LimitRange
|
|
resources:
|
|
- limitranges
|
|
verbs:
|
|
- "*"
|
|
- apiGroup: authorization.k8s.io
|
|
kind: LocalSubjectAccessReview
|
|
resources:
|
|
- localsubjectaccessreviews
|
|
verbs:
|
|
- "*"
|
|
- apiGroup: networking.k8s.io
|
|
kind: NetworkPolicy
|
|
resources:
|
|
- networkpolicies
|
|
verbs:
|
|
- "*"
|
|
- apiGroup: ""
|
|
kind: PersistentVolumeClaim
|
|
resources:
|
|
- persistentvolumeclaims
|
|
- persistentvolumeclaims/status
|
|
verbs:
|
|
- "*"
|
|
- apiGroup: ""
|
|
kind: Pod
|
|
resources:
|
|
- pods
|
|
- pods/attach
|
|
- pods/binding
|
|
- pods/ephemeralcontainers
|
|
- pods/eviction
|
|
- pods/exec
|
|
- pods/log
|
|
- pods/portforward
|
|
- pods/proxy
|
|
- pods/status
|
|
verbs:
|
|
- "*"
|
|
- apiGroup: policy
|
|
kind: PodDisruptionBudget
|
|
resources:
|
|
- poddisruptionbudgets
|
|
- poddisruptionbudgets/status
|
|
verbs:
|
|
- "*"
|
|
- apiGroup: ""
|
|
kind: PodTemplate
|
|
resources:
|
|
- podtemplates
|
|
verbs:
|
|
- "*"
|
|
- apiGroup: apps
|
|
kind: ReplicaSet
|
|
resources:
|
|
- replicasets
|
|
- replicasets/scale
|
|
- replicasets/status
|
|
verbs:
|
|
- "*"
|
|
- apiGroup: ""
|
|
kind: ReplicationController
|
|
resources:
|
|
- replicationcontrollers
|
|
- replicationcontrollers/scale
|
|
- replicationcontrollers/status
|
|
verbs:
|
|
- "*"
|
|
- apiGroup: ""
|
|
kind: ResourceQuota
|
|
resources:
|
|
- resourcequotas
|
|
- resourcequotas/status
|
|
verbs:
|
|
- "*"
|
|
- apiGroup: rbac.authorization.k8s.io
|
|
kind: Role
|
|
resources:
|
|
- roles
|
|
verbs:
|
|
- create
|
|
- delete
|
|
- deletecollection
|
|
- get
|
|
- list
|
|
- patch
|
|
- update
|
|
- watch
|
|
# - bind
|
|
# - escalate
|
|
- apiGroup: rbac.authorization.k8s.io
|
|
kind: RoleBinding
|
|
resources:
|
|
- rolebindings
|
|
verbs:
|
|
- "*"
|
|
- apiGroup: ""
|
|
kind: Secret
|
|
resources:
|
|
- secrets
|
|
verbs:
|
|
- "*"
|
|
- apiGroup: ""
|
|
kind: Service
|
|
resources:
|
|
- services
|
|
- services/proxy
|
|
- services/status
|
|
verbs:
|
|
- "*"
|
|
- apiGroup: ""
|
|
kind: ServiceAccount
|
|
resources:
|
|
- serviceaccounts
|
|
- serviceaccounts/token
|
|
verbs:
|
|
- create
|
|
- delete
|
|
- deletecollection
|
|
- get
|
|
- list
|
|
- patch
|
|
- update
|
|
- watch
|
|
# - impersonate
|
|
- apiGroup: apps
|
|
kind: StatefulSet
|
|
resources:
|
|
- statefulsets
|
|
- statefulsets/scale
|
|
- statefulsets/status
|
|
verbs:
|
|
- "*"
|
|
|
|
systemSubjects:
|
|
User:
|
|
- cluster-autoscaler
|
|
- kube-apiserver
|
|
- kubelet
|
|
- kubelet-bootstrap
|
|
- kyverno@test.com
|
|
- ladithyav@nvidia.com
|
|
- pwittrock@nvidia.com
|
|
- system:anet-controller-manager
|
|
- system:anet-operator
|
|
- system:cloud-controller-manager
|
|
- system:cluster-autoscaler
|
|
- system:clustermetrics
|
|
- system:controller:glbc
|
|
- system:filestorecsi-controller
|
|
- system:gcp-controller-manager
|
|
- system:gke-common-webhooks
|
|
- system:gke-spiffe-controller
|
|
- system:konnectivity-server
|
|
- system:kube-controller-manager
|
|
- system:kube-proxy
|
|
- system:kube-scheduler
|
|
- system:kubestore-collector
|
|
- system:l7-lb-controller
|
|
- system:maintenance-controller
|
|
- system:managed-certificate-controller
|
|
- system:master-prom-to-sd-monitor
|
|
- system:metrics-server-nanny
|
|
- system:network-controller-manager
|
|
- system:node-problem-detector
|
|
- system:pdcsi-controller
|
|
- system:resource-tracker
|
|
- system:service-steering
|
|
- system:slo-monitor
|
|
- system:snapshot-controller
|
|
- system:vpa-recommender
|
|
Group:
|
|
- access-f-dgx-cloud-runai-non-prod-gcp-admin@nvidia.com
|
|
- access-f-dgx-cloud-runai-non-prod-gcp-engineer@nvidia.com
|
|
- access-f-dgx-cloud-runai-prod-gcp-admin@nvidia.com
|
|
- access-f-dgx-cloud-runai-prod-gcp-engineer@nvidia.com
|
|
- hcuf-f-dgx-cloud-runai-non-prod-gcp-admin@nvidia.com
|
|
- hcuf-f-dgx-cloud-runai-non-prod-gcp-engineer@nvidia.com
|
|
- hcuf-f-dgx-cloud-runai-prod-gcp-admin@nvidia.com
|
|
- hcuf-f-dgx-cloud-runai-prod-gcp-engineer@nvidia.com
|
|
- system:masters
|
|
- system:monitoring
|
|
- system:nodes
|
|
- system:serviceaccounts
|
|
- system:unauthenticated
|
|
|
|
|