You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
1048 lines
30 KiB
1048 lines
30 KiB
|
|
####################################################################
|
|
##### The portion below this marker is automatically generated #####
|
|
##### DO NOT EDIT BY HAND #####
|
|
####################################################################
|
|
|
|
clusterScopedKinds:
|
|
- apiGroup: ""
|
|
resources:
|
|
- persistentvolumeclaims/finalizers
|
|
verbs:
|
|
- create
|
|
- update
|
|
- delete
|
|
- get
|
|
systemResources: []
|
|
- apiGroup: argoproj.io
|
|
resources:
|
|
- eventsources
|
|
- sensors
|
|
verbs:
|
|
- "*"
|
|
systemResources: []
|
|
- apiGroup: extensions
|
|
resources:
|
|
- ingresses
|
|
verbs:
|
|
- create
|
|
- delete
|
|
- get
|
|
- list
|
|
- patch
|
|
- update
|
|
- watch
|
|
systemResources: []
|
|
- apiGroup: route.openshift.io
|
|
resources:
|
|
- "*"
|
|
verbs:
|
|
- "*"
|
|
systemResources: []
|
|
- apiGroup: ""
|
|
resources:
|
|
- configmaps/status
|
|
verbs:
|
|
- "*"
|
|
systemResources: []
|
|
- apiGroup: nvidia.com
|
|
kind: ClusterPolicy
|
|
resources:
|
|
- clusterpolicies
|
|
- clusterpolicies/status
|
|
verbs:
|
|
- "*"
|
|
systemResources:
|
|
- cluster-policy
|
|
- apiGroup: rbac.authorization.k8s.io
|
|
kind: ClusterRole
|
|
resources:
|
|
- clusterroles
|
|
verbs:
|
|
- create
|
|
- delete
|
|
- deletecollection
|
|
- get
|
|
- list
|
|
- patch
|
|
- update
|
|
- watch
|
|
# - bind
|
|
# - escalate
|
|
systemResources:
|
|
- admin
|
|
- approve-node-client-csr
|
|
- approve-node-client-renewal-csr
|
|
- approve-node-server-renewal-csr
|
|
- argocd-application-controller
|
|
- argocd-notifications-controller
|
|
- argocd-server
|
|
- assets-sync
|
|
- assets-sync-cluster
|
|
- cert-manager-cainjector
|
|
- cert-manager-cluster-view
|
|
- cert-manager-controller-approve:cert-manager-io
|
|
- cert-manager-controller-certificates
|
|
- cert-manager-controller-certificatesigningrequests
|
|
- cert-manager-controller-challenges
|
|
- cert-manager-controller-clusterissuers
|
|
- cert-manager-controller-ingress-shim
|
|
- cert-manager-controller-issuers
|
|
- cert-manager-controller-orders
|
|
- cert-manager-edit
|
|
- cert-manager-view
|
|
- cert-manager-webhook:subjectaccessreviews
|
|
- cilium
|
|
- cilium-operator
|
|
- cluster-admin
|
|
- cluster-sync
|
|
- cluster-sync-project
|
|
- csi-oci-driver-registrar-role
|
|
- dgxc-admission-controller
|
|
- dgxc-customer-app-admin
|
|
- dgxc-customer-app-admin-base
|
|
- dgxc-customer-network-policy
|
|
- dgxc-exporter
|
|
- dgxc-logging-alloy
|
|
- dgxc-runai-controller
|
|
- edit
|
|
- gpu-operator
|
|
- gpu-operator-node-feature-discovery
|
|
- gpu-operator-node-feature-discovery-gc
|
|
- ingress-nginx
|
|
- knative-serving-activator-cluster
|
|
- knative-serving-addressable-resolver
|
|
- knative-serving-admin
|
|
- knative-serving-aggregated-addressable-resolver
|
|
- knative-serving-core
|
|
- knative-serving-namespaced-admin
|
|
- knative-serving-namespaced-edit
|
|
- knative-serving-namespaced-view
|
|
- knative-serving-podspecable-binding
|
|
- kratos-fluent-bit-read
|
|
- kube-dns-autoscaler
|
|
- kubeadm:get-nodes
|
|
- kubeflow-mpijobs-admin
|
|
- kubeflow-mpijobs-edit
|
|
- kubeflow-mpijobs-view
|
|
- kyverno-cleanup-jobs
|
|
- kyverno:admission-controller
|
|
- kyverno:admission-controller:additional
|
|
- kyverno:admission-controller:core
|
|
- kyverno:background-controller
|
|
- kyverno:background-controller:additional
|
|
- kyverno:background-controller:core
|
|
- kyverno:cleanup-controller
|
|
- kyverno:cleanup-controller:core
|
|
- kyverno:dgxc-integrations
|
|
- kyverno:rbac:admin:policies
|
|
- kyverno:rbac:admin:policyreports
|
|
- kyverno:rbac:admin:reports
|
|
- kyverno:rbac:admin:updaterequests
|
|
- kyverno:rbac:view:policies
|
|
- kyverno:rbac:view:policyreports
|
|
- kyverno:rbac:view:reports
|
|
- kyverno:rbac:view:updaterequests
|
|
- kyverno:reports-controller
|
|
- kyverno:reports-controller:core
|
|
- kyverno:watch-update-namespaces
|
|
- kyverno:watch-update-services
|
|
- metrics-exporter
|
|
- mpi-operator
|
|
- multus
|
|
- net-kourier
|
|
- network-operator
|
|
- node-problem-detector-cpu
|
|
- node-problem-detector-gpu
|
|
- node-scale-adjuster-ro
|
|
- node-termination-handler
|
|
- nodepool-controller
|
|
- nv-ipam-controller
|
|
- nv-ipam-node
|
|
- nvidia-device-plugin
|
|
- nvidia-device-plugin-mps-control-daemon
|
|
- nvidia-driver
|
|
- nvidia-gpu-feature-discovery
|
|
- nvidia-mig-manager
|
|
- nvidia-operator-validator
|
|
- nvsentinel
|
|
- oci-secrets-store-csi-driver-provider-cluster-role
|
|
- oke-nvidia-device-plugin
|
|
- pod-group-assigner
|
|
- pod-group-controller
|
|
- pod-group-controller-ro
|
|
- pod-grouper
|
|
- prometheus-kube-state-metrics
|
|
- prometheus-operator
|
|
- prometheus-prometheus
|
|
- queue-controller
|
|
- researcher-service-ro
|
|
- researcher-service-rw
|
|
- runai-accessrule-controller
|
|
- runai-accessrule-controller-project
|
|
- runai-admission-controller-project
|
|
- runai-admission-controller-ro
|
|
- runai-agent
|
|
- runai-binder-cluster-wide
|
|
- runai-binder-project
|
|
- runai-cluster-api
|
|
- runai-cluster-api-project
|
|
- runai-compute-resource-administrator
|
|
- runai-compute-resource-administrator-ns
|
|
- runai-compute-resource-administrator-runai
|
|
- runai-credentials-administrator
|
|
- runai-credentials-administrator-ns
|
|
- runai-credentials-administrator-runai
|
|
- runai-data-source-administrator
|
|
- runai-data-source-administrator-ns
|
|
- runai-data-source-administrator-runai
|
|
- runai-data-source-administrator-runai-cs
|
|
- runai-data-volume-administrator
|
|
- runai-data-volume-administrator-ns
|
|
- runai-data-volume-administrator-runai
|
|
- runai-department-administrator
|
|
- runai-department-administrator-ns
|
|
- runai-department-administrator-runai
|
|
- runai-department-viewer
|
|
- runai-department-viewer-ns
|
|
- runai-department-viewer-runai
|
|
- runai-device-plugin
|
|
- runai-editor
|
|
- runai-editor-ns
|
|
- runai-editor-runai
|
|
- runai-engine-operator
|
|
- runai-environment-administrator
|
|
- runai-environment-administrator-ns
|
|
- runai-environment-administrator-runai
|
|
- runai-external-workload-integrator
|
|
- runai-external-workload-integrator-project
|
|
- runai-inference-workload-controller
|
|
- runai-inference-workload-controller-project
|
|
- runai-init-ca
|
|
- runai-job-controller
|
|
- runai-job-controller-project
|
|
- runai-l1-researcher
|
|
- runai-l1-researcher-ns
|
|
- runai-l1-researcher-runai
|
|
- runai-l2-researcher
|
|
- runai-l2-researcher-ns
|
|
- runai-l2-researcher-runai
|
|
- runai-mig-parted
|
|
- runai-ml-engineer
|
|
- runai-ml-engineer-ns
|
|
- runai-ml-engineer-runai
|
|
- runai-operator
|
|
- runai-project-controller
|
|
- runai-project-controller-cluster-pvc
|
|
- runai-project-controller-cluster-pvc-per-project
|
|
- runai-project-controller-cluster-secret
|
|
- runai-project-controller-cluster-secret-per-project
|
|
- runai-project-controller-limit-range
|
|
- runai-project-controller-limit-range-per-project
|
|
- runai-project-controller-ns-creation
|
|
- runai-project-controller-resources-patcher
|
|
- runai-project-controller-rolebinding-creation
|
|
- runai-project-controller-servicemonitor-creation
|
|
- runai-prometheus
|
|
- runai-research-manager
|
|
- runai-research-manager-ns
|
|
- runai-research-manager-runai
|
|
- runai-resource-reservation-rw
|
|
- runai-scheduler-ro
|
|
- runai-scheduler-rw
|
|
- runai-shared-objects-controller
|
|
- runai-shared-objects-controller-project
|
|
- runai-system-administrator
|
|
- runai-system-administrator-ns
|
|
- runai-system-administrator-runai
|
|
- runai-system-administrator-runai-cs
|
|
- runai-template-administrator
|
|
- runai-template-administrator-ns
|
|
- runai-template-administrator-runai
|
|
- runai-viewer
|
|
- runai-viewer-ns
|
|
- runai-viewer-runai
|
|
- runai-workload-exporter
|
|
- secretproviderclasses-admin-role
|
|
- secretproviderclasses-role
|
|
- secretproviderclasses-viewer-role
|
|
- secretproviderclasspodstatuses-viewer-role
|
|
- skyhook-operator-manager-role
|
|
- skyhook-operator-metrics-reader
|
|
- skyhook-operator-proxy-role
|
|
- sre-cluster-scoped-access
|
|
- status-updater
|
|
- status-updater-ro
|
|
- system:aggregate-to-admin
|
|
- system:aggregate-to-edit
|
|
- system:aggregate-to-view
|
|
- system:auth-delegator
|
|
- system:basic-user
|
|
- system:certificates.k8s.io:certificatesigningrequests:nodeclient
|
|
- system:certificates.k8s.io:certificatesigningrequests:selfnodeclient
|
|
- system:certificates.k8s.io:kube-apiserver-client-approver
|
|
- system:certificates.k8s.io:kube-apiserver-client-kubelet-approver
|
|
- system:certificates.k8s.io:kubelet-serving-approver
|
|
- system:certificates.k8s.io:legacy-unknown-approver
|
|
- system:controller:attachdetach-controller
|
|
- system:controller:certificate-controller
|
|
- system:controller:clusterrole-aggregation-controller
|
|
- system:controller:cronjob-controller
|
|
- system:controller:daemon-set-controller
|
|
- system:controller:deployment-controller
|
|
- system:controller:disruption-controller
|
|
- system:controller:endpoint-controller
|
|
- system:controller:endpointslice-controller
|
|
- system:controller:endpointslicemirroring-controller
|
|
- system:controller:ephemeral-volume-controller
|
|
- system:controller:expand-controller
|
|
- system:controller:generic-garbage-collector
|
|
- system:controller:horizontal-pod-autoscaler
|
|
- system:controller:job-controller
|
|
- system:controller:legacy-service-account-token-cleaner
|
|
- system:controller:namespace-controller
|
|
- system:controller:node-controller
|
|
- system:controller:persistent-volume-binder
|
|
- system:controller:pod-garbage-collector
|
|
- system:controller:pv-protection-controller
|
|
- system:controller:pvc-protection-controller
|
|
- system:controller:replicaset-controller
|
|
- system:controller:replication-controller
|
|
- system:controller:resourcequota-controller
|
|
- system:controller:root-ca-cert-publisher
|
|
- system:controller:route-controller
|
|
- system:controller:service-account-controller
|
|
- system:controller:service-controller
|
|
- system:controller:statefulset-controller
|
|
- system:controller:ttl-after-finished-controller
|
|
- system:controller:ttl-controller
|
|
- system:controller:validatingadmissionpolicy-status-controller
|
|
- system:coredns
|
|
- system:discovery
|
|
- system:heapster
|
|
- system:kube-aggregator
|
|
- system:kube-controller-manager
|
|
- system:kube-dns
|
|
- system:kube-scheduler
|
|
- system:kubelet-api-admin
|
|
- system:monitoring
|
|
- system:node
|
|
- system:node-bootstrapper
|
|
- system:node-problem-detector
|
|
- system:node-proxier
|
|
- system:persistent-volume-provisioner
|
|
- system:proxymux
|
|
- system:public-info-viewer
|
|
- system:service-account-issuer-discovery
|
|
- system:volume-scheduler
|
|
- training-operator
|
|
- vace-role
|
|
- view
|
|
- workload-controller-ro
|
|
- workload-controller-rw
|
|
- workload-overseer
|
|
- apiGroup: rbac.authorization.k8s.io
|
|
kind: ClusterRoleBinding
|
|
resources:
|
|
- clusterrolebindings
|
|
verbs:
|
|
- "*"
|
|
systemResources:
|
|
- argocd-application-controller
|
|
- argocd-notifications-controller
|
|
- argocd-server
|
|
- assets-sync
|
|
- cert-manager-cainjector
|
|
- cert-manager-controller-approve:cert-manager-io
|
|
- cert-manager-controller-certificates
|
|
- cert-manager-controller-certificatesigningrequests
|
|
- cert-manager-controller-challenges
|
|
- cert-manager-controller-clusterissuers
|
|
- cert-manager-controller-ingress-shim
|
|
- cert-manager-controller-issuers
|
|
- cert-manager-controller-orders
|
|
- cert-manager-webhook:subjectaccessreviews
|
|
- cilium
|
|
- cilium-operator
|
|
- cluster-admin
|
|
- cluster-sync
|
|
- csi-oci-driver-registrar-binding
|
|
- dgxc-admission-controller
|
|
- dgxc-customer-app-admin
|
|
# - dgxc-customer-app-admin-access
|
|
- dgxc-exporter
|
|
- dgxc-logging-alloy
|
|
- dgxc-runai-controller
|
|
- gpu-operator
|
|
- gpu-operator-node-feature-discovery
|
|
- gpu-operator-node-feature-discovery-gc
|
|
- ingress-nginx
|
|
- knative-serving-activator-cluster
|
|
- knative-serving-controller-addressable-resolver
|
|
- knative-serving-controller-admin
|
|
- kratos-fluent-bit-read
|
|
- kube-dns-autoscaler
|
|
- kubeadm:get-nodes
|
|
- kubeadm:kubelet-bootstrap
|
|
- kubeadm:node-autoapprove-bootstrap
|
|
- kubeadm:node-autoapprove-certificate-rotation
|
|
- kubeadm:node-proxier
|
|
- kubelet-bootstrap
|
|
- kyverno-cleanup-jobs
|
|
- kyverno:admission-controller
|
|
- kyverno:background-controller
|
|
- kyverno:cleanup-controller
|
|
- kyverno:reports-controller
|
|
- metrics-exporter
|
|
- mpi-operator
|
|
- multus
|
|
- net-kourier
|
|
- network-operator
|
|
- node-bootstrapper-auto-approve-csrs
|
|
- node-bootstrapper-client-cert-renewal
|
|
- node-problem-detector-cpu
|
|
- node-problem-detector-gpu
|
|
- node-scale-adjuster-ro
|
|
- node-termination-handler
|
|
- nodepool-controller
|
|
- nv-ipam-controller
|
|
- nv-ipam-node
|
|
- nvidia-device-plugin
|
|
- nvidia-device-plugin-mps-control-daemon
|
|
- nvidia-driver
|
|
- nvidia-gpu-feature-discovery
|
|
- nvidia-mig-manager
|
|
- nvidia-operator-validator
|
|
- nvsentinel
|
|
- nvsentinel-shoreline
|
|
- oci-secrets-store-csi-driver-provider-cluster-rolebinding
|
|
- oke-nvidia-device-plugin
|
|
- pod-group-assigner
|
|
- pod-group-controller-ro
|
|
- pod-grouper
|
|
- prometheus-kube-state-metrics
|
|
- prometheus-operator
|
|
- prometheus-prometheus
|
|
- queue-controller
|
|
- researcher-service-ro
|
|
- runai-accessrule-controller
|
|
- runai-admission-controller-ro
|
|
- runai-agent
|
|
- runai-binder-cluster-wide
|
|
- runai-cluster-api
|
|
- runai-compute-resource-administrator
|
|
- runai-credentials-administrator
|
|
- runai-data-source-administrator
|
|
- runai-data-volume-administrator
|
|
- runai-department-administrator
|
|
- runai-department-viewer
|
|
- runai-device-plugin
|
|
- runai-editor
|
|
- runai-engine-operator
|
|
- runai-environment-administrator
|
|
- runai-external-workload-integrator
|
|
- runai-inference-workload-controller
|
|
- runai-init-ca
|
|
- runai-job-controller
|
|
- runai-l1-researcher
|
|
- runai-l2-researcher
|
|
- runai-mig-parted
|
|
- runai-ml-engineer
|
|
- runai-operator
|
|
- runai-project-controller
|
|
- runai-project-controller-cluster-pvc
|
|
- runai-project-controller-cluster-secret
|
|
- runai-project-controller-limit-range
|
|
- runai-project-controller-ns-creation
|
|
- runai-project-controller-rolebinding-creation
|
|
- runai-project-controller-servicemonitor-creation
|
|
- runai-prometheus
|
|
- runai-research-manager
|
|
- runai-scheduler-ro
|
|
- runai-shared-objects-controller
|
|
- runai-system-administrator
|
|
- runai-template-administrator
|
|
- runai-viewer
|
|
- runai-workload-exporter
|
|
- secretproviderclasses-rolebinding
|
|
- skyhook-operator-manager-rolebinding
|
|
- skyhook-operator-proxy-rolebinding
|
|
- sre-cluster-scoped-access
|
|
- sre-full-access-binding
|
|
- status-updater-ro
|
|
- system:basic-user
|
|
- system:controller:attachdetach-controller
|
|
- system:controller:certificate-controller
|
|
- system:controller:clusterrole-aggregation-controller
|
|
- system:controller:cronjob-controller
|
|
- system:controller:daemon-set-controller
|
|
- system:controller:deployment-controller
|
|
- system:controller:disruption-controller
|
|
- system:controller:endpoint-controller
|
|
- system:controller:endpointslice-controller
|
|
- system:controller:endpointslicemirroring-controller
|
|
- system:controller:ephemeral-volume-controller
|
|
- system:controller:expand-controller
|
|
- system:controller:generic-garbage-collector
|
|
- system:controller:horizontal-pod-autoscaler
|
|
- system:controller:job-controller
|
|
- system:controller:legacy-service-account-token-cleaner
|
|
- system:controller:namespace-controller
|
|
- system:controller:node-controller
|
|
- system:controller:persistent-volume-binder
|
|
- system:controller:pod-garbage-collector
|
|
- system:controller:pv-protection-controller
|
|
- system:controller:pvc-protection-controller
|
|
- system:controller:replicaset-controller
|
|
- system:controller:replication-controller
|
|
- system:controller:resourcequota-controller
|
|
- system:controller:root-ca-cert-publisher
|
|
- system:controller:route-controller
|
|
- system:controller:service-account-controller
|
|
- system:controller:service-controller
|
|
- system:controller:statefulset-controller
|
|
- system:controller:ttl-after-finished-controller
|
|
- system:controller:ttl-controller
|
|
- system:controller:validatingadmissionpolicy-status-controller
|
|
- system:coredns
|
|
- system:discovery
|
|
- system:kube-controller-manager
|
|
- system:kube-dns
|
|
- system:kube-nodes
|
|
- system:kube-scheduler
|
|
- system:monitoring
|
|
- system:node
|
|
- system:node-proxier
|
|
- system:proxymux
|
|
- system:public-info-viewer
|
|
- system:service-account-issuer-discovery
|
|
- system:volume-scheduler
|
|
- training-operator
|
|
- vace-rolebinding
|
|
- workload-controller-ro
|
|
- workload-overseer
|
|
- apiGroup: ""
|
|
kind: ComponentStatus
|
|
resources:
|
|
- componentstatuses
|
|
verbs:
|
|
- "*"
|
|
systemResources:
|
|
- scheduler
|
|
- controller-manager
|
|
- etcd-0
|
|
- apiGroup: apiextensions.k8s.io
|
|
kind: CustomResourceDefinition
|
|
resources:
|
|
- customresourcedefinitions
|
|
- customresourcedefinitions/status
|
|
verbs:
|
|
- "*"
|
|
systemResources:
|
|
- accessrules.run.ai
|
|
- admissionreports.kyverno.io
|
|
- alertmanagerconfigs.monitoring.coreos.com
|
|
- alertmanagers.monitoring.coreos.com
|
|
- applications.argoproj.io
|
|
- applicationsets.argoproj.io
|
|
- appprojects.argoproj.io
|
|
- backgroundscanreports.kyverno.io
|
|
- bindrequests.scheduling.run.ai
|
|
- certificaterequests.cert-manager.io
|
|
- certificates.cert-manager.io
|
|
- certificates.networking.internal.knative.dev
|
|
- challenges.acme.cert-manager.io
|
|
- cidrpools.nv-ipam.nvidia.com
|
|
- ciliumcidrgroups.cilium.io
|
|
- ciliumclusterwidenetworkpolicies.cilium.io
|
|
- ciliumendpoints.cilium.io
|
|
- ciliumexternalworkloads.cilium.io
|
|
- ciliumidentities.cilium.io
|
|
- ciliuml2announcementpolicies.cilium.io
|
|
- ciliumloadbalancerippools.cilium.io
|
|
- ciliumnetworkpolicies.cilium.io
|
|
- ciliumnodeconfigs.cilium.io
|
|
- ciliumnodes.cilium.io
|
|
- ciliumpodippools.cilium.io
|
|
- cleanuppolicies.kyverno.io
|
|
- clusteradmissionreports.kyverno.io
|
|
- clusterbackgroundscanreports.kyverno.io
|
|
- clustercleanuppolicies.kyverno.io
|
|
- clusterdomainclaims.networking.internal.knative.dev
|
|
- clusterissuers.cert-manager.io
|
|
- clusterpolicies.kyverno.io
|
|
- clusterpolicies.nvidia.com
|
|
- clusterpolicyreports.wgpolicyk8s.io
|
|
- configs.engine.run.ai
|
|
- configurations.serving.knative.dev
|
|
- datavolumes.run.ai
|
|
- departments.scheduling.run.ai
|
|
- distributedpolicies.run.ai
|
|
- distributedworkloads.run.ai
|
|
- domainmappings.serving.knative.dev
|
|
- externalworkloads.run.ai
|
|
- hostdevicenetworks.mellanox.com
|
|
- images.caching.internal.knative.dev
|
|
- inferencepolicies.run.ai
|
|
- inferenceworkloads.run.ai
|
|
- ingresses.networking.internal.knative.dev
|
|
- interactivepolicies.run.ai
|
|
- interactiveworkloads.run.ai
|
|
- ipoibnetworks.mellanox.com
|
|
- ippools.nv-ipam.nvidia.com
|
|
- issuers.cert-manager.io
|
|
- macvlannetworks.mellanox.com
|
|
- metrics.autoscaling.internal.knative.dev
|
|
- mpijobs.kubeflow.org
|
|
- mxjobs.kubeflow.org
|
|
- network-attachment-definitions.k8s.cni.cncf.io
|
|
- nicclusterpolicies.mellanox.com
|
|
- nodefeaturegroups.nfd.k8s-sigs.io
|
|
- nodefeaturerules.nfd.k8s-sigs.io
|
|
- nodefeatures.nfd.k8s-sigs.io
|
|
- nodepools.run.ai
|
|
- nvidiadrivers.nvidia.com
|
|
- orders.acme.cert-manager.io
|
|
- paddlejobs.kubeflow.org
|
|
- podautoscalers.autoscaling.internal.knative.dev
|
|
- podgroups.scheduling.run.ai
|
|
- podlogs.monitoring.grafana.com
|
|
- podmonitors.monitoring.coreos.com
|
|
- policies.kyverno.io
|
|
- policyexceptions.kyverno.io
|
|
- policyreports.wgpolicyk8s.io
|
|
- probes.monitoring.coreos.com
|
|
- projects.run.ai
|
|
- prometheusagents.monitoring.coreos.com
|
|
- prometheuses.monitoring.coreos.com
|
|
- prometheusrules.monitoring.coreos.com
|
|
- pytorchjobs.kubeflow.org
|
|
- queues.scheduling.run.ai
|
|
- revisions.serving.knative.dev
|
|
- routes.serving.knative.dev
|
|
- runaiconfigs.run.ai
|
|
- runaidgxclogexporters.runai.dgxc.nvidia.com
|
|
- runaidgxcnetworkpolicies.runai.dgxc.nvidia.com
|
|
- runaidgxcstorages.runai.dgxc.nvidia.com
|
|
- runaijobs.run.ai
|
|
- schedulingshards.engine.run.ai
|
|
- scrapeconfigs.monitoring.coreos.com
|
|
- secretproviderclasses.secrets-store.csi.x-k8s.io
|
|
- secretproviderclasspodstatuses.secrets-store.csi.x-k8s.io
|
|
- serverlessservices.networking.internal.knative.dev
|
|
- servicemonitors.monitoring.coreos.com
|
|
- services.serving.knative.dev
|
|
- skyhooks.skyhook.nvidia.com
|
|
- tfjobs.kubeflow.org
|
|
- thanosrulers.monitoring.coreos.com
|
|
- trainingpolicies.run.ai
|
|
- trainingworkloads.run.ai
|
|
- updaterequests.kyverno.io
|
|
- xgboostjobs.kubeflow.org
|
|
- apiGroup: mellanox.com
|
|
kind: HostDeviceNetwork
|
|
resources:
|
|
- hostdevicenetworks
|
|
- hostdevicenetworks/status
|
|
verbs:
|
|
- "*"
|
|
systemResources: []
|
|
- apiGroup: mellanox.com
|
|
kind: IPoIBNetwork
|
|
resources:
|
|
- ipoibnetworks
|
|
- ipoibnetworks/status
|
|
verbs:
|
|
- "*"
|
|
systemResources: []
|
|
- apiGroup: networking.k8s.io
|
|
kind: IngressClass
|
|
resources:
|
|
- ingressclasses
|
|
verbs:
|
|
# - create
|
|
# - delete
|
|
# - deletecollection
|
|
- get
|
|
- list
|
|
# - patch
|
|
# - update
|
|
- watch
|
|
systemResources:
|
|
- nginx
|
|
- apiGroup: mellanox.com
|
|
kind: MacvlanNetwork
|
|
resources:
|
|
- macvlannetworks
|
|
- macvlannetworks/status
|
|
verbs:
|
|
- "*"
|
|
systemResources: []
|
|
- apiGroup: ""
|
|
kind: Namespace
|
|
resources:
|
|
- namespaces
|
|
- namespaces/finalize
|
|
- namespaces/status
|
|
verbs:
|
|
- "*"
|
|
systemResources:
|
|
- argocd
|
|
- cert-manager
|
|
- default
|
|
- dgxc-admission-controller
|
|
- dgxc-logging
|
|
- dgxc-tenant-cluster-policies
|
|
- gpu-operator
|
|
- ingress-nginx
|
|
- knative-serving
|
|
- kourier-system
|
|
- kube-node-lease
|
|
- kube-public
|
|
- kube-system
|
|
- kubeflow
|
|
- kyverno
|
|
- monitoring
|
|
- mpi-operator
|
|
- network-operator
|
|
- node-problem-detector
|
|
- nvdiag
|
|
- nvsentinel
|
|
- observability
|
|
- prometheus
|
|
- runai
|
|
- skyhook
|
|
- apiGroup: mellanox.com
|
|
kind: NicClusterPolicy
|
|
resources:
|
|
- nicclusterpolicies
|
|
- nicclusterpolicies/status
|
|
verbs:
|
|
- "*"
|
|
systemResources:
|
|
- nic-cluster-policy
|
|
- apiGroup: ""
|
|
kind: PersistentVolume
|
|
resources:
|
|
- persistentvolumes
|
|
- persistentvolumes/status
|
|
verbs:
|
|
# - create
|
|
# - delete
|
|
# - deletecollection
|
|
- get
|
|
- list
|
|
# - patch
|
|
# - update
|
|
- watch
|
|
systemResources:
|
|
- csi-021ed734-f8f3-4987-b429-e779055c1d8b
|
|
- csi-7f4d2119-f378-4519-b79b-631a37063d52
|
|
- apiGroup: scheduling.k8s.io
|
|
kind: PriorityClass
|
|
resources:
|
|
- priorityclasses
|
|
verbs:
|
|
- "*"
|
|
systemResources:
|
|
- build
|
|
- inference
|
|
- interactive-preemptible
|
|
- runai-critical
|
|
- runai-engine-critical
|
|
- system-cluster-critical
|
|
- system-node-critical
|
|
- train
|
|
- train-critical
|
|
- train-high
|
|
- apiGroup: authorization.k8s.io
|
|
kind: SelfSubjectAccessReview
|
|
resources:
|
|
- selfsubjectaccessreviews
|
|
verbs:
|
|
- "*"
|
|
systemResources: []
|
|
- apiGroup: authentication.k8s.io
|
|
kind: SelfSubjectReview
|
|
resources:
|
|
- selfsubjectreviews
|
|
verbs:
|
|
- "*"
|
|
systemResources: []
|
|
- apiGroup: authorization.k8s.io
|
|
kind: SelfSubjectRulesReview
|
|
resources:
|
|
- selfsubjectrulesreviews
|
|
verbs:
|
|
- "*"
|
|
systemResources: []
|
|
- apiGroup: authorization.k8s.io
|
|
kind: SubjectAccessReview
|
|
resources:
|
|
- subjectaccessreviews
|
|
verbs:
|
|
- "*"
|
|
systemResources: []
|
|
- apiGroup: authentication.k8s.io
|
|
kind: TokenReview
|
|
resources:
|
|
- tokenreviews
|
|
verbs:
|
|
- "*"
|
|
systemResources: []
|
|
|
|
namespacedKinds:
|
|
- apiGroup: policy
|
|
resources:
|
|
- pods/eviction
|
|
verbs:
|
|
- create
|
|
- apiGroup: ""
|
|
kind: Binding
|
|
resources:
|
|
- bindings
|
|
verbs:
|
|
- "*"
|
|
- apiGroup: ""
|
|
kind: ConfigMap
|
|
resources:
|
|
- configmaps
|
|
verbs:
|
|
- "*"
|
|
- apiGroup: apps
|
|
kind: ControllerRevision
|
|
resources:
|
|
- controllerrevisions
|
|
verbs:
|
|
- "*"
|
|
- apiGroup: batch
|
|
kind: CronJob
|
|
resources:
|
|
- cronjobs
|
|
- cronjobs/status
|
|
verbs:
|
|
- "*"
|
|
- apiGroup: apps
|
|
kind: DaemonSet
|
|
resources:
|
|
- daemonsets
|
|
- daemonsets/status
|
|
verbs:
|
|
- "*"
|
|
- apiGroup: apps
|
|
kind: Deployment
|
|
resources:
|
|
- deployments
|
|
- deployments/scale
|
|
- deployments/status
|
|
verbs:
|
|
- "*"
|
|
- apiGroup: discovery.k8s.io
|
|
kind: EndpointSlice
|
|
resources:
|
|
- endpointslices
|
|
verbs:
|
|
- "*"
|
|
- apiGroup: ""
|
|
kind: Endpoints
|
|
resources:
|
|
- endpoints
|
|
verbs:
|
|
- "*"
|
|
- apiGroup: ""
|
|
kind: Event
|
|
resources:
|
|
- events
|
|
verbs:
|
|
- "*"
|
|
- apiGroup: events.k8s.io
|
|
kind: Event
|
|
resources:
|
|
- events
|
|
verbs:
|
|
- "*"
|
|
- apiGroup: autoscaling
|
|
kind: HorizontalPodAutoscaler
|
|
resources:
|
|
- horizontalpodautoscalers
|
|
- horizontalpodautoscalers/status
|
|
verbs:
|
|
- "*"
|
|
- apiGroup: networking.k8s.io
|
|
kind: Ingress
|
|
resources:
|
|
- ingresses
|
|
- ingresses/status
|
|
verbs:
|
|
- "*"
|
|
- apiGroup: batch
|
|
kind: Job
|
|
resources:
|
|
- jobs
|
|
- jobs/status
|
|
verbs:
|
|
- "*"
|
|
- apiGroup: coordination.k8s.io
|
|
kind: Lease
|
|
resources:
|
|
- leases
|
|
verbs:
|
|
- "*"
|
|
- apiGroup: ""
|
|
kind: LimitRange
|
|
resources:
|
|
- limitranges
|
|
verbs:
|
|
- "*"
|
|
- apiGroup: authorization.k8s.io
|
|
kind: LocalSubjectAccessReview
|
|
resources:
|
|
- localsubjectaccessreviews
|
|
verbs:
|
|
- "*"
|
|
- apiGroup: networking.k8s.io
|
|
kind: NetworkPolicy
|
|
resources:
|
|
- networkpolicies
|
|
verbs:
|
|
- "*"
|
|
- apiGroup: ""
|
|
kind: PersistentVolumeClaim
|
|
resources:
|
|
- persistentvolumeclaims
|
|
- persistentvolumeclaims/status
|
|
verbs:
|
|
- "*"
|
|
- apiGroup: ""
|
|
kind: Pod
|
|
resources:
|
|
- pods
|
|
- pods/attach
|
|
- pods/binding
|
|
- pods/ephemeralcontainers
|
|
- pods/eviction
|
|
- pods/exec
|
|
- pods/log
|
|
- pods/portforward
|
|
- pods/proxy
|
|
- pods/status
|
|
verbs:
|
|
- "*"
|
|
- apiGroup: policy
|
|
kind: PodDisruptionBudget
|
|
resources:
|
|
- poddisruptionbudgets
|
|
- poddisruptionbudgets/status
|
|
verbs:
|
|
- "*"
|
|
- apiGroup: ""
|
|
kind: PodTemplate
|
|
resources:
|
|
- podtemplates
|
|
verbs:
|
|
- "*"
|
|
- apiGroup: apps
|
|
kind: ReplicaSet
|
|
resources:
|
|
- replicasets
|
|
- replicasets/scale
|
|
- replicasets/status
|
|
verbs:
|
|
- "*"
|
|
- apiGroup: ""
|
|
kind: ReplicationController
|
|
resources:
|
|
- replicationcontrollers
|
|
- replicationcontrollers/scale
|
|
- replicationcontrollers/status
|
|
verbs:
|
|
- "*"
|
|
- apiGroup: ""
|
|
kind: ResourceQuota
|
|
resources:
|
|
- resourcequotas
|
|
- resourcequotas/status
|
|
verbs:
|
|
- "*"
|
|
- apiGroup: rbac.authorization.k8s.io
|
|
kind: Role
|
|
resources:
|
|
- roles
|
|
verbs:
|
|
- create
|
|
- delete
|
|
- deletecollection
|
|
- get
|
|
- list
|
|
- patch
|
|
- update
|
|
- watch
|
|
# - bind
|
|
# - escalate
|
|
- apiGroup: rbac.authorization.k8s.io
|
|
kind: RoleBinding
|
|
resources:
|
|
- rolebindings
|
|
verbs:
|
|
- "*"
|
|
- apiGroup: ""
|
|
kind: Secret
|
|
resources:
|
|
- secrets
|
|
verbs:
|
|
- "*"
|
|
- apiGroup: ""
|
|
kind: Service
|
|
resources:
|
|
- services
|
|
- services/proxy
|
|
- services/status
|
|
verbs:
|
|
- "*"
|
|
- apiGroup: ""
|
|
kind: ServiceAccount
|
|
resources:
|
|
- serviceaccounts
|
|
- serviceaccounts/token
|
|
verbs:
|
|
- create
|
|
- delete
|
|
- deletecollection
|
|
- get
|
|
- list
|
|
- patch
|
|
- update
|
|
- watch
|
|
# - impersonate
|
|
- apiGroup: apps
|
|
kind: StatefulSet
|
|
resources:
|
|
- statefulsets
|
|
- statefulsets/scale
|
|
- statefulsets/status
|
|
verbs:
|
|
- "*"
|
|
|
|
systemSubjects:
|
|
User:
|
|
- kubelet-bootstrap
|
|
- kyverno@test.com
|
|
- ladithyav@nvidia.com
|
|
- pwittrock@nvidia.com
|
|
- system:kube-controller-manager
|
|
- system:kube-proxy
|
|
- system:kube-scheduler
|
|
Group:
|
|
- ocid1.group.oc1..aaaaaaaaxe752um3jcucgpytvu3msgueh5bdnrcsmalp6ztj5mjt26lrxegq
|
|
- ocid1.group.oc1..aaaaaaaajapqxojgiat5c3sabi2utodp3nffgq7bue6qm7c2bosxomdvscuq
|
|
- ocid1.group.oc1..aaaaaaaawythahrsnnmblptsvfaeasv5pf65rdjhdbimkwu2mwquh2arly7a
|
|
- ocid1.group.oc1..aaaaaaaaxn2dnkms7yddi257jwepzsv6weypbg4w2eksrajbvvoyh7lk2hza
|
|
- system:bootstrappers:kubeadm:default-node-token
|
|
- system:masters
|
|
- system:monitoring
|
|
- system:node-bootstrapper
|
|
- system:nodes
|
|
- system:serviceaccounts
|
|
- system:serviceaccounts:network-operator
|
|
- system:unauthenticated
|
|
|
|
|