Skip to content

Kubernetes RBAC

The Helm chart creates ServiceAccounts and RBAC resources for each controller automatically when rbac.create: true, which is the default.

  •  Controller Permissions

    Review the resources and verbs granted to the Depot, Module, Provider, Version, and Server components.

  •  Namespace-Scoped RBAC

    Reduce the controller blast radius by replacing cluster-wide roles with namespace-scoped Role and RoleBinding resources.

  •  Pipeline Publisher Role

    Grant a CI ServiceAccount the least privilege needed to create or update Module resources.

  •  GroupBinding and Stats Visibility

    Understand how OIDC GroupBinding rules affect OpenDepot Workshop statistics and resource visibility.

Choosing an RBAC Model

Use the default cluster-wide model when controllers must reconcile resources across namespaces. Use namespace-scoped mode when all managed resources live in the installation namespace and a smaller permission boundary is more important than multi-namespace reconciliation.

See Namespace-Scoped RBAC for the required Helm values and constraints.