Controller Permissions¶
The chart creates roles for each OpenDepot component. The Server is read-only; the Depot, Module, Provider, and Version controllers reconcile resources and therefore receive write permissions.
Permission Matrix¶
| Controller | Resource | Verbs |
|---|---|---|
| Depot | depots | create, delete, get, list, patch, update, watch |
| Depot | depots/finalizers | update |
| Depot | depots/status | get, patch, update |
| Depot | modules | create, get, list, patch, update, watch |
| Depot | providers | create, get, list, patch, update, watch |
| Depot | secrets | get |
| Module | modules | create, delete, get, list, patch, update, watch |
| Module | modules/finalizers | update |
| Module | modules/status | get, patch, update |
| Module | versions | create, delete, get, list, patch, update, watch |
| Version | modules | get, list, watch |
| Version | modules/status | get, patch, update |
| Version | providers | get, list, watch |
| Version | providers/status | get, patch, update |
| Version | versions | create, delete, get, list, patch, update, watch |
| Version | versions/finalizers | update |
| Version | versions/status | get, patch, update |
| Version | pods | delete (namespace-scoped) |
| Version | secrets | get |
| Version | configmaps | create, get, list, patch, update, watch |
| Provider | providers | create, delete, get, list, patch, update, watch |
| Provider | providers/finalizers | update |
| Provider | providers/status | get, patch, update |
| Provider | versions | create, delete, get, list, patch, update, watch |
| Server | versions | get, list, watch |
| Server | modules | get, list |
| Server | providers | get, list, watch |
| Server | depots | get, list, watch |
| Server | groupbindings | get, list, watch |
| Server | namespaces | get, list, watch |
| Server | configmaps | get, list, watch |
Note
The depots rule is added to the Server ClusterRole only when ui.enabled: true. When the UI is disabled, the Server does not call the Depots API and the rule is omitted.
Controller permissions are generated by the Helm chart. Avoid editing the resulting Role or ClusterRole objects directly; configure the deployment with rbac.create and rbac.scopeToNamespace values instead.
The Version controller's pods/delete and secrets/get permissions are limited to global.namespace. With rbac.scopeToNamespace: true, they are included in the namespace-scoped Role. Otherwise, the chart still grants them through separate namespace-scoped Roles rather than widening the controller's main ClusterRole.