Permissions
🔐 Overview
This document outlines the required Kubernetes RBAC (Role-Based Access Control) permissions for each Kubesense service account. These permissions ensure that each component has the necessary access to interact with Kubernetes resources, monitor activity, and maintain observability.
Each Kubesense component, deployed as a DaemonSet or Deployment, requires specific APIGroup resources and permissions for its respective service account. Here is a breakdown of the required permissions for each:
📄 Logs Management - Logsensor Permissions
(Kind: DaemonSet)
The Logsensor requires read-only access to the Kubernetes default logs directory (/var/log/containers) to capture logs from all containers within the cluster. This setup allows it to monitor logs effectively without writing to the directory.
Directory Access:
/var/log/containers: Read-only access for log data collection.
📊 Kubernetes Observability - KubeSensor Permissions
(Kind: DaemonSet)
The Kubesensor uses eBPF to monitor Kubernetes resources and requires elevated permissions to access various Kubernetes resources across API groups. It also requires Privileged container access to function effectively with eBPF.
The following table lists the API groups, required access levels, and resources necessary for Kubesensor:
| API Group | Access Level | Resources |
|---|---|---|
| "" | get, list, watch | nodes, namespaces, configmaps, services, pods, replicationcontrollers |
| apps | get, list, watch | daemonsets, deployments, replicasets, statefulsets |
| extensions networking.k8s.io | get, list, watch | ingresses |
| route.openshift.io | get, list, watch | routes (for OpenShift environments) |
Note: These permissions are essential for monitoring cluster-wide resources and maintaining real-time visibility into workloads, services, and network traffic.
🔍 Application Monitoring - Otel Agent Permissions
(Kind: Deployment)
The Otel Agent (OpenTelemetry Agent) gathers telemetry data from Kubernetes resources. To function correctly, it requires read access to nodes and events.
| API Group | Access Level | Resources |
|---|---|---|
| "" | get, list, watch | nodes, nodes/stats, nodes/proxy, events |
| events.k8s.io | get, list, watch | events |
These permissions enable the Otel Agent to monitor events and node metrics, providing valuable insights into cluster performance and application health.
📈 Cluster Data Collection - Kubecol Permissions
(Kind: Deployment)
The Kubecol component manages Kubernetes endpoint and service data, requiring permissions to create, update, and observe service-related resources.
| API Group | Access Level | Resources |
|---|---|---|
| "" | get, list, watch, create, update | endpoints, services |
Note: These permissions ensure that Kubecol can effectively aggregate and update service-related metrics for comprehensive data collection across the cluster.
Summary
Ensuring that each Kubesense component has the correct permissions is critical for maintaining the functionality and observability of your Kubernetes cluster. These permissions allow the components to interact with Kubernetes resources, monitor events, and gather essential data while adhering to security best practices.
For more detailed setup instructions, please refer to the Kubesense Installation Guide.