Kubernetes Permissions for the Armory Scale Agent
The Scale Agent service can use a
kubeconfig file loaded as a Kubernetes secret when deploying to a remote cluster. Also, you can configure Agent permissions using a Kubernetes Service Account when deploying to the cluster the Armory Scale Agent resides in.
The Scale Agent service should have
ClusterRole authorization if you need to deploy pods across your cluster or
Role authorization if you deploy pods only to a single namespace.
- If Scale Agent service is running in Agent Mode, then the
Roleis the one attached to the Kubernetes Service Account mounted by the Armory Scale Agent pod.
- If Scale Agent service is running in any of the other modes, then the
Roleis the one the
kubeconfigFileuses to interact with the target cluster.
kubeconfigFileis configured in
armory-agent.ymlof the Armory Scale Agent pod.
Example configuration for deploying
apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRole metadata: name: agent-role rules: - apiGroups: "" resources: - pods - pods/log - pods/finalizers verbs: - get - list - watch - create - update - patch - delete
apiVersion: rbac.authorization.k8s.io/v1 kind: Role metadata: name: agent-role rules: - apiGroups: "" resources: - pods - pods/log - pods/finalizers verbs: - get - list - watch - create - update - patch - delete
See the Kubernetes Using RBAC Authorization guide for details on configuring
Was this page helpful?
Thank you for letting us know!
Sorry to hear that. Please tell us how we can improve.
Last modified September 5, 2023: (17d76bcd)