Kubernetes Permissions for the Armory Agent
The Agent can use a
kubeconfig file loaded as a Kubernetes secret when deploying to a remote cluster. Also, you can configure Agent permissions using a Kubernetes Service Account when deploying to the cluster the Armory Agent resides in.
The Agent should have
ClusterRole authorization if you need to deploy pods across your cluster or
Role authorization if you deploy pods only to a single namespace.
- If Agent is running in Agent Mode, then the
Roleis the one attached to the Kubernetes Service Account mounted by the Armory Agent pod.
- If Agent is running in any of the other modes, then the
Roleis the one the
kubeconfigFileuses to interact with the target cluster.
kubeconfigFileis configured in
armory-agent.ymlof the Armory Agent pod.
Example configuration for deploying
apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRole metadata: name: agent-role rules: - apiGroups: "" resources: - pods - pods/log - pods/finalizers verbs: - get - list - watch - create - update - patch - delete
apiVersion: rbac.authorization.k8s.io/v1 kind: Role metadata: name: agent-role rules: - apiGroups: "" resources: - pods - pods/log - pods/finalizers verbs: - get - list - watch - create - update - patch - delete
See the Install the Armory Agent Service Using Kubectl for a complete example that uses
See the Kubernetes Using RBAC Authorization guide for details on configuring
Was this page helpful?
Thank you for letting us know!
Sorry to hear that. Please tell us how we can improve.
Last modified August 4, 2022: (256b89fe)