RTFCTL Kubernetes Permissions | MuleSoft Documentation
# RTFCTL Kubernetes Permissions
To successfully run `rtfctl` commands, you must understand and enable specific role permissions over Kubernetes resources.
The following table lists the permissions that you configure using Kubernetes (K8s) RBACs (role-based access control):
rtfctl Command | Namespace | API Groups | Kubernetes Resources | Verbs  
---|---|---|---|---  
configmaps | create, get, patch, update  
deletecollection  
<app-namespace> | get, list, watch  
rtfctl-audit | create, get, patch, update  
namespaces | create, get, list, watch  
create, get, patch, update  
configmaps, secrets  
rtfctl-audit | create, get, patch, update  
namespaces  
configmaps, secret  
rtfctl-audit | create, get, patch, update  
daemonsets, deployments | get, list, watch  
namespaces  
configmaps, pods/log  
get, list, watch  
create, get  
serviceaccounts  
create, get  
rtfctl-audit | create, get, patch, update  
namespaces  
rbac.authorization.k8s.io | clusterrolebindings, clusterroles  
rtfctl-audit | create, get, patch, update  
namespaces | create, get, list, watch  
configmaps, namespaces, secrets, serviceaccounts, services | get, list, watch  
apiextensions.k8s.io | customresourcedefinitions  
daemonsets, deployments | get, list, watch  
cronjobs | get, list, watch  
networking.k8s.io | ingresses | get, list, watch  
rbac.authorization.k8s.io | clusterrolebindings, clusterroles, rolebindings, roles | get, list, watch  
rtf.mulesoft.com | persistencegateways | get, list, watch  
scheduling.k8s.io | priorityclasses  
daemonsets | create, get, patch, update  
cronjobs | create, get, patch, update  
rtf.mulesoft.com | persistencegateways | get, list, watch  
rtfctl-audit | create, get, patch, update  
configmaps, namespaces, secrets, serviceaccounts, services | create, get, patch, update  
apiextensions.k8s.io | customresourcedefinitions | get, patch, update  
deployments | create, get, patch, update  
networking.k8s.io | ingresses | create, get, patch, update  
rbac.authorization.k8s.io | clusterrolebindings, clusterroles | create, get, patch, update  
scheduling.k8s.io | priorityclasses | create, get, patch, update  
configmaps  
deletecollection  
delete, get  
rtf-validate | namespaces | delete, get  
secrets, serviceaccounts  
create, get  
rtfctl-audit | create, get, patch, update  
namespaces  
nodes, pods | get, list, watch  
authorization.k8s.io | selfsubjectaccessreviews  
rbac.authorization.k8s.io | clusterrolebindings, clusterroles | create, delete  
configmaps, secrets  
rtfctl-audit | create, get, patch, update  
namespaces  
<app-namespace> | get, list, watch  
get, list, patch, update, watch  
configmaps, secrets  
rtfctl-audit | create, get, patch, update  
namespaces  
<app-namespace> | get, list, watch  
configmaps, secrets  
rtfctl-audit | create, get, patch, update  
namespaces  
deployments | get, list, watch  
<app-namespace> | get, list, watch  
pods/exec  
configmaps, secrets  
rtfctl-audit | create, get, patch, update  
namespaces  
<app-namespace> | get, list, watch  
pods/exec  
configmaps, secrets  
rtfctl-audit | create, get, patch, update  
namespaces  
<app-namespace> | get, list, watch  
pods/exec  
configmaps, secrets  
rtfctl-audit | create, get, patch, update  
namespaces  
<app-namespace> | delete, get, list, watch  
configmaps, secrets  
rtfctl-audit | create, get, patch, update  
namespaces  
<app-namespace> | get, list, watch  
pods/exec  
configmaps, secrets  
rtfctl-audit | create, get, patch, update  
namespaces  
`threaddump` | <app-namespace> | get, list, watch  
pods/exec  
configmaps, secrets  
rtfctl-audit | create, get, patch, update  
namespaces  
<app-namespace> | get, list, watch  
configmaps, secrets  
rtfctl-audit | create, get, patch, update  
namespaces  
deployments | get, list, watch  
configmaps, limitranges, resourcequotas, secrets, serviceaccounts, services | get, list, watch  
endpoints, pods/log  
daemonsets, deployments, replicasets | get, list, watch  
cronjobs | get, list, watch  
create, delete, get, list, watch  
networking.k8s.io | ingresses | get, list, watch  
rbac.authorization.k8s.io | rolebindings, roles | get, list, watch  
rtf.mulesoft.com | persistencegateways, kubernetestemplates | get, list, watch  
kube-node-lease | coordination.k8s.io  
rtfctl-audit | create, get, patch, update  
namespaces | create, get, list, watch  
events, nodes, pods | get, list, watch  
configmaps, pods/log, secrets  
create, delete, get, list, watch  
create, delete, get  
rtfctl-audit | create, get, patch, update  
namespaces  
configmaps, pods/log, secrets  
create, delete, get, list, watch  
create, delete, get  
rtfctl-audit | create, get, patch, update  
get, list, watch  
namespaces  
  * Namespace
Permissions can be role-based or cluster role-based:
  * Role-based: the namespace can be rtf, <app-namespace>, rtf-validate, or kube-node-lease.
  * Cluster role-based: because it applies to the entire cluster, the namespace field doesn’t exist and is blank in the table.
  * apiGroups
The API group for the K8s resources. When you create a role, each K8s resource declares its API group or uses the core API group if not specified. Refer to API groups for details.
  * Kubernetes Resource
Type of Kubernetes resources, for example, `pods`, `services`, or `secrets` to which the permissions apply.
  * Verbs
Actions that are allowed on the specified Kubernetes resources.


## See Also
  * Runtime Fabric Core Software Kubernetes Permissions
  * Mule App Deployments Kubernetes Permissions on Runtime Fabric