Project: Vald (App Definition and Development / Database)
File: cluster-role-binding.md

The feature provided by Kubernetes contains rules that represent a set of permission to grant access to a specific target depending on the binding rule. This page describes why we need a cluster role for the Vald cluster and how to configure it. Vald applies the distributed index system across the Kubernetes cluster depending on the resource usage of the Kubernetes Node, it requires configuration to grant permission to a specific role to retrieve cluster information on Kubernetes. By default, the cluster role configurations are deployed automatically when using Helm. The following manifest will be deployed by default. These configurations allow the service account `discoverer`, which is for the Vald Discoverer components, to access different resources in the Kubernetes cluster. This service account allows to retrieve Node and Pod resource usage from , and share it to other components in the Vald cluster. For example, will control which Vald Agent to insert based on the Node and Pod resource usage retrieved by Vald Discoverer. If you are interested, please refer to the for more detail. As described in the above section, Vald Discoverer requires configuration on cluster role and cluster role binding to retrieve Node and Pod information from the Kubernetes Cluster. In this section, we will describe how to configure it and how to customize these configurations. By looking at the , the access right of the following resources are granted to the cluster role `discoverer`. ```yaml apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRole metadata: name: discoverer rules: apiGroups: apps resources: replicasets verbs: get list watch apiGroups: "" resources: nodes nodes/proxy services endpoints pods verbs: get list watch nonResourceURLs: /metrics verbs: get apiGroups: "metrics.k8s.io" resources: nodes pods verbs: get list ``` All of these rules are required to retrieve Node and Pod resource usage from and also used to discover new Vald Agent Pods or Nodes created on the cluster. The cluster role binding configuration binds the cluster role `discoverer` described in the previous section to the service account `vald` according to the . ```yaml apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRoleBinding metadata: name: discoverer ... roleRef: apiGroup: rbac.authorization.k8s.io kind: ClusterRole name: discoverer subjects: kind: ServiceAccount name: vald namespace: default ``` When the role binds to the service account, the access right of the role will be granted to the service account. In this case, all the access rights of the role `discoverer` will be granted to the service account `vald`. The service account `vald` is required for to retrieve the required information to operate the Vald

For more information about Vald Discoverer, please refer . To customize the cluster role configuration on the Helm chart for Vald Discoverer, you may need to change the `discoverer.clusterRole` configuration on the Helm chart file. The cluster role configurations are enabled by default. ```yaml discoverer: clusterRole: enabled: true name: discoverer clusterRoleBinding: enabled: true name: discoverer serviceAccount: enabled: true name: vald ``` <div class="warning"> If you disable these configurations, the Vald Discoverer will not work, and the Vald cluster will not be functional. </div> If you want to modify or disable these configurations, you need to grant the and bind it to the Vald Discoverer to retrieve required information to operate the Vald cluster. The Vald Mirror Gateway requires configuration on cluster role and cluster role binding to create/update/retrive resource from the Kubernetes Cluster. In this section, we will describe how to configure it and how to customize these configurations. By looking at the , the access right of the following resources are granted to the cluster role `gateway-mirror`. ```yaml apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRole metadata: name: gateway-mirror rules: apiGroups: vald.vdaas.org resources: valdmirrortargets verbs: create update delete get list watch patch apiGroups: vald.vdaas.org resources: valdmirrortargets/status verbs: create update get list patch apiGroups: vald.vdaas.org resources: valdmirrortargets/finalizers verbs: update ``` The cluster role binding configuration binds the cluster role `gateway-mirror` described in the previous section to the service account `gateway-mirror` according to the . ```yaml apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRoleBinding metadata: name: gateway-mirror ... roleRef: apiGroup: rbac.authorization.k8s.io kind: ClusterRole name: gateway-mirror subjects: kind: ServiceAccount name: gateway-mirror namespace: default ``` When the role binds to the service account, the access right of the role will be granted to the service account. In this case, all the access rights of the role `gateway-mirror` will be granted to the service account `gateway-mirror`. To customize the cluster role configuration on the Helm chart for Vald Mirror Gateway, you may need to change the `gateway.mirror.clusterRole` configuration on the Helm chart file. The cluster role configurations are enabled by default. ```yaml gateway: mirror: clusterRole: enabled: true name: gateway-mirror clusterRoleBinding: enabled: true name: gateway-mirror serviceAccount: enabled: true name: gateway-mirror ``` <div class="warning"> If you disable these configurations, the Vald Mirror Gateway will not work properly. </div> Please refer to the official guidelines to configure cluster role configuration for your cloud provider, and configure the service account name for Vald Discoverer. For example: For other cloud providers, you may need to find the related document on their official website, or you can enable the cluster role and the cluster role binding configurations on the Helm chart.