aient-viewer RBAC template
Paste this when you attach a cluster. It grantsget, list and watch on the common built-in and operator resources, plus pod logs. It leaves out Secrets and the
resources whose contents can carry secret material; the comments at the top name what is excluded and why.
Remove any API group you do not want agents to read. Aient merges the rules of both ClusterRoles into one
declaration. The gateway admits only get and list, whatever watch grants.
aient-viewer.yaml
# Generated by infra/k8s-identity/aient-viewer/generate.mjs from policy.yaml and the repository's CRDs.
# Do not edit: change policy.yaml and run the generator with --write.
#
# Excluded API groups:
# helm.cattle.io: a k3s HelmChart carries chart values inline in valuesContent, which can hold credentials; little diagnostic value
# authentication.k8s.io: create-only review APIs; nothing to read
# authorization.k8s.io: create-only review APIs; nothing to read
# Denied resources (their spec or status can carry secret material):
# aquasecurity.github.io/exposedsecretreports: each report quotes the secrets Trivy found in an image
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
name: aient-viewer
annotations:
aient.ai/viewer-excluded-groups: authentication.k8s.io,authorization.k8s.io,helm.cattle.io
aient.ai/viewer-denied-resources: aquasecurity.github.io/exposedsecretreports
rules:
- apiGroups:
- ""
resources:
- componentstatuses
- configmaps
- endpoints
- events
- limitranges
- namespaces
- namespaces/status
- nodes
- nodes/status
- persistentvolumeclaims
- persistentvolumeclaims/status
- persistentvolumes
- persistentvolumes/status
- pods
- pods/status
- podtemplates
- replicationcontrollers
- replicationcontrollers/scale
- replicationcontrollers/status
- resourcequotas
- resourcequotas/status
- serviceaccounts
- services
- services/status
verbs:
- get
- list
- watch
- apiGroups:
- acme.cert-manager.io
- actions.github.com
- admissionregistration.k8s.io
- apiextensions.k8s.io
- apiregistration.k8s.io
- apps
- argocd-image-updater.argoproj.io
- argoproj.io
- autoscaling
- barmancloud.cnpg.io
- batch
- cert-manager.io
- certificates.k8s.io
- cilium.io
- clickhouse-keeper.altinity.com
- clickhouse.altinity.com
- coordination.k8s.io
- core.strimzi.io
- discovery.k8s.io
- events.k8s.io
- flowcontrol.apiserver.k8s.io
- gateway.envoyproxy.io
- gateway.networking.k8s.io
- gateway.networking.x-k8s.io
- job.min.io
- k3s.cattle.io
- kafka.strimzi.io
- longhorn.io
- metrics.k8s.io
- minio.min.io
- networking.k8s.io
- node.k8s.io
- opentelemetry.io
- policy
- postgresql.cnpg.io
- rbac.authorization.k8s.io
- resource.k8s.io
- restate.dev
- scheduling.k8s.io
- spire.spiffe.io
- storage.k8s.io
- sts.min.io
- tailscale.com
- upgrade.cattle.io
resources:
- "*"
verbs:
- get
- list
- watch
- apiGroups:
- aquasecurity.github.io
resources:
- clustercompliancereports
- clustercompliancereports/status
- clusterconfigauditreports
- clusterinfraassessmentreports
- clusterrbacassessmentreports
- clustersbomreports
- clustervulnerabilityreports
- configauditreports
- infraassessmentreports
- rbacassessmentreports
- sbomreports
- vulnerabilityreports
verbs:
- get
- list
- watch
---
# On-demand pod logs, bound separately so a role without them stays possible.
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
name: aient-viewer-logs
rules:
- apiGroups:
- ""
resources:
- pods/log
verbs:
- get
- list
- watch