> ## Documentation Index
> Fetch the complete documentation index at: https://docs.aient.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# aient-viewer RBAC template

> The read-only RBAC Aient publishes for the viewer of a Kubernetes connection: copy it, remove what you do not want agents to read, and paste it when you attach a cluster.

# aient-viewer RBAC template

Paste this when you [attach a cluster](https://docs.aient.ai/ai-tools/kubernetes-connections.md#choose-the-rbac-you-declare). It grants
`get`, `list` and `watch` on the common built-in and operator resources, plus pod logs. It leaves out Secrets and the
resources whose contents can carry secret material; the comments at the top name what is excluded and why.

Remove any API group you do not want agents to read. Aient merges the rules of both ClusterRoles into one
declaration. The gateway admits only `get` and `list`, whatever `watch` grants.

```yaml aient-viewer.yaml theme={"theme":{"light":"github-light","dark":"github-dark"}}
# Generated by infra/k8s-identity/aient-viewer/generate.mjs from policy.yaml and the repository's CRDs.
# Do not edit: change policy.yaml and run the generator with --write.
#
# Excluded API groups:
#   helm.cattle.io: a k3s HelmChart carries chart values inline in valuesContent, which can hold credentials; little diagnostic value
#   authentication.k8s.io: create-only review APIs; nothing to read
#   authorization.k8s.io: create-only review APIs; nothing to read
# Denied resources (their spec or status can carry secret material):
#   aquasecurity.github.io/exposedsecretreports: each report quotes the secrets Trivy found in an image
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: aient-viewer
  annotations:
    aient.ai/viewer-excluded-groups: authentication.k8s.io,authorization.k8s.io,helm.cattle.io
    aient.ai/viewer-denied-resources: aquasecurity.github.io/exposedsecretreports
rules:
  - apiGroups:
      - ""
    resources:
      - componentstatuses
      - configmaps
      - endpoints
      - events
      - limitranges
      - namespaces
      - namespaces/status
      - nodes
      - nodes/status
      - persistentvolumeclaims
      - persistentvolumeclaims/status
      - persistentvolumes
      - persistentvolumes/status
      - pods
      - pods/status
      - podtemplates
      - replicationcontrollers
      - replicationcontrollers/scale
      - replicationcontrollers/status
      - resourcequotas
      - resourcequotas/status
      - serviceaccounts
      - services
      - services/status
    verbs:
      - get
      - list
      - watch
  - apiGroups:
      - acme.cert-manager.io
      - actions.github.com
      - admissionregistration.k8s.io
      - apiextensions.k8s.io
      - apiregistration.k8s.io
      - apps
      - argocd-image-updater.argoproj.io
      - argoproj.io
      - autoscaling
      - barmancloud.cnpg.io
      - batch
      - cert-manager.io
      - certificates.k8s.io
      - cilium.io
      - clickhouse-keeper.altinity.com
      - clickhouse.altinity.com
      - coordination.k8s.io
      - core.strimzi.io
      - discovery.k8s.io
      - events.k8s.io
      - flowcontrol.apiserver.k8s.io
      - gateway.envoyproxy.io
      - gateway.networking.k8s.io
      - gateway.networking.x-k8s.io
      - job.min.io
      - k3s.cattle.io
      - kafka.strimzi.io
      - longhorn.io
      - metrics.k8s.io
      - minio.min.io
      - networking.k8s.io
      - node.k8s.io
      - opentelemetry.io
      - policy
      - postgresql.cnpg.io
      - rbac.authorization.k8s.io
      - resource.k8s.io
      - restate.dev
      - scheduling.k8s.io
      - spire.spiffe.io
      - storage.k8s.io
      - sts.min.io
      - tailscale.com
      - upgrade.cattle.io
    resources:
      - "*"
    verbs:
      - get
      - list
      - watch
  - apiGroups:
      - aquasecurity.github.io
    resources:
      - clustercompliancereports
      - clustercompliancereports/status
      - clusterconfigauditreports
      - clusterinfraassessmentreports
      - clusterrbacassessmentreports
      - clustersbomreports
      - clustervulnerabilityreports
      - configauditreports
      - infraassessmentreports
      - rbacassessmentreports
      - sbomreports
      - vulnerabilityreports
    verbs:
      - get
      - list
      - watch
---
# On-demand pod logs, bound separately so a role without them stays possible.
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: aient-viewer-logs
rules:
  - apiGroups:
      - ""
    resources:
      - pods/log
    verbs:
      - get
      - list
      - watch
```


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.