> ## Documentation Index
> Fetch the complete documentation index at: https://docs.odigos.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Kubernetes RBAC Permissions

This page lists the Kubernetes Roles and ClusterRoles used by Odigos and the Odigos Operator.

# Components

This section lists the RBAC policies used by the Odigos components.

## ClusterRoles

Below are the ClusterRoles used by Odigos components.

### cleanup-clusterrole

| APIGroups | Resources | Resource Names | Verbs |
| - | - | - | - |
| odigos.io | sources | \* | list<br />delete |
| \* | pods | \* | list |
| \* | nodes | \* | list<br />patch |

### odigos-gateway

| APIGroups | Resources | Resource Names | Verbs |
| - | - | - | - |
| odigos.io | instrumentationconfigs | \* | get<br />list<br />watch |
| \* | pods<br />namespaces | \* | get<br />list<br />watch |
| apps | replicasets<br />deployments<br />statefulsets<br />daemonsets | \* | get<br />list<br />watch |

### odigos-go-offsets-updater

| APIGroups | Resources | Resource Names | Verbs |
| - | - | - | - |
| \* | configmaps | \* | list |

### odigos-instrumentor

| APIGroups | Resources | Resource Names | Verbs |
| - | - | - | - |
| \* | nodes | \* | list<br />watch<br />get |
| \* | namespaces | \* | list<br />watch<br />get |
| \* | pods | \* | list<br />watch<br />get |
| batch | cronjobs | \* | list<br />watch<br />get |
| apps | daemonsets | \* | get<br />list<br />watch<br />update<br />patch |
| apps | deployments | \* | get<br />list<br />watch<br />update<br />patch |
| apps | statefulsets | \* | get<br />list<br />watch<br />update<br />patch |
| \* | pods/finalizers<br />configmaps/finalizers | \* | update |
| apps | statefulsets/finalizers<br />deployments/finalizers<br />daemonsets/finalizers | \* | update |
| batch | cronjobs/finalizers<br />jobs/finalizers | \* | update |
| argoproj.io | rollouts/finalizers | \* | update |
| apps.openshift.io | deploymentconfigs<br />deploymentconfigs/finalizers | \* | get<br />list<br />watch<br />update<br />patch |
| argoproj.io | rollouts | \* | get<br />list<br />watch<br />patch |
| operator.odigos.io | odigos/finalizers | \* | update |
| odigos.io | instrumentationconfigs/status | \* | get<br />patch<br />update |
| odigos.io | instrumentationconfigs | \* | create<br />delete<br />get<br />list<br />patch<br />update<br />watch |
| odigos.io | sources | \* | create<br />delete<br />get<br />list<br />patch<br />update<br />watch |
| odigos.io | sources/finalizers | \* | update |
| admissionregistration.k8s.io | mutatingwebhookconfigurations | \* | get<br />list<br />watch |
| admissionregistration.k8s.io | mutatingwebhookconfigurations | odigos-source-mutating-webhook-configuration<br />odigos-pod-mutating-webhook-configuration | update |
| admissionregistration.k8s.io | validatingwebhookconfigurations | \* | get<br />list<br />watch |
| admissionregistration.k8s.io | validatingwebhookconfigurations | odigos-source-validating-webhook-configuration<br />odigos-action-validating-webhook-configuration | update |
| apiregistration.k8s.io | apiservices | \* | get<br />list<br />watch<br />update<br />patch<br />delete |

### odiglet

| APIGroups | Resources | Resource Names | Verbs |
| - | - | - | - |
| \* | pods<br />services | \* | get<br />list<br />watch |
| \* | pods/status | \* | get |
| \* | pods/finalizers | \* | update |
| \* | nodes | \* | get<br />list<br />watch<br />patch<br />update |
| odigos.io | instrumentationinstances | \* | create<br />get<br />list<br />patch<br />update<br />watch<br />delete |
| odigos.io | instrumentationinstances/status | \* | get<br />patch<br />update |
| odigos.io | instrumentationconfigs | \* | get<br />list<br />watch<br />patch<br />update |
| odigos.io | instrumentationconfigs/status | \* | get<br />patch<br />update |
| \* | nodes/stats | \* | get<br />list |
| \* | pods<br />namespaces | \* | get<br />list<br />watch |
| apps | replicasets<br />deployments<br />daemonsets<br />statefulsets | \* | get<br />list<br />watch |
| discovery.k8s.io | endpointslices | \* | get<br />list<br />watch |

### odigos-ui

| APIGroups | Resources | Resource Names | Verbs |
| - | - | - | - |
| \* | namespaces | \* | get<br />list<br />watch<br />patch |
| apps | deployments<br />statefulsets<br />daemonsets | \* | get<br />list<br />watch<br />update<br />patch |
| batch | cronjobs | \* | get<br />list<br />watch<br />update<br />patch |
| apps.openshift.io | deploymentconfigs | \* | get<br />list<br />watch<br />update<br />patch |
| argoproj.io | rollouts | \* | get<br />list<br />watch<br />update<br />patch |
| apps | replicasets | \* | get<br />list |
| \* | services | \* | get<br />list |
| \* | pods | \* | get<br />list<br />watch<br />delete |
| odigos.io | \* | \* | get<br />list<br />watch |
| odigos.io | instrumentationconfigs<br />instrumentationinstances<br />sources<br />samplings | \* | update<br />patch<br />create<br />delete |
| operator.odigos.io | odigos | \* | get<br />list<br />watch |
| actions.odigos.io | \* | \* | get<br />list<br />watch |

## Roles

Below are the Roles used by Odigos components. These Roles are only scoped to the Namespace in which Odigos is installed.

### cleanup-role

| APIGroups | Resources | Resource Names | Verbs |
| - | - | - | - |
| \* | configmaps | odigos-deployment<br />odigos-configuration | get |
| \* | configmaps | \* | list |

### odigos-gateway

| APIGroups | Resources | Resource Names | Verbs |
| - | - | - | - |
| \* | configmaps | odigos-gateway | get<br />list<br />watch |

### odigos-go-offsets-updater

| APIGroups | Resources | Resource Names | Verbs |
| - | - | - | - |
| \* | configmaps | odigos-go-offsets | get<br />update |
| \* | secrets | odigos-pro | get |

### odigos-instrumentor

| APIGroups | Resources | Resource Names | Verbs |
| - | - | - | - |
| \* | configmaps | \* | get<br />list<br />watch<br />create<br />patch<br />update<br />delete |
| \* | services | \* | get<br />list<br />watch<br />create<br />patch<br />update<br />delete |
| \* | pods | \* | get<br />list<br />watch |
| apps | deployments | \* | create<br />delete<br />get<br />list<br />patch<br />update<br />watch |
| apps | deployments/status | \* | get |
| autoscaling | horizontalpodautoscalers | \* | create<br />patch<br />update<br />delete |
| odigos.io | collectorsgroups | \* | get<br />list<br />create<br />patch<br />update<br />watch<br />delete |
| odigos.io | collectorsgroups/status | \* | get<br />list<br />watch<br />patch<br />update |
| odigos.io | destinations | \* | get<br />list<br />watch |
| odigos.io | destinations/status | \* | get<br />patch<br />update |
| odigos.io | instrumentationrules<br />processors | \* | get<br />list<br />watch<br />patch<br />update<br />delete<br />create |
| odigos.io | processors/status | \* | get<br />patch<br />update |
| odigos.io | instrumentationrules/status | \* | get<br />patch<br />update |
| odigos.io | actions | \* | get<br />list<br />watch<br />patch<br />update<br />delete<br />create |
| odigos.io | samplings | \* | get<br />list<br />watch |
| odigos.io | actions/status | \* | get<br />patch<br />update |
| odigos.io | recommendations | \* | get<br />list<br />watch<br />create<br />patch<br />update<br />delete |
| odigos.io | recommendations/status | \* | get<br />patch<br />update |
| actions.odigos.io | \* | \* | get<br />list<br />watch<br />update |
| actions.odigos.io | \*/status | \* | get<br />patch<br />update |
| odigos.io | samplings/status | \* | get<br />patch<br />update |
| \* | secrets | \* | get<br />list<br />watch |
| \* | secrets | instrumentor-webhooks-cert | update |
| \* | secrets | autoscaler-webhook-cert<br />autoscaler-webhooks-cert | delete |
| apps | daemonsets | odiglet | get<br />list<br />watch |
| apps | deployments/finalizers | \* | update |
| odigos.io | collectorsgroups/finalizers | \* | get<br />patch<br />update |
| batch | cronjobs | odigos-go-offsets-updater | get<br />list<br />watch<br />create<br />update<br />patch<br />delete |
| batch | jobs | \* | create |

### odigos-leader-election-role

| APIGroups | Resources | Resource Names | Verbs |
| - | - | - | - |
| \* | events | \* | create<br />patch |
| coordination.k8s.io | leases | \* | get<br />list<br />watch<br />create<br />update<br />patch<br />delete |

### odiglet

| APIGroups | Resources | Resource Names | Verbs |
| - | - | - | - |
| \* | configmaps | \* | list<br />watch |
| \* | configmaps | odigos-data-collection<br />effective-config | get<br />list<br />watch |

### odigos-ui

| APIGroups | Resources | Resource Names | Verbs |
| - | - | - | - |
| \* | configmaps | \* | get<br />list<br />watch<br />create<br />update<br />patch |
| \* | secrets | \* | get<br />list<br />watch<br />create<br />patch<br />update<br />delete |
| apps | replicasets | \* | get<br />list |
| autoscaling | horizontalpodautoscalers | \* | get |
| odigos.io | \* | \* | get<br />list<br />watch |
| odigos.io | instrumentationrules<br />destinations<br />actions<br />samplings | \* | create<br />patch<br />update<br />delete |
| odigos.io | recommendations | \* | update<br />patch |
| odigos.io | collectorsgroups | \* | get<br />list<br />watch |
| actions.odigos.io | \* | \* | get<br />list<br />watch<br />create<br />patch<br />update<br />delete |
| operator.odigos.io | odigos | \* | get<br />list<br />watch |
| apps | deployments/scale | odigos-instrumentor | get<br />update<br />patch |
| apps | daemonsets | odiglet | get<br />update<br />patch |
| \* | pods | \* | get<br />list<br />delete |
| \* | pods/log | \* | get |
| \* | pods/proxy | \* | get |

# Operator

This section lists the RBAC policies used by the Odigos Operator. Many of these permissions are necessary in order to create the RBAC policies for the components listed above.

## ClusterRoles

| APIGroups | Resources | Resource Names | Verbs |
| - | - | - | - |
| \* | configmaps<br />endpoints<br />secrets<br />services | \* | create<br />delete<br />deletecollection<br />get<br />list<br />patch<br />update<br />watch |
| \* | configmaps/finalizers<br />pods/finalizers | \* | update |
| \* | events | \* | create<br />get<br />list<br />patch<br />watch |
| \* | namespaces | \* | get<br />list<br />patch<br />watch |
| \* | namespaces/status<br />nodes/spec<br />nodes/stats<br />replicationcontrollers<br />replicationcontrollers/status<br />resourcequotas | \* | get<br />list<br />watch |
| \* | nodes | \* | get<br />list<br />patch<br />update<br />watch |
| \* | pods | \* | delete<br />get<br />list<br />watch |
| \* | pods/log<br />pods/proxy<br />pods/status | \* | get |
| \* | serviceaccounts | \* | create<br />delete<br />get<br />list<br />patch<br />watch |
| actions.odigos.io | \* | \* | create<br />delete<br />deletecollection<br />get<br />list<br />patch<br />update<br />watch |
| actions.odigos.io | \*/status | \* | get<br />patch<br />update |
| admissionregistration.k8s.io | mutatingwebhookconfigurations<br />validatingwebhookconfigurations | \* | create<br />delete<br />get<br />list<br />patch<br />update<br />watch |
| apiextensions.k8s.io | customresourcedefinitions | \* | create<br />delete<br />deletecollection<br />get<br />list<br />patch<br />update<br />watch |
| apiregistration.k8s.io | apiservices | \* | create<br />get<br />list<br />patch<br />update<br />watch |
| apps | daemonsets<br />deployments<br />replicasets<br />statefulsets | \* | create<br />delete<br />deletecollection<br />get<br />list<br />patch<br />update<br />watch |
| apps | daemonsets/finalizers<br />deployments/finalizers<br />replicasets/finalizers<br />statefulsets/finalizers | \* | update |
| apps | daemonsets/status<br />deployments/status<br />statefulsets/status | \* | get |
| apps | deployments/scale | \* | get<br />patch<br />update |
| apps.openshift.io | deploymentconfigs<br />deploymentconfigs/finalizers | \* | get<br />list<br />patch<br />update<br />watch |
| argoproj.io | rollouts | \* | get<br />list<br />patch<br />update<br />watch |
| argoproj.io | rollouts/finalizers | \* | update |
| autoscaling | horizontalpodautoscalers | \* | create<br />delete<br />get<br />list<br />patch<br />update<br />watch |
| batch | cronjobs | \* | create<br />delete<br />get<br />list<br />patch<br />update<br />watch |
| batch | cronjobs/finalizers<br />jobs/finalizers | \* | update |
| batch | jobs | \* | create<br />delete<br />get<br />list<br />watch |
| coordination.k8s.io | leases | \* | create<br />delete<br />get<br />list<br />patch<br />update<br />watch |
| discovery.k8s.io | endpointslices | \* | get<br />list<br />watch |
| extensions | daemonsets<br />deployments<br />replicasets | \* | get<br />list<br />watch |
| odigos.io | \* | \* | \* |
| odigos.io | collectorsgroups/finalizers<br />sources/finalizers | \* | update |
| odigos.io | collectorsgroups/status<br />destinations/status<br />instrumentationconfigs/status<br />instrumentationinstances/status<br />processors/status | \* | get<br />list<br />patch<br />update<br />watch |
| odigos.io | instrumentationrules/status<br />recommendations/status | \* | get<br />patch<br />update |
| odigos.io | recommendations<br />sampling | \* | create<br />delete<br />get<br />list<br />patch<br />update<br />watch |
| operator.odigos.io | odigos | \* | create<br />delete<br />get<br />list<br />patch<br />update<br />watch |
| operator.odigos.io | odigos/finalizers | \* | update |
| operator.odigos.io | odigos/status | \* | get<br />patch<br />update |
| policy | podsecuritypolicies | privileged | use |
| rbac.authorization.k8s.io | clusterrolebindings<br />clusterroles<br />rolebindings<br />roles | \* | create<br />delete<br />deletecollection<br />get<br />list<br />patch<br />update<br />watch |
| security.openshift.io | securitycontextconstraints | \* | use |
| authentication.k8s.io | tokenreviews | \* | create |
| authorization.k8s.io | subjectaccessreviews | \* | create |


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.