Skip to content

kserve-autogluon-server: RBAC

ServiceAccount bindings, roles, and resource permissions.

RBAC Overview

This component defines a large RBAC surface (113 diagram lines). The graph below groups roles by permission scope.

graph LR
    classDef wide fill:#e74c3c,stroke:#c0392b,color:#fff
    classDef medium fill:#f39c12,stroke:#d68910,color:#fff
    classDef narrow fill:#2ecc71,stroke:#27ae60,color:#fff
    classDef subject fill:#3498db,stroke:#2980b9,color:#fff

    subgraph wide["Wide Scope (>30 resources)"]
    kserve_manager_role["kserve-manager-role\n42 resources"]:::wide
    end
    subgraph nar["Narrow Scope (<10)"]
    kserve_proxy_role["kserve-proxy-role\n2 resources"]:::narrow
    kserve_leader_election_role["kserve-leader-election-role\n4 resources"]:::narrow
    end

    subj_kserve_controller_manager["kserve-controller-manager\nServiceAccount"]:::subject
    subj_kserve_controller_manager -->|binds| kserve_manager_role
    subj_kserve_controller_manager -->|binds| kserve_proxy_role
    subj_kserve_controller_manager -->|binds| kserve_leader_election_role

Bindings

Subject-to-role mappings defining who has access to what.

Binding Type Role Subject
kserve-manager-rolebinding ClusterRoleBinding kserve-manager-role ServiceAccount/kserve-controller-manager
kserve-proxy-rolebinding ClusterRoleBinding kserve-proxy-role ServiceAccount/kserve-controller-manager
kserve-leader-election-rolebinding RoleBinding kserve-leader-election-role ServiceAccount/kserve-controller-manager

Role Details

Per-rule breakdown of API groups, resources, and verbs for each role.

Role Kind API Groups Resources Verbs
kserve-manager-role ClusterRole configmaps create, get, update
kserve-manager-role ClusterRole events, services create, delete, get, list, patch, update, watch
kserve-manager-role ClusterRole namespaces, pods get, list, watch
kserve-manager-role ClusterRole secrets, serviceaccounts get
kserve-manager-role ClusterRole mutatingwebhookconfigurations, validatingwebhookconfigurations create, delete, get, list, patch, update, watch
kserve-manager-role ClusterRole deployments create, delete, get, list, patch, update, watch
kserve-manager-role ClusterRole horizontalpodautoscalers create, delete, get, list, patch, update, watch
kserve-manager-role ClusterRole httproutes create, delete, get, list, patch, update, watch
kserve-manager-role ClusterRole scaledobjects, scaledobjects/finalizers create, delete, get, list, patch, update, watch
kserve-manager-role ClusterRole scaledobjects/status get, patch, update
kserve-manager-role ClusterRole virtualservices, virtualservices/finalizers create, delete, get, list, patch, update, watch
kserve-manager-role ClusterRole virtualservices/status get, patch, update
kserve-manager-role ClusterRole ingresses create, delete, get, list, patch, update, watch
kserve-manager-role ClusterRole opentelemetrycollectors, opentelemetrycollectors/finalizers create, delete, get, list, patch, update, watch
kserve-manager-role ClusterRole opentelemetrycollectors/status get, patch, update
kserve-manager-role ClusterRole services, services/finalizers create, delete, get, list, patch, update, watch
kserve-manager-role ClusterRole services/status get, patch, update
kserve-manager-role ClusterRole clusterservingruntimes, clusterservingruntimes/finalizers, clusterstoragecontainers, inferencegraphs, inferencegraphs/finalizers, inferenceservices, inferenceservices/finalizers, servingruntimes, servingruntimes/finalizers, trainedmodels create, delete, get, list, patch, update, watch
kserve-manager-role ClusterRole clusterservingruntimes/status, inferencegraphs/status, inferenceservices/status, servingruntimes/status, trainedmodels/status get, patch, update
kserve-manager-role ClusterRole localmodelcaches, localmodelnamespacecaches get, list, watch
kserve-proxy-role ClusterRole tokenreviews create
kserve-proxy-role ClusterRole subjectaccessreviews create
kserve-leader-election-role Role leases create, get, list, update
kserve-leader-election-role Role configmaps get, list, watch, create, update, patch, delete
kserve-leader-election-role Role configmaps/status get, update, patch
kserve-leader-election-role Role events create

Cluster Roles

Name Resources Verbs Source
kserve-manager-role configmaps create, get, update config/rbac/role.yaml
kserve-manager-role events, services create, delete, get, list, patch, update, watch config/rbac/role.yaml
kserve-manager-role namespaces, pods get, list, watch config/rbac/role.yaml
kserve-manager-role secrets, serviceaccounts get config/rbac/role.yaml
kserve-manager-role mutatingwebhookconfigurations, validatingwebhookconfigurations create, delete, get, list, patch, update, watch config/rbac/role.yaml
kserve-manager-role deployments create, delete, get, list, patch, update, watch config/rbac/role.yaml
kserve-manager-role horizontalpodautoscalers create, delete, get, list, patch, update, watch config/rbac/role.yaml
kserve-manager-role httproutes create, delete, get, list, patch, update, watch config/rbac/role.yaml
kserve-manager-role scaledobjects, scaledobjects/finalizers create, delete, get, list, patch, update, watch config/rbac/role.yaml
kserve-manager-role scaledobjects/status get, patch, update config/rbac/role.yaml
kserve-manager-role virtualservices, virtualservices/finalizers create, delete, get, list, patch, update, watch config/rbac/role.yaml
kserve-manager-role virtualservices/status get, patch, update config/rbac/role.yaml
kserve-manager-role ingresses create, delete, get, list, patch, update, watch config/rbac/role.yaml
kserve-manager-role opentelemetrycollectors, opentelemetrycollectors/finalizers create, delete, get, list, patch, update, watch config/rbac/role.yaml
kserve-manager-role opentelemetrycollectors/status get, patch, update config/rbac/role.yaml
kserve-manager-role services, services/finalizers create, delete, get, list, patch, update, watch config/rbac/role.yaml
kserve-manager-role services/status get, patch, update config/rbac/role.yaml
kserve-manager-role clusterservingruntimes, clusterservingruntimes/finalizers, clusterstoragecontainers, inferencegraphs, inferencegraphs/finalizers, inferenceservices, inferenceservices/finalizers, servingruntimes, servingruntimes/finalizers, trainedmodels create, delete, get, list, patch, update, watch config/rbac/role.yaml
kserve-manager-role clusterservingruntimes/status, inferencegraphs/status, inferenceservices/status, servingruntimes/status, trainedmodels/status get, patch, update config/rbac/role.yaml
kserve-manager-role localmodelcaches, localmodelnamespacecaches get, list, watch config/rbac/role.yaml
kserve-proxy-role tokenreviews create config/rbac/auth_proxy_role.yaml
kserve-proxy-role subjectaccessreviews create config/rbac/auth_proxy_role.yaml

Kubebuilder RBAC Markers

Kubebuilder +kubebuilder:rbac markers declare the RBAC requirements of controller reconcilers. These are the source of truth for generated ClusterRole manifests. 66 markers found.

File Line Groups Resources Verbs
.gomod-cache/github.com/open-telemetry/opentelemetry-operator@v0.113.0/controllers/opampbridge_controller.go:75 75 opentelemetry.io opampbridges get, list, watch, create, update, patch, delete
.gomod-cache/github.com/open-telemetry/opentelemetry-operator@v0.113.0/controllers/opampbridge_controller.go:76 76 opentelemetry.io opampbridges/status get, update, patch
.gomod-cache/github.com/open-telemetry/opentelemetry-operator@v0.113.0/controllers/opampbridge_controller.go:77 77 opentelemetry.io opampbridges/finalizers update
.gomod-cache/sigs.k8s.io/lws@v0.7.0/pkg/cert/cert.go:31 31 "" secrets get, list, watch, update
.gomod-cache/sigs.k8s.io/lws@v0.7.0/pkg/cert/cert.go:32 32 "admissionregistration.k8s.io" mutatingwebhookconfigurations get, list, watch, update
.gomod-cache/sigs.k8s.io/lws@v0.7.0/pkg/cert/cert.go:33 33 "admissionregistration.k8s.io" validatingwebhookconfigurations get, list, watch, update
.gomod-cache/sigs.k8s.io/lws@v0.7.0/pkg/controllers/leaderworkerset_controller.go:84 84 "" events create, watch, update, patch
.gomod-cache/sigs.k8s.io/lws@v0.7.0/pkg/controllers/leaderworkerset_controller.go:85 85 leaderworkerset.x-k8s.io leaderworkersets get, list, watch, create, update, patch, delete
.gomod-cache/sigs.k8s.io/lws@v0.7.0/pkg/controllers/leaderworkerset_controller.go:86 86 leaderworkerset.x-k8s.io leaderworkersets/status get, update, patch
.gomod-cache/sigs.k8s.io/lws@v0.7.0/pkg/controllers/leaderworkerset_controller.go:87 87 leaderworkerset.x-k8s.io leaderworkersets/finalizers update
.gomod-cache/sigs.k8s.io/lws@v0.7.0/pkg/controllers/leaderworkerset_controller.go:88 88 apps statefulsets get, list, watch, create, update, patch, delete
.gomod-cache/sigs.k8s.io/lws@v0.7.0/pkg/controllers/leaderworkerset_controller.go:89 89 apps statefulsets/status get, update, patch
.gomod-cache/sigs.k8s.io/lws@v0.7.0/pkg/controllers/leaderworkerset_controller.go:90 90 apps statefulsets/finalizers update
.gomod-cache/sigs.k8s.io/lws@v0.7.0/pkg/controllers/leaderworkerset_controller.go:91 91 core services get, list, watch, create, update, patch, delete
.gomod-cache/sigs.k8s.io/lws@v0.7.0/pkg/controllers/leaderworkerset_controller.go:92 92 core events get, list, watch, create, patch
.gomod-cache/sigs.k8s.io/lws@v0.7.0/pkg/controllers/pod_controller.go:63 63 "" events create, watch, update, patch
.gomod-cache/sigs.k8s.io/lws@v0.7.0/pkg/controllers/pod_controller.go:64 64 core pods create, delete, get, list, patch, update, watch
.gomod-cache/sigs.k8s.io/lws@v0.7.0/pkg/controllers/pod_controller.go:65 65 core pods/finalizers update
.gomod-cache/sigs.k8s.io/lws@v0.7.0/pkg/controllers/pod_controller.go:66 66 core nodes get, list, watch, update, patch
.gopath-loader/pkg/mod/github.com/open-telemetry/opentelemetry-operator@v0.113.0/controllers/opampbridge_controller.go:75 75 opentelemetry.io opampbridges get, list, watch, create, update, patch, delete
.gopath-loader/pkg/mod/github.com/open-telemetry/opentelemetry-operator@v0.113.0/controllers/opampbridge_controller.go:76 76 opentelemetry.io opampbridges/status get, update, patch
.gopath-loader/pkg/mod/github.com/open-telemetry/opentelemetry-operator@v0.113.0/controllers/opampbridge_controller.go:77 77 opentelemetry.io opampbridges/finalizers update
.gopath-loader/pkg/mod/sigs.k8s.io/lws@v0.7.0/pkg/cert/cert.go:31 31 "" secrets get, list, watch, update
.gopath-loader/pkg/mod/sigs.k8s.io/lws@v0.7.0/pkg/cert/cert.go:32 32 "admissionregistration.k8s.io" mutatingwebhookconfigurations get, list, watch, update
.gopath-loader/pkg/mod/sigs.k8s.io/lws@v0.7.0/pkg/cert/cert.go:33 33 "admissionregistration.k8s.io" validatingwebhookconfigurations get, list, watch, update
.gopath-loader/pkg/mod/sigs.k8s.io/lws@v0.7.0/pkg/controllers/leaderworkerset_controller.go:84 84 "" events create, watch, update, patch
.gopath-loader/pkg/mod/sigs.k8s.io/lws@v0.7.0/pkg/controllers/leaderworkerset_controller.go:85 85 leaderworkerset.x-k8s.io leaderworkersets get, list, watch, create, update, patch, delete
.gopath-loader/pkg/mod/sigs.k8s.io/lws@v0.7.0/pkg/controllers/leaderworkerset_controller.go:86 86 leaderworkerset.x-k8s.io leaderworkersets/status get, update, patch
.gopath-loader/pkg/mod/sigs.k8s.io/lws@v0.7.0/pkg/controllers/leaderworkerset_controller.go:87 87 leaderworkerset.x-k8s.io leaderworkersets/finalizers update
.gopath-loader/pkg/mod/sigs.k8s.io/lws@v0.7.0/pkg/controllers/leaderworkerset_controller.go:88 88 apps statefulsets get, list, watch, create, update, patch, delete
.gopath-loader/pkg/mod/sigs.k8s.io/lws@v0.7.0/pkg/controllers/leaderworkerset_controller.go:89 89 apps statefulsets/status get, update, patch
.gopath-loader/pkg/mod/sigs.k8s.io/lws@v0.7.0/pkg/controllers/leaderworkerset_controller.go:90 90 apps statefulsets/finalizers update
.gopath-loader/pkg/mod/sigs.k8s.io/lws@v0.7.0/pkg/controllers/leaderworkerset_controller.go:91 91 core services get, list, watch, create, update, patch, delete
.gopath-loader/pkg/mod/sigs.k8s.io/lws@v0.7.0/pkg/controllers/leaderworkerset_controller.go:92 92 core events get, list, watch, create, patch
.gopath-loader/pkg/mod/sigs.k8s.io/lws@v0.7.0/pkg/controllers/pod_controller.go:63 63 "" events create, watch, update, patch
.gopath-loader/pkg/mod/sigs.k8s.io/lws@v0.7.0/pkg/controllers/pod_controller.go:64 64 core pods create, delete, get, list, patch, update, watch
.gopath-loader/pkg/mod/sigs.k8s.io/lws@v0.7.0/pkg/controllers/pod_controller.go:65 65 core pods/finalizers update
.gopath-loader/pkg/mod/sigs.k8s.io/lws@v0.7.0/pkg/controllers/pod_controller.go:66 66 core nodes get, list, watch, update, patch
pkg/controller/v1alpha2/llmisvc/controller.go:89 89 serving.kserve.io llminferenceservices get, list, watch, create, update, patch, delete
pkg/controller/v1alpha2/llmisvc/controller.go:90 90 serving.kserve.io llminferenceservices/status get, update, patch
pkg/controller/v1alpha2/llmisvc/controller.go:91 91 serving.kserve.io llminferenceservices/finalizers update
pkg/controller/v1alpha2/llmisvc/controller.go:92 92 serving.kserve.io llminferenceserviceconfigs get, list, watch, create, update, patch, delete
pkg/controller/v1alpha2/llmisvc/controller.go:93 93 serving.kserve.io llminferenceserviceconfigs/finalizers update
pkg/controller/v1alpha2/llmisvc/controller.go:94 94 apps deployments get, list, watch, create, update, patch, delete
pkg/controller/v1alpha2/llmisvc/controller.go:95 95 leaderworkerset.x-k8s.io leaderworkersets get, list, watch, create, update, patch, delete
pkg/controller/v1alpha2/llmisvc/controller.go:96 96 core services get, list, watch, create, update, patch, delete
pkg/controller/v1alpha2/llmisvc/controller.go:97 97 core secrets get, list, watch, create, update, patch, delete
pkg/controller/v1alpha2/llmisvc/controller.go:98 98 networking.k8s.io ingresses get, list, watch, create, update, patch, delete
pkg/controller/v1alpha2/llmisvc/controller.go:99 99 gateway.networking.k8s.io httproutes, gateways, gatewayclasses get, list, watch, create, update, patch, delete
pkg/controller/v1alpha2/llmisvc/controller.go:100 100 inference.networking.x-k8s.io inferencepools, inferenceobjectives, inferencemodels get, list, watch, create, update, patch, delete
pkg/controller/v1alpha2/llmisvc/controller.go:101 101 inference.networking.k8s.io inferencepools, inferenceobjectives, inferencemodels get, list, watch, create, update, patch, delete
pkg/controller/v1alpha2/llmisvc/controller.go:102 102 core pods get, list, watch
pkg/controller/v1alpha2/llmisvc/controller.go:103 103 core serviceaccounts get, list, watch, create, update, patch, delete
pkg/controller/v1alpha2/llmisvc/controller.go:104 104 rbac.authorization.k8s.io roles, rolebindings, clusterrolebindings get, list, watch, create, update, patch, delete
pkg/controller/v1alpha2/llmisvc/controller.go:105 105 discovery.k8s.io endpointslices get, list, watch
pkg/controller/v1alpha2/llmisvc/controller.go:106 106 authentication.k8s.io tokenreviews, subjectaccessreviews create
pkg/controller/v1alpha2/llmisvc/controller.go:107 107 get
pkg/controller/v1alpha2/llmisvc/controller.go:108 108 "" events create, patch, update
pkg/controller/v1alpha2/llmisvc/controller.go:109 109 "" configmaps get, list, watch
pkg/controller/v1alpha2/llmisvc/controller.go:110 110 apiextensions.k8s.io customresourcedefinitions get, list, watch
pkg/controller/v1alpha2/llmisvc/controller.go:111 111 apiextensions.k8s.io customresourcedefinitions/status update, patch
pkg/controller/v1alpha2/llmisvc/controller.go:112 112 authorization.k8s.io subjectaccessreviews create
pkg/controller/v1alpha2/llmisvc/controller.go:113 113 autoscaling horizontalpodautoscalers get, list, watch, create, update, patch, delete
pkg/controller/v1alpha2/llmisvc/controller.go:114 114 llmd.ai variantautoscalings get, list, watch, create, update, patch, delete
pkg/controller/v1alpha2/llmisvc/controller.go:115 115 keda.sh scaledobjects get, list, watch, create, update, patch, delete
pkg/controller/v1alpha2/llmisvc/controller.go:116 116 coordination.k8s.io leases get, list, watch, create, update, patch, delete