OpenShell/deploy/helm/openshell/templates/clusterrole.yaml

{{- if include "openshell.clusterRbacCreate" . }}
# SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
# SPDX-License-Identifier: Apache-2.0

{{ $kubernetesConfig := include "openshell.effectiveKubernetesConfig" . | fromYaml -}}
{{- $workspaceMode := get $kubernetesConfig "workspace_mode" | default "shared" }}
{{- $allowDriverConfig := get $kubernetesConfig "allow_driver_config" | default false -}}
{{- $managedSshIngressEnabled := .Values.networkPolicy.enabled -}}
{{- $gatewayConfig := .Values.gatewayConfig | default dict -}}
{{- $managedSshIngress := get $gatewayConfig "openshell.drivers.kubernetes.managed_ssh_ingress" | default dict -}}
{{- if hasKey $managedSshIngress "enabled" -}}
{{- $managedSshIngressEnabled = get $managedSshIngress "enabled" -}}
{{- end -}}
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: {{ include "openshell.clusterRoleName" . }}
  labels:
    {{- include "openshell.labels" . | nindent 4 }}
rules:
  - apiGroups: ["node.k8s.io"]
    resources: ["runtimeclasses"]
    verbs: ["get"]
  - apiGroups: ["scheduling.k8s.io"]
    resources: ["priorityclasses"]
    verbs: ["get"]
  {{- if and (ne $workspaceMode "shared") $allowDriverConfig }}
  - apiGroups: [""]
    resources: ["persistentvolumeclaims"]
    verbs: ["get"]
  {{- end }}
  # Validate projected ServiceAccount tokens during sandbox bootstrap and
  # internal gateway peer authentication.
  - apiGroups:
      - authentication.k8s.io
    resources:
      - tokenreviews
    verbs:
      - create
  - apiGroups:
      - ""
    resources:
      - nodes
    verbs:
      - get
      - list
      - watch
  # Read namespace annotations for OpenShift SCC UID/GID range resolution.
  # Managed/operator modes additionally need list+watch for cluster-wide
  # namespace discovery. Managed mode needs create+delete for namespace
  # lifecycle.
  - apiGroups:
      - ""
    resources:
      - namespaces
    verbs:
      - get
      {{- if ne $workspaceMode "shared" }}
      - list
      - watch
      {{- end }}
      {{- if eq $workspaceMode "managed" }}
      - create
      - delete
      {{- end }}
  {{- if ne $workspaceMode "shared" }}
  # Cluster-wide sandbox CRD access for managed/operator workspace modes.
  - apiGroups:
      - agents.x-k8s.io
    resources:
      - sandboxes
      - sandboxes/status
    verbs:
      - create
      - delete
      - get
      - list
      - patch
      - update
      - watch
  - apiGroups:
      - ""
    resources:
      - events
    verbs:
      - get
      - list
      - watch
  - apiGroups:
      - ""
    resources:
      - pods
    verbs:
      - create
      - delete
      - get
      - list
      - patch
      - watch
  {{- end }}
  {{- if ne $workspaceMode "shared" }}
  - apiGroups: [""]
    resources: ["services"]
    verbs: ["create", "get"]
  - apiGroups: ["networking.k8s.io"]
    resources: ["networkpolicies"]
    verbs: ["create", "get"]
  {{- end }}
  {{- if eq $workspaceMode "managed" }}
  # Operator-mode namespaces receive Secret permissions from the
  # openshell-workspace chart Role instead.
  - apiGroups: [""]
    resources: ["secrets"]
    verbs: ["create", "delete"]
  # ServiceAccount creation in managed namespaces.
  - apiGroups:
      - ""
    resources:
      - serviceaccounts
    verbs:
      - create
      - get
  {{- if $managedSshIngressEnabled }}
  # Apply gateway-only SSH ingress isolation in managed namespaces.
  - apiGroups:
      - networking.k8s.io
    resources:
      - networkpolicies
    verbs:
      - get
      - create
      - patch
      - update
  {{- end }}
  {{- end }}
{{- end }}