garm-provider-k8s required permissions

[Hdom]

Hello, is there any documentation about what Kubernetes permissions are needed for GARM to be able to deploy runners using the garm-provider-k8s provider?

[gabriel-samfira]

CC @bavarianbidi

[bavarianbidi]

it's not explicit documented, but the garm-provider-k8s binary needs permission to create a namespace and in that namespace it has to be able to create, list and delete a pod.

if you want to get rid of the namespace permission, you can pre-create the namespace (this is the current ensureNamespace implementation - xref: https://github.com/mercedes-benz/garm-provider-k8s/blob/main/internal/provider/provider.go#L97-L119

For local development, we're using the following clusterrole (which has to many permissions - will get rid of this)
xref: https://github.com/mercedes-benz/garm-provider-k8s/blob/main/hack/local-development/kubernetes/clusterrole.yaml

[bavarianbidi]

i've created an issue to update the docs: mercedes-benz/garm-provider-k8s#70