From 29397f377ab10bad8730201422b411451fcd09f7 Mon Sep 17 00:00:00 2001 From: Alessandro Degano <40891147+aledegano@users.noreply.github.com> Date: Mon, 3 Nov 2025 16:36:55 +0100 Subject: [PATCH 1/2] docs: Openshift namespaced roles Added instruction on how to deploy namespaced-roles and their bindings for OpenShift to be used when Cluster-wide permissions are not available. --- docs/docs/20-admins/40-openshift/10-setup.md | 273 +++++++++++++++++++ 1 file changed, 273 insertions(+) diff --git a/docs/docs/20-admins/40-openshift/10-setup.md b/docs/docs/20-admins/40-openshift/10-setup.md index 037ef6f984..d3d009675b 100644 --- a/docs/docs/20-admins/40-openshift/10-setup.md +++ b/docs/docs/20-admins/40-openshift/10-setup.md @@ -202,6 +202,279 @@ roleRef: name: priorityclasses-manager ``` +If cluster-wide permissions are not available, the roles and their bindings can be bound to the namespace in which Renku will be deployed: +```yaml +--- +kind: Role +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: amaltheasession-manager + namespace: +rules: +- apiGroups: + - amalthea.dev + resources: + - amaltheasessions + verbs: + - create + - delete + - get + - list + - patch + - update + - watch +- apiGroups: + - amalthea.dev + resources: + - amaltheasessions/finalizers + verbs: + - update +- apiGroups: + - amalthea.dev + resources: + - amaltheasessions/status + verbs: + - get + - patch + - update +--- +kind: RoleBinding +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: amaltheasession-manager-for-renku-admin + namespace: +subjects: + - kind: Group + apiGroup: rbac.authorization.k8s.io + name: renku-admin +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: Role + name: amaltheasession-manager +--- +kind: RoleBinding +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: resourcesquotas-manager-for-renku-admin +subjects: + - kind: Group + apiGroup: rbac.authorization.k8s.io + name: renku-admin +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: Role + name: resourcesquotas-manager +--- +kind: Role +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: priorityclasses-manager + namespace: +rules: +- apiGroups: + - "scheduling.k8s.io" + resources: + - priorityclasses + verbs: + - create + - delete + - get + - list + - patch + - update + - watch +--- +kind: RoleBinding +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: priorityclasses-manager-for-renku-admin + namespace: +subjects: + - kind: User + apiGroup: rbac.authorization.k8s.io + name: renku-admin +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: Role + name: priorityclasses-manager +# Source: renku/templates/data-service/rbac.yaml +apiVersion: rbac.authorization.k8s.io/v1 +kind: Role +metadata: + name: renku-data-service + namespace: + labels: + app: renku + chart: renku-2.10.0 + release: renku + heritage: Helm +rules: + - apiGroups: + - "scheduling.k8s.io" + resources: + - priorityclasses + verbs: + - get + - list + - patch + - delete + - create +--- +# Source: renku/templates/data-service/rbac.yaml +apiVersion: rbac.authorization.k8s.io/v1 +kind: RoleBinding +metadata: + name: renku-data-service + namespace: + labels: + app: renku + chart: renku-2.10.0 + release: renku + heritage: Helm +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: Role + name: renku-data-service +subjects: + - kind: ServiceAccount + name: renku-data-service + namespace: +--- +# Source: renku/templates/data-service/rbac.yaml +apiVersion: rbac.authorization.k8s.io/v1 +kind: Role +metadata: + name: renku-data-service + namespace: + labels: + app: renku + chart: renku-2.10.0 + release: renku + heritage: Helm +rules: + - apiGroups: + - "" + resources: + - resourcequotas + verbs: + - get + - list + - patch + - delete + - create + - apiGroups: + - "" + resources: + - pods + - pods/log + - services + - endpoints + - secrets + verbs: + - get + - list + - watch + - apiGroups: + - "" + resources: + - pods + - secrets + verbs: + - delete + - apiGroups: + - apps + resources: + - statefulsets + verbs: + - get + - list + - watch + - patch + - apiGroups: + - "" + resources: + - secrets + verbs: + - create + - update + - delete + - patch + - apiGroups: + - amalthea.dev + resources: + - amaltheasessions + verbs: + - create + - update + - delete + - patch + - list + - get + - watch +--- +# Source: renku/templates/data-service/rbac_k8s_watcher.yaml +apiVersion: rbac.authorization.k8s.io/v1 +kind: Role +metadata: + name: renku-k8s-watcher + labels: + app: renku + chart: renku-2.10.0 + release: renku + heritage: Helm +rules: + - apiGroups: + - amalthea.dev + resources: + - amaltheasessions + verbs: + - create + - update + - delete + - patch + - list + - get + - watch +--- +# Source: renku/templates/data-service/rbac.yaml +apiVersion: rbac.authorization.k8s.io/v1 +kind: RoleBinding +metadata: + name: renku-data-service + labels: + app: renku + chart: renku-2.10.0 + release: renku + heritage: Helm +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: Role + name: renku-data-service +subjects: + - kind: ServiceAccount + name: renku-data-service + namespace: +--- +# Source: renku/templates/data-service/rbac_k8s_watcher.yaml +apiVersion: rbac.authorization.k8s.io/v1 +kind: RoleBinding +metadata: + name: renku-k8s-watcher + labels: + app: renku + chart: renku-2.10.0 + release: renku + heritage: Helm +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: Role + name: renku-k8s-watcher +subjects: + - kind: ServiceAccount + name: renku-k8s-watcher + namespace: +``` + As an admin, setup renku project admin roles: ```bash From 7125b6ad55f0cea62b1cafa6bdc5f00f9a138689 Mon Sep 17 00:00:00 2001 From: Alessandro Degano <40891147+aledegano@users.noreply.github.com> Date: Thu, 19 Feb 2026 15:10:13 +0100 Subject: [PATCH 2/2] Apply suggestions from code review Co-authored-by: Tasko Olevski <16360283+olevski@users.noreply.github.com> --- docs/docs/20-admins/40-openshift/10-setup.md | 1 + 1 file changed, 1 insertion(+) diff --git a/docs/docs/20-admins/40-openshift/10-setup.md b/docs/docs/20-admins/40-openshift/10-setup.md index d3d009675b..80990dcfa7 100644 --- a/docs/docs/20-admins/40-openshift/10-setup.md +++ b/docs/docs/20-admins/40-openshift/10-setup.md @@ -297,6 +297,7 @@ roleRef: apiGroup: rbac.authorization.k8s.io kind: Role name: priorityclasses-manager +--- # Source: renku/templates/data-service/rbac.yaml apiVersion: rbac.authorization.k8s.io/v1 kind: Role