Skip to content

docs: Openshift namespaced roles #4233

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
aledegano wants to merge 3 commits into
base: master
Choose a base branch
from
Open

docs: Openshift namespaced roles #4233

Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
29397f3
docs: Openshift namespaced roles
aledegano Nov 3, 2025
7125b6a
Apply suggestions from code review
aledegano Feb 19, 2026
2c073fe
Merge branch 'master' into docs-namespaced-roles-openshift
aledegano Feb 19, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
274 changes: 274 additions & 0 deletions docs/docs/20-admins/40-openshift/10-setup.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -207,6 +207,280 @@ roleRef:
name: priorityclasses-manager
```

If cluster-wide permissions are not available, the roles and their bindings can be bound to the namespace in which Renku will be deployed:
```yaml
---
kind: Role
apiVersion: rbac.authorization.k8s.io/v1
metadata:
name: amaltheasession-manager
namespace: <replace-renku-namespace>
rules:
- apiGroups:
- amalthea.dev
resources:
- amaltheasessions
verbs:
- create
- delete
- get
- list
- patch
- update
- watch
- apiGroups:
- amalthea.dev
resources:
- amaltheasessions/finalizers
verbs:
- update
- apiGroups:
- amalthea.dev
resources:
- amaltheasessions/status
verbs:
- get
- patch
- update
---
kind: RoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
name: amaltheasession-manager-for-renku-admin
namespace: <replace-renku-namespace>
subjects:
- kind: Group
apiGroup: rbac.authorization.k8s.io
name: renku-admin
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: Role
name: amaltheasession-manager
---
kind: RoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
name: resourcesquotas-manager-for-renku-admin
subjects:
- kind: Group
apiGroup: rbac.authorization.k8s.io
name: renku-admin
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: Role
name: resourcesquotas-manager
---
kind: Role
apiVersion: rbac.authorization.k8s.io/v1
metadata:
name: priorityclasses-manager
namespace: <replace-renku-namespace>
rules:
- apiGroups:
- "scheduling.k8s.io"
resources:
- priorityclasses
verbs:
- create
- delete
- get
- list
- patch
- update
- watch
---
kind: RoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
name: priorityclasses-manager-for-renku-admin
namespace: <replace-renku-namespace>
subjects:
- kind: User
apiGroup: rbac.authorization.k8s.io
name: renku-admin
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: Role
name: priorityclasses-manager
---
# Source: renku/templates/data-service/rbac.yaml
Comment thread
aledegano marked this conversation as resolved.
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
name: renku-data-service
namespace: <replace-renku-namespace>
labels:
app: renku
chart: renku-2.10.0
release: renku
heritage: Helm
Comment thread
aledegano marked this conversation as resolved.
rules:
- apiGroups:
- "scheduling.k8s.io"
resources:
- priorityclasses
verbs:
- get
- list
- patch
- delete
- create
---
# Source: renku/templates/data-service/rbac.yaml
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
name: renku-data-service
namespace: <replace-renku-namespace>
labels:
app: renku
chart: renku-2.10.0
release: renku
heritage: Helm
Comment thread
aledegano marked this conversation as resolved.
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: Role
name: renku-data-service
subjects:
- kind: ServiceAccount
name: renku-data-service
namespace: <replace-renku-namespace>
---
# Source: renku/templates/data-service/rbac.yaml
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
name: renku-data-service
namespace: <replace-renku-namespace>
labels:
app: renku
chart: renku-2.10.0
release: renku
heritage: Helm
Comment thread
aledegano marked this conversation as resolved.
rules:
- apiGroups:
- ""
resources:
- resourcequotas
verbs:
- get
- list
- patch
- delete
- create
- apiGroups:
- ""
resources:
- pods
- pods/log
- services
- endpoints
- secrets
verbs:
- get
- list
- watch
- apiGroups:
- ""
resources:
- pods
- secrets
verbs:
- delete
- apiGroups:
- apps
resources:
- statefulsets
verbs:
- get
- list
- watch
- patch
- apiGroups:
- ""
resources:
- secrets
verbs:
- create
- update
- delete
- patch
- apiGroups:
- amalthea.dev
resources:
- amaltheasessions
verbs:
- create
- update
- delete
- patch
- list
- get
- watch
---
# Source: renku/templates/data-service/rbac_k8s_watcher.yaml
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
name: renku-k8s-watcher
labels:
app: renku
chart: renku-2.10.0
release: renku
heritage: Helm
Comment thread
aledegano marked this conversation as resolved.
rules:
- apiGroups:
- amalthea.dev
resources:
- amaltheasessions
verbs:
- create
- update
- delete
- patch
- list
- get
- watch
---
# Source: renku/templates/data-service/rbac.yaml
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
name: renku-data-service
labels:
app: renku
chart: renku-2.10.0
release: renku
heritage: Helm
Comment thread
aledegano marked this conversation as resolved.
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: Role
name: renku-data-service
subjects:
- kind: ServiceAccount
name: renku-data-service
namespace: <replace-renku-namespace>
---
# Source: renku/templates/data-service/rbac_k8s_watcher.yaml
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
name: renku-k8s-watcher
labels:
app: renku
chart: renku-2.10.0
release: renku
heritage: Helm
Comment thread
aledegano marked this conversation as resolved.
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: Role
name: renku-k8s-watcher
subjects:
- kind: ServiceAccount
name: renku-k8s-watcher
namespace: <replace-renku-namespace>
```

As an admin, setup renku project admin roles:

```bash
Expand Down
Loading