What RBAC permissions does helmtester need?

[hobbsh]

Hi,

Really impressed with Flagger and everything it can do! I'm wondering what the minimum RBAC policy required is for helmtester. Does this depend on the chart being tested?

[stefanprodan]

It depends on how you define the tests, if they are pods then helmtester needs access to create, get, list, delete pods as well as fetching the logs from those pods. You can determine the right RBAC by creating an account and run helm test under that account.

[hobbsh]

Thanks for the quick response! I'll see what I can figure out.

[kobellem]

I've got the helm test to work with the following ClusterRole:

apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: flagger-loadtester
rules:
- apiGroups: [""]
  resources: ["pods"]
  verbs: ["create", "get", "list", "watch", "delete"]
- apiGroups: [""]
  resources: ["secrets"]
  verbs: ["list", "update"]