Kubernetes permissions DevOpsPad needs

DevOpsPad’s Kubernetes query tabs and resource inspector only read. They need list on the resource types you query, get to open an object, list on events for the Events tab and get on pods/log for logs. Kubernetes RBAC still decides what you can see: DevOpsPad never widens your access.

If a request is denied, DevOpsPad shows “Access denied”, names the operation and includes the server response. The error stays in the section that needs it.

Permission table

What you do in DevOpsPad	API request	Verb and resource
Test connection	List one Pod in the connection’s namespace	list pods
Populate the namespace drop-down	List namespaces	list namespaces (cluster-wide)
get pods, get services, …	List the type	list <resource>
get nodes	List nodes	list nodes (cluster-wide)
Open the inspector (Overview, JSON)	Get the object	get <resource>
Events tab	List events by UID	list events
Logs tab	Read Pod logs	get pods, get pods/log

Listing namespaces is optional. Without it, DevOpsPad keeps using the namespace saved in the connection. See Choose a Kubernetes namespace.

A minimal read-only Role

This Role allows everything above within one namespace. Bind it to the user or service account in your kubeconfig.

apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: devopspad-read
  namespace: team-a
rules:
  - apiGroups: [""]
    resources: ["pods", "pods/log", "services", "configmaps", "events"]
    verbs: ["get", "list"]
  - apiGroups: ["apps"]
    resources: ["deployments", "statefulsets", "daemonsets"]
    verbs: ["get", "list"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: devopspad-read
  namespace: team-a
subjects:
  - kind: User
    name: alice
    apiGroup: rbac.authorization.k8s.io
roleRef:
  kind: Role
  name: devopspad-read
  apiGroup: rbac.authorization.k8s.io

Nodes and namespaces are cluster-scoped. To list them, add a ClusterRole with get and list on nodes and namespaces, bound with a ClusterRoleBinding.

Kubernetes also ships a built-in view ClusterRole that covers most namespaced reads. It does not include Secrets, which DevOpsPad does not need.

Secrets are not needed

DevOpsPad’s query tabs cannot list Secrets, and the Infra console’s application configuration view shows only which Secrets a workload references, not their contents. Do not grant Secret access for DevOpsPad.

Infra console writes need more

Releases, scaling, restarts and rollbacks in the Infra console change Deployments, so they need write permissions on top of this Role. If your team separates read and write access, keep a read-only context for browsing and a separate context for releases.

For accounts on other engines, see Create least-privilege accounts.