RBAC permissions

Edge and Edge Proxy run with separate ServiceAccounts and ClusterRoles. Edge reads a wide range of cluster resources to build the production map. Edge Proxy reads only Secrets to resolve backend credentials for on-prem data-source connections.

Edge permissions

Edge runs with a ClusterRole that grants read-only access to standard Kubernetes resources across five API groups.

rules:
  - apiGroups: [""]
    resources:
      - pods
      - services
      - configmaps
      - secrets
      - persistentvolumeclaims
      - persistentvolumes
      - nodes
      - namespaces
      - resourcequotas
      - limitranges
    verbs: ["get", "list", "watch"]

  - apiGroups: ["apps"]
    resources:
      - deployments
      - statefulsets
      - daemonsets
      - replicasets
    verbs: ["get", "list", "watch"]

  - apiGroups: ["networking.k8s.io"]
    resources:
      - ingresses
      - networkpolicies
    verbs: ["get", "list", "watch"]

  - apiGroups: ["batch"]
    resources:
      - jobs
    verbs: ["get", "list", "watch"]

  - apiGroups: ["policy"]
    resources:
      - poddisruptionbudgets
    verbs: ["get", "list", "watch"]

Why Edge needs these permissions

API Group	Resource	Why
`""` (core)	`pods`	Map IPs to workloads and track container status.
`""` (core)	`services`	Identify service endpoints and DNS names.
`""` (core)	`configmaps`	Detect configuration dependencies between workloads.
`""` (core)	`secrets`	Track secret references used by pods and volumes.
`""` (core)	`persistentvolumeclaims`	Map storage claims to workloads.
`""` (core)	`persistentvolumes`	Understand backing storage topology.
`""` (core)	`nodes`	Map pods to nodes and track node conditions.
`""` (core)	`namespaces`	Scope resources and detect namespace boundaries.
`""` (core)	`resourcequotas`	Surface quota limits that may affect scheduling.
`""` (core)	`limitranges`	Surface default limits applied to containers.
`apps`	`deployments`	Understand ownership hierarchy and rollout status.
`apps`	`statefulsets`	Track stateful workload ownership and ordering.
`apps`	`daemonsets`	Identify node-level workloads.
`apps`	`replicasets`	Link pods to their owning deployment (Pod → ReplicaSet → Deployment).
`networking.k8s.io`	`ingresses`	Map external entry points to backend services.
`networking.k8s.io`	`networkpolicies`	Detect network segmentation between workloads.
`batch`	`jobs`	Track batch workloads and their completion status.
`policy`	`poddisruptionbudgets`	Surface availability constraints on workloads.

Helm chart resources

When rbac.create is true (the default), the chart creates the following resources for Edge:

Resource	Name	Condition
ServiceAccount	`<release>-edge`	`serviceAccount.create=true` (default)
ClusterRole	`<release>-edge`	`rbac.create=true` (default)
ClusterRoleBinding	`<release>-edge`	`rbac.create=true` (default)

Edge Proxy permissions

When you deploy on-prem connections, Edge Proxy needs read access to Kubernetes Secrets to load credentials for your data sources at runtime.

API Group	Resource	Verbs	Why
`""` (core)	`secrets`	`get`, `list`, `watch`	Read credentials stored in Kubernetes Secrets.

Helm chart resources

Resource	Name	Condition
ServiceAccount	`<release>-edge-proxy`	`onPremConnections` non-empty
ClusterRole	`<release>-edge-proxy`	`onPremConnections` non-empty and `rbac.create=true`
ClusterRoleBinding	`<release>-edge-proxy`	`onPremConnections` non-empty and `rbac.create=true`

The ClusterRole definition:

apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: <release>-edge-proxy
rules:
- apiGroups: [""]
  resources: ["secrets"]
  verbs: ["get", "list", "watch"]

RBAC comparison

API Group	Resource	Edge	Edge Proxy
`""` (core)	`pods`	`get`, `list`, `watch`	None
`""` (core)	`services`	`get`, `list`, `watch`	None
`""` (core)	`configmaps`	`get`, `list`, `watch`	None
`""` (core)	`secrets`	`get`, `list`, `watch`	`get`, `list`, `watch`
`""` (core)	`persistentvolumeclaims`	`get`, `list`, `watch`	None
`""` (core)	`persistentvolumes`	`get`, `list`, `watch`	None
`""` (core)	`nodes`	`get`, `list`, `watch`	None
`""` (core)	`namespaces`	`get`, `list`, `watch`	None
`""` (core)	`resourcequotas`	`get`, `list`, `watch`	None
`""` (core)	`limitranges`	`get`, `list`, `watch`	None
`apps`	`deployments`	`get`, `list`, `watch`	None
`apps`	`statefulsets`	`get`, `list`, `watch`	None
`apps`	`daemonsets`	`get`, `list`, `watch`	None
`apps`	`replicasets`	`get`, `list`, `watch`	None
`networking.k8s.io`	`ingresses`	`get`, `list`, `watch`	None
`networking.k8s.io`	`networkpolicies`	`get`, `list`, `watch`	None
`batch`	`jobs`	`get`, `list`, `watch`	None
`policy`	`poddisruptionbudgets`	`get`, `list`, `watch`	None

Edge reads a wide range of resources to build the production map. Edge Proxy reads only Secrets to resolve backend credentials. Both components run with separate ServiceAccounts.

Extending the Edge ClusterRole

The rbac.extraRules value lets you append additional rules to the Edge ClusterRole. This applies to Edge only. The Edge Proxy ClusterRole is not affected.

rbac:
  extraRules:
    - apiGroups: ["autoscaling"]
      resources: ["horizontalpodautoscalers"]
      verbs: ["get", "list", "watch"]

Least privilege

The agent is Read-Only. It never modifies your Kubernetes resources. It only reads the state to build the observability graph.

Use an existing ServiceAccount

Edge

To skip automatic ServiceAccount creation and use your own:

serviceAccount:
  create: false
  name: "your-existing-sa"

If you also want to manage the ClusterRole yourself, disable RBAC creation as well:

rbac:
  create: false

serviceAccount:
  create: false
  name: "your-existing-sa"

Make sure that your ServiceAccount has the permissions listed in Edge Permissions.

Edge Proxy

There is no separate create toggle for the Edge Proxy ServiceAccount. The chart always creates it when onPremConnections is non-empty. To bring your own RBAC while keeping the chart-created ServiceAccount, set rbac.create: false and create your own ClusterRole and ClusterRoleBinding targeting the <release>-edge-proxy ServiceAccount:

rbac:
  create: false

rbac.create is a shared toggle. Setting it to false disables ClusterRole creation for both Edge and Edge Proxy. If you only need custom RBAC for one component, create both ClusterRoles manually.

Restrict secret access with namespace scoping

The default Helm chart creates a ClusterRole (cluster-wide secret access). To restrict Edge Proxy to secrets in a specific namespace, create a namespaced Role and RoleBinding manually:

apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: <release>-edge-proxy
  namespace: nofire-system
rules:
- apiGroups: [""]
  resources: ["secrets"]
  verbs: ["get", "list", "watch"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: <release>-edge-proxy
  namespace: nofire-system
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: <release>-edge-proxy
subjects:
- kind: ServiceAccount
  name: <release>-edge-proxy
  namespace: nofire-system

Then disable the chart’s ClusterRole:

rbac:
  create: false

All connector secrets must be in the same namespace as the Role. If your secrets are spread across namespaces, use the default ClusterRole or create multiple Roles.

Get Started

Production readiness

Change management

Incidents

Always-On Workflows

Analytics

Setup & Integrations

Security

Edge permissions

Why Edge needs these permissions

Helm chart resources

Edge Proxy permissions

Helm chart resources

RBAC comparison

Extending the Edge ClusterRole

Least privilege

Use an existing ServiceAccount

Edge

Edge Proxy

Restrict secret access with namespace scoping

​Edge permissions

​Why Edge needs these permissions

​Helm chart resources

​Edge Proxy permissions

​Helm chart resources

​RBAC comparison

​Extending the Edge ClusterRole

​Least privilege

​Use an existing ServiceAccount

​Edge

​Edge Proxy

​Restrict secret access with namespace scoping

Edge permissions

Why Edge needs these permissions

Helm chart resources

Edge Proxy permissions

Helm chart resources

RBAC comparison

Extending the Edge ClusterRole

Least privilege

Use an existing ServiceAccount

Edge

Edge Proxy

Restrict secret access with namespace scoping