T1system:kube-schedulercluster
Scheduler identity.
Reads pods, nodes, storage and scheduling metadata, then writes binding/status decisions for pods.
Cluster-scoped but limited to scheduling concerns.
- →
Uses create on pods/binding and update/patch on pods/status for scheduling decisions; this is not the RBAC special verb bind.
- →
Reads PriorityClasses, PersistentVolumes, PersistentVolumeClaims, and related scheduling data, giving visibility into workload placement constraints.
Permissions (27)
| apiGroup | resources / urls | verbs |
|---|---|---|
| "", events.k8s.io | events | create patch update |
| coordination.k8s.io | leases | create |
| coordination.k8s.io | leases | get list update watch |
| coordination.k8s.io | leasecandidates | create delete deletecollection get list patch update watch |
| "" | nodes | get list watch |
| "" | pods | delete get list watch |
| "" | bindings, pods/binding | create |
| "" | pods/status | patch update |
| "" | replicationcontrollers, services | get list watch |
| apps, extensions | replicasets | get list watch |
| apps | statefulsets | get list watch |
| policy | poddisruptionbudgets | get list watch |
| "" | persistentvolumeclaims, persistentvolumes | get list watch |
| authentication.k8s.io | tokenreviews | create |
| authorization.k8s.io | subjectaccessreviews | create |
| storage.k8s.io | csinodes | get list watch |
| storage.k8s.io | volumeattachments | get list watch |
| "" | namespaces | get list watch |
| storage.k8s.io | csidrivers | get list watch |
| storage.k8s.io | csistoragecapacities | get list watch |
| resource.k8s.io | deviceclasses | get list watch |
| resource.k8s.io | resourceclaims | get list patch update watch |
| resource.k8s.io | resourceclaims/status | get list patch update watch |
| "" | pods/finalizers | update |
| resource.k8s.io | resourceslices | get list watch |
| resource.k8s.io | resourceclaims | create delete |
| resource.k8s.io | resourceclaims/binding | patch update |
Audit: MetadataK8s docs ↗