T2system:node-proxiercluster
kube-proxy identity with list/watch access to Services, Endpoints, EndpointSlices, and Nodes to maintain service routing rules.
- →
Bound to the kube-proxy ServiceAccount by default.
- →
Cluster-wide watch on Services, Endpoints, and EndpointSlices provides full service-routing topology visibility to any holder of this role.
Permissions (5)
| apiGroup | resources / urls | verbs |
|---|---|---|
| "" | endpoints, services | list watch |
| "" | nodes | get list watch |
| "", events.k8s.io | events | create patch update |
| networking.k8s.io | servicecidrs | list watch |
| discovery.k8s.io | endpointslices | list watch |
Audit: MetadataK8s docs ↗