T1system:persistent-volume-provisionercluster
Allows external storage provisioners to create and delete PersistentVolumes and read PersistentVolumeClaims and StorageClasses.
- →
Can create PersistentVolumes with hostPath; pods mounting those volumes gain direct access to the node filesystem.
- →
Intended exclusively for external storage provisioner controllers; verify no application workloads hold this role.
Permissions (4)
| apiGroup | resources / urls | verbs |
|---|---|---|
| "" | persistentvolumes | create delete get list watch |
| "" | persistentvolumeclaims | get list update watch |
| storage.k8s.io | storageclasses | get list watch |
| "", events.k8s.io | events | create patch update watch |
Audit: RequestResponseK8s docs ↗