Reduce ClusterRole{Bindings}s to namespaced Role{Bindings}s in logstream-workergroup about helm-charts HOT 3 OPEN

There is no requirement for the Cribl Worker Group chart to have a ClusterRole/ClusterRoleBinding at all. Cribl Stream does not need to have access to the Kubernetes API. This is maintained as to not break older versions of the chart. We will be removing it in a future release/new chart.

I would recommend setting the following in your values file:

rbac:
  create: false
serviceAccount:
  create: false

from helm-charts.

Check me @bdalpe but I think the product wants to be able to get the pod it's in using the CRIBL_K8S_POD envvar we set in the chart. It uses that to let the leader know the name of the namespace, pod, and node the instance is in for Mappings.

from helm-charts.

Yeah, looks like setting rbac.create=false is good enough to deploy without needing cluster-admin permissions.

Even if the leader uses the API to get information about the pods then the default local namespaced scoped permissions should work I would believe, at least from what I've been able to see as the workload does come up.

Unless it's intended to be getting resources from other namespaces or the cluster scope and just hasn't failed for me yet...I'm not too familiar with the Cribl architecture and operations so I'll let y'all correct me on that one.

from helm-charts.