Q: Minimum permissions for connecting Stratos with Kubernetes

Stratos Version

• All Stratos versions

Frontend Deployment type

• Cloud Foundry Application (cf push)
• Kubernetes, using a helm chart
• Docker, single container deploying all components
• npm run start
• Other (please specify below)

Backend (Jet Stream) Deployment type

• Cloud Foundry Application (cf push)
• Kubernetes, using a helm chart
• Docker, single container deploying all components
• Other (please specify below)

Expected behaviour

Configuring Kubernetes access in Stratos, I was wondering what minimum permissions a Kubernetes Service Account needs so that all Stratos views for Kubernetes resource work correctly. I checked the docs but couldn't find a description there.

Actual behaviour

So, I went ahead with assigning the cluster-admin ClusterRole to the default ServiceAccount:

cat <<EOF | kubectl apply -f -
kind: ClusterRoleBinding
apiVersion: rbac.authorization.k8s.io/v1beta1
metadata:
   name: stratos-default-cluster-admin-binding
   namespace: default
subjects:
 - kind: ServiceAccount
   name: default
   namespace: $MYNAMESPACE
roleRef:
   kind: ClusterRole
   name: cluster-admin
   apiGroup: rbac.authorization.k8s.io
EOF

but I'm hoping there's a chance to use Stratos with fewer permissions and ideally the docs/this repo would contain a description of what these permissions need to be.

Steps to reproduce the behavior

see above

Log output covering before error and any error statements

N/A

Detailed Description

Context

Possible Implementation

No file, test, or entry point is named in the issue. Start by locating Stratos's Kubernetes integration and existing permission documentation, then determine the permissions required by each Kubernetes view; done means documenting the minimum ServiceAccount permissions and validating them against the supported views.