(docs): Adding psp and admin-rbac note (#3130)
Signed-off-by: shubham chaudhary <shubham@chaosnative.com>
This commit is contained in:
Shubham Chaudhary
GitHub
parent
0018e11eab
commit
59ae7e7195
|
|
@ -45,58 +45,61 @@
|
|||
|
||||
## Minimal RBAC configuration example (optional)
|
||||
|
||||
??? note "View the Minimal RBAC permissions"
|
||||
!!! tip "NOTE"
|
||||
If you are using this experiment as part of a litmus workflow scheduled constructed & executed from chaos-center, then you may be making use of the [litmus-admin](https://litmuschaos.github.io/litmus/litmus-admin-rbac.yaml) RBAC, which is pre installed in the cluster as part of the agent setup.
|
||||
|
||||
[embedmd]:# (https://raw.githubusercontent.com/litmuschaos/chaos-charts/master/charts/aws-ssm/aws-ssm-chaos-by-id/rbac.yaml yaml)
|
||||
```yaml
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
name: aws-ssm-chaos-by-id-sa
|
||||
namespace: default
|
||||
labels:
|
||||
name: aws-ssm-chaos-by-id-sa
|
||||
app.kubernetes.io/part-of: litmus
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRole
|
||||
metadata:
|
||||
name: aws-ssm-chaos-by-id-sa
|
||||
labels:
|
||||
name: aws-ssm-chaos-by-id-sa
|
||||
app.kubernetes.io/part-of: litmus
|
||||
rules:
|
||||
- apiGroups: [""]
|
||||
resources: ["pods","events","secrets","configmaps"]
|
||||
verbs: ["create","list","get","patch","update","delete","deletecollection"]
|
||||
- apiGroups: [""]
|
||||
resources: ["pods/exec","pods/log"]
|
||||
verbs: ["create","list","get"]
|
||||
- apiGroups: ["batch"]
|
||||
resources: ["jobs"]
|
||||
verbs: ["create","list","get","delete","deletecollection"]
|
||||
- apiGroups: ["litmuschaos.io"]
|
||||
resources: ["chaosengines","chaosexperiments","chaosresults"]
|
||||
verbs: ["create","list","get","patch","update"]
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRoleBinding
|
||||
metadata:
|
||||
name: aws-ssm-chaos-by-id-sa
|
||||
labels:
|
||||
name: aws-ssm-chaos-by-id-sa
|
||||
app.kubernetes.io/part-of: litmus
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: ClusterRole
|
||||
name: aws-ssm-chaos-by-id-sa
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: aws-ssm-chaos-by-id-sa
|
||||
namespace: default
|
||||
```
|
||||
Use this sample RBAC manifest to create a chaosServiceAccount in the desired (app) namespace. This example consists of the minimum necessary role permissions to execute the experiment.
|
||||
??? note "View the Minimal RBAC permissions"
|
||||
|
||||
[embedmd]:# (https://raw.githubusercontent.com/litmuschaos/chaos-charts/master/charts/aws-ssm/aws-ssm-chaos-by-id/rbac.yaml yaml)
|
||||
```yaml
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
name: aws-ssm-chaos-by-id-sa
|
||||
namespace: default
|
||||
labels:
|
||||
name: aws-ssm-chaos-by-id-sa
|
||||
app.kubernetes.io/part-of: litmus
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRole
|
||||
metadata:
|
||||
name: aws-ssm-chaos-by-id-sa
|
||||
labels:
|
||||
name: aws-ssm-chaos-by-id-sa
|
||||
app.kubernetes.io/part-of: litmus
|
||||
rules:
|
||||
- apiGroups: [""]
|
||||
resources: ["pods","events","secrets","configmaps"]
|
||||
verbs: ["create","list","get","patch","update","delete","deletecollection"]
|
||||
- apiGroups: [""]
|
||||
resources: ["pods/exec","pods/log"]
|
||||
verbs: ["create","list","get"]
|
||||
- apiGroups: ["batch"]
|
||||
resources: ["jobs"]
|
||||
verbs: ["create","list","get","delete","deletecollection"]
|
||||
- apiGroups: ["litmuschaos.io"]
|
||||
resources: ["chaosengines","chaosexperiments","chaosresults"]
|
||||
verbs: ["create","list","get","patch","update"]
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRoleBinding
|
||||
metadata:
|
||||
name: aws-ssm-chaos-by-id-sa
|
||||
labels:
|
||||
name: aws-ssm-chaos-by-id-sa
|
||||
app.kubernetes.io/part-of: litmus
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: ClusterRole
|
||||
name: aws-ssm-chaos-by-id-sa
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: aws-ssm-chaos-by-id-sa
|
||||
namespace: default
|
||||
```
|
||||
Use this sample RBAC manifest to create a chaosServiceAccount in the desired (app) namespace. This example consists of the minimum necessary role permissions to execute the experiment.
|
||||
|
||||
## Experiment tunables
|
||||
|
||||
|
|
|
|||
|
|
@ -45,58 +45,61 @@
|
|||
|
||||
## Minimal RBAC configuration example (optional)
|
||||
|
||||
??? note "View the Minimal RBAC permissions"
|
||||
!!! tip "NOTE"
|
||||
If you are using this experiment as part of a litmus workflow scheduled constructed & executed from chaos-center, then you may be making use of the [litmus-admin](https://litmuschaos.github.io/litmus/litmus-admin-rbac.yaml) RBAC, which is pre installed in the cluster as part of the agent setup.
|
||||
|
||||
[embedmd]:# (https://raw.githubusercontent.com/litmuschaos/chaos-charts/master/charts/aws-ssm/aws-ssm-chaos-by-tag/rbac.yaml yaml)
|
||||
```yaml
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
name: aws-ssm-chaos-by-tag-sa
|
||||
namespace: default
|
||||
labels:
|
||||
name: aws-ssm-chaos-by-tag-sa
|
||||
app.kubernetes.io/part-of: litmus
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRole
|
||||
metadata:
|
||||
name: aws-ssm-chaos-by-tag-sa
|
||||
labels:
|
||||
name: aws-ssm-chaos-by-tag-sa
|
||||
app.kubernetes.io/part-of: litmus
|
||||
rules:
|
||||
- apiGroups: [""]
|
||||
resources: ["pods","events","secrets","configmaps"]
|
||||
verbs: ["create","list","get","patch","update","delete","deletecollection"]
|
||||
- apiGroups: [""]
|
||||
resources: ["pods/exec","pods/log"]
|
||||
verbs: ["create","list","get"]
|
||||
- apiGroups: ["batch"]
|
||||
resources: ["jobs"]
|
||||
verbs: ["create","list","get","delete","deletecollection"]
|
||||
- apiGroups: ["litmuschaos.io"]
|
||||
resources: ["chaosengines","chaosexperiments","chaosresults"]
|
||||
verbs: ["create","list","get","patch","update"]
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRoleBinding
|
||||
metadata:
|
||||
name: aws-ssm-chaos-by-tag-sa
|
||||
labels:
|
||||
name: aws-ssm-chaos-by-tag-sa
|
||||
app.kubernetes.io/part-of: litmus
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: ClusterRole
|
||||
name: aws-ssm-chaos-by-tag-sa
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: aws-ssm-chaos-by-tag-sa
|
||||
namespace: default
|
||||
```
|
||||
Use this sample RBAC manifest to create a chaosServiceAccount in the desired (app) namespace. This example consists of the minimum necessary role permissions to execute the experiment.
|
||||
??? note "View the Minimal RBAC permissions"
|
||||
|
||||
[embedmd]:# (https://raw.githubusercontent.com/litmuschaos/chaos-charts/master/charts/aws-ssm/aws-ssm-chaos-by-tag/rbac.yaml yaml)
|
||||
```yaml
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
name: aws-ssm-chaos-by-tag-sa
|
||||
namespace: default
|
||||
labels:
|
||||
name: aws-ssm-chaos-by-tag-sa
|
||||
app.kubernetes.io/part-of: litmus
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRole
|
||||
metadata:
|
||||
name: aws-ssm-chaos-by-tag-sa
|
||||
labels:
|
||||
name: aws-ssm-chaos-by-tag-sa
|
||||
app.kubernetes.io/part-of: litmus
|
||||
rules:
|
||||
- apiGroups: [""]
|
||||
resources: ["pods","events","secrets","configmaps"]
|
||||
verbs: ["create","list","get","patch","update","delete","deletecollection"]
|
||||
- apiGroups: [""]
|
||||
resources: ["pods/exec","pods/log"]
|
||||
verbs: ["create","list","get"]
|
||||
- apiGroups: ["batch"]
|
||||
resources: ["jobs"]
|
||||
verbs: ["create","list","get","delete","deletecollection"]
|
||||
- apiGroups: ["litmuschaos.io"]
|
||||
resources: ["chaosengines","chaosexperiments","chaosresults"]
|
||||
verbs: ["create","list","get","patch","update"]
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRoleBinding
|
||||
metadata:
|
||||
name: aws-ssm-chaos-by-tag-sa
|
||||
labels:
|
||||
name: aws-ssm-chaos-by-tag-sa
|
||||
app.kubernetes.io/part-of: litmus
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: ClusterRole
|
||||
name: aws-ssm-chaos-by-tag-sa
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: aws-ssm-chaos-by-tag-sa
|
||||
namespace: default
|
||||
```
|
||||
Use this sample RBAC manifest to create a chaosServiceAccount in the desired (app) namespace. This example consists of the minimum necessary role permissions to execute the experiment.
|
||||
|
||||
## Experiment tunables
|
||||
|
||||
|
|
|
|||
|
|
@ -14,7 +14,6 @@ Tests deployment sanity (replica availability & uninterrupted service) and recov
|
|||
|
||||
## Prerequisites
|
||||
|
||||
|
||||
??? info "Verify the prerequisites"
|
||||
- Ensure that Kubernetes Version > 1.16
|
||||
- Ensure that the Litmus Chaos Operator is running by executing <code>kubectl get pods</code> in operator namespace (typically, <code>litmus</code>).If not, install from <a herf="https://docs.litmuschaos.io/docs/getstarted/#install-litmus">here</a>
|
||||
|
|
@ -45,58 +44,61 @@ Tests deployment sanity (replica availability & uninterrupted service) and recov
|
|||
|
||||
## Minimal RBAC configuration example (optional)
|
||||
|
||||
??? note "View the Minimal RBAC permissions"
|
||||
!!! tip "NOTE"
|
||||
If you are using this experiment as part of a litmus workflow scheduled constructed & executed from chaos-center, then you may be making use of the [litmus-admin](https://litmuschaos.github.io/litmus/litmus-admin-rbac.yaml) RBAC, which is pre installed in the cluster as part of the agent setup.
|
||||
|
||||
[embedmd]:# (https://raw.githubusercontent.com/litmuschaos/chaos-charts/master/charts/kube-aws/ebs-loss-by-id/rbac.yaml yaml)
|
||||
```yaml
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
name: ebs-loss-by-id-sa
|
||||
namespace: default
|
||||
labels:
|
||||
name: ebs-loss-by-id-sa
|
||||
app.kubernetes.io/part-of: litmus
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRole
|
||||
metadata:
|
||||
name: ebs-loss-by-id-sa
|
||||
labels:
|
||||
name: ebs-loss-by-id-sa
|
||||
app.kubernetes.io/part-of: litmus
|
||||
rules:
|
||||
- apiGroups: [""]
|
||||
resources: ["pods","events","secrets"]
|
||||
verbs: ["create","list","get","patch","update","delete","deletecollection"]
|
||||
- apiGroups: [""]
|
||||
resources: ["pods/exec","pods/log"]
|
||||
verbs: ["create","list","get"]
|
||||
- apiGroups: ["batch"]
|
||||
resources: ["jobs"]
|
||||
verbs: ["create","list","get","delete","deletecollection"]
|
||||
- apiGroups: ["litmuschaos.io"]
|
||||
resources: ["chaosengines","chaosexperiments","chaosresults"]
|
||||
verbs: ["create","list","get","patch","update"]
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRoleBinding
|
||||
metadata:
|
||||
name: ebs-loss-by-id-sa
|
||||
labels:
|
||||
name: ebs-loss-by-id-sa
|
||||
app.kubernetes.io/part-of: litmus
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: ClusterRole
|
||||
name: ebs-loss-by-id-sa
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: ebs-loss-by-id-sa
|
||||
namespace: default
|
||||
```
|
||||
Use this sample RBAC manifest to create a chaosServiceAccount in the desired (app) namespace. This example consists of the minimum necessary role permissions to execute the experiment.
|
||||
??? note "View the Minimal RBAC permissions"
|
||||
|
||||
[embedmd]:# (https://raw.githubusercontent.com/litmuschaos/chaos-charts/master/charts/kube-aws/ebs-loss-by-id/rbac.yaml yaml)
|
||||
```yaml
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
name: ebs-loss-by-id-sa
|
||||
namespace: default
|
||||
labels:
|
||||
name: ebs-loss-by-id-sa
|
||||
app.kubernetes.io/part-of: litmus
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRole
|
||||
metadata:
|
||||
name: ebs-loss-by-id-sa
|
||||
labels:
|
||||
name: ebs-loss-by-id-sa
|
||||
app.kubernetes.io/part-of: litmus
|
||||
rules:
|
||||
- apiGroups: [""]
|
||||
resources: ["pods","events","secrets"]
|
||||
verbs: ["create","list","get","patch","update","delete","deletecollection"]
|
||||
- apiGroups: [""]
|
||||
resources: ["pods/exec","pods/log"]
|
||||
verbs: ["create","list","get"]
|
||||
- apiGroups: ["batch"]
|
||||
resources: ["jobs"]
|
||||
verbs: ["create","list","get","delete","deletecollection"]
|
||||
- apiGroups: ["litmuschaos.io"]
|
||||
resources: ["chaosengines","chaosexperiments","chaosresults"]
|
||||
verbs: ["create","list","get","patch","update"]
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRoleBinding
|
||||
metadata:
|
||||
name: ebs-loss-by-id-sa
|
||||
labels:
|
||||
name: ebs-loss-by-id-sa
|
||||
app.kubernetes.io/part-of: litmus
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: ClusterRole
|
||||
name: ebs-loss-by-id-sa
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: ebs-loss-by-id-sa
|
||||
namespace: default
|
||||
```
|
||||
Use this sample RBAC manifest to create a chaosServiceAccount in the desired (app) namespace. This example consists of the minimum necessary role permissions to execute the experiment.
|
||||
|
||||
## Experiment tunables
|
||||
|
||||
|
|
|
|||
|
|
@ -44,58 +44,61 @@ Tests deployment sanity (replica availability & uninterrupted service) and recov
|
|||
|
||||
## Minimal RBAC configuration example (optional)
|
||||
|
||||
??? note "View the Minimal RBAC permissions"
|
||||
!!! tip "NOTE"
|
||||
If you are using this experiment as part of a litmus workflow scheduled constructed & executed from chaos-center, then you may be making use of the [litmus-admin](https://litmuschaos.github.io/litmus/litmus-admin-rbac.yaml) RBAC, which is pre installed in the cluster as part of the agent setup.
|
||||
|
||||
[embedmd]:# (https://raw.githubusercontent.com/litmuschaos/chaos-charts/master/charts/kube-aws/ebs-loss-by-tag/rbac.yaml yaml)
|
||||
```yaml
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
name: ebs-loss-by-tag-sa
|
||||
namespace: default
|
||||
labels:
|
||||
name: ebs-loss-by-tag-sa
|
||||
app.kubernetes.io/part-of: litmus
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRole
|
||||
metadata:
|
||||
name: ebs-loss-by-tag-sa
|
||||
labels:
|
||||
name: ebs-loss-by-tag-sa
|
||||
app.kubernetes.io/part-of: litmus
|
||||
rules:
|
||||
- apiGroups: [""]
|
||||
resources: ["pods","events","secrets"]
|
||||
verbs: ["create","list","get","patch","update","delete","deletecollection"]
|
||||
- apiGroups: [""]
|
||||
resources: ["pods/exec","pods/log"]
|
||||
verbs: ["create","list","get"]
|
||||
- apiGroups: ["batch"]
|
||||
resources: ["jobs"]
|
||||
verbs: ["create","list","get","delete","deletecollection"]
|
||||
- apiGroups: ["litmuschaos.io"]
|
||||
resources: ["chaosengines","chaosexperiments","chaosresults"]
|
||||
verbs: ["create","list","get","patch","update"]
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRoleBinding
|
||||
metadata:
|
||||
name: ebs-loss-by-tag-sa
|
||||
labels:
|
||||
name: ebs-loss-by-tag-sa
|
||||
app.kubernetes.io/part-of: litmus
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: ClusterRole
|
||||
name: ebs-loss-by-tag-sa
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: ebs-loss-by-tag-sa
|
||||
namespace: default
|
||||
```
|
||||
Use this sample RBAC manifest to create a chaosServiceAccount in the desired (app) namespace. This example consists of the minimum necessary role permissions to execute the experiment.
|
||||
??? note "View the Minimal RBAC permissions"
|
||||
|
||||
[embedmd]:# (https://raw.githubusercontent.com/litmuschaos/chaos-charts/master/charts/kube-aws/ebs-loss-by-tag/rbac.yaml yaml)
|
||||
```yaml
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
name: ebs-loss-by-tag-sa
|
||||
namespace: default
|
||||
labels:
|
||||
name: ebs-loss-by-tag-sa
|
||||
app.kubernetes.io/part-of: litmus
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRole
|
||||
metadata:
|
||||
name: ebs-loss-by-tag-sa
|
||||
labels:
|
||||
name: ebs-loss-by-tag-sa
|
||||
app.kubernetes.io/part-of: litmus
|
||||
rules:
|
||||
- apiGroups: [""]
|
||||
resources: ["pods","events","secrets"]
|
||||
verbs: ["create","list","get","patch","update","delete","deletecollection"]
|
||||
- apiGroups: [""]
|
||||
resources: ["pods/exec","pods/log"]
|
||||
verbs: ["create","list","get"]
|
||||
- apiGroups: ["batch"]
|
||||
resources: ["jobs"]
|
||||
verbs: ["create","list","get","delete","deletecollection"]
|
||||
- apiGroups: ["litmuschaos.io"]
|
||||
resources: ["chaosengines","chaosexperiments","chaosresults"]
|
||||
verbs: ["create","list","get","patch","update"]
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRoleBinding
|
||||
metadata:
|
||||
name: ebs-loss-by-tag-sa
|
||||
labels:
|
||||
name: ebs-loss-by-tag-sa
|
||||
app.kubernetes.io/part-of: litmus
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: ClusterRole
|
||||
name: ebs-loss-by-tag-sa
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: ebs-loss-by-tag-sa
|
||||
namespace: default
|
||||
```
|
||||
Use this sample RBAC manifest to create a chaosServiceAccount in the desired (app) namespace. This example consists of the minimum necessary role permissions to execute the experiment.
|
||||
|
||||
## Experiment tunables
|
||||
|
||||
|
|
|
|||
|
|
@ -14,7 +14,6 @@ When the MANAGED_NODEGROUP is enable then the experiment will not try to start t
|
|||
|
||||
## Prerequisites
|
||||
|
||||
|
||||
??? info "Verify the prerequisites"
|
||||
- Ensure that Kubernetes Version > 1.16
|
||||
- Ensure that the Litmus Chaos Operator is running by executing <code>kubectl get pods</code> in operator namespace (typically, <code>litmus</code>).If not, install from <a herf="https://docs.litmuschaos.io/docs/getstarted/#install-litmus">here</a>
|
||||
|
|
@ -50,61 +49,64 @@ When the MANAGED_NODEGROUP is enable then the experiment will not try to start t
|
|||
|
||||
## Minimal RBAC configuration example (optional)
|
||||
|
||||
??? note "View the Minimal RBAC permissions"
|
||||
!!! tip "NOTE"
|
||||
If you are using this experiment as part of a litmus workflow scheduled constructed & executed from chaos-center, then you may be making use of the [litmus-admin](https://litmuschaos.github.io/litmus/litmus-admin-rbac.yaml) RBAC, which is pre installed in the cluster as part of the agent setup.
|
||||
|
||||
[embedmd]:# (https://raw.githubusercontent.com/litmuschaos/chaos-charts/master/charts/kube-aws/ec2-terminate-by-id/rbac.yaml yaml)
|
||||
```yaml
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
name: ec2-terminate-by-id-sa
|
||||
namespace: default
|
||||
labels:
|
||||
name: ec2-terminate-by-id-sa
|
||||
app.kubernetes.io/part-of: litmus
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRole
|
||||
metadata:
|
||||
name: ec2-terminate-by-id-sa
|
||||
labels:
|
||||
name: ec2-terminate-by-id-sa
|
||||
app.kubernetes.io/part-of: litmus
|
||||
rules:
|
||||
- apiGroups: [""]
|
||||
resources: ["pods","events","secrets"]
|
||||
verbs: ["create","list","get","patch","update","delete","deletecollection"]
|
||||
- apiGroups: [""]
|
||||
resources: ["pods/exec","pods/log"]
|
||||
verbs: ["create","list","get"]
|
||||
- apiGroups: ["batch"]
|
||||
resources: ["jobs"]
|
||||
verbs: ["create","list","get","delete","deletecollection"]
|
||||
- apiGroups: ["litmuschaos.io"]
|
||||
resources: ["chaosengines","chaosexperiments","chaosresults"]
|
||||
verbs: ["create","list","get","patch","update"]
|
||||
- apiGroups: [""]
|
||||
resources: ["nodes"]
|
||||
verbs: ["patch","get","list"]
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRoleBinding
|
||||
metadata:
|
||||
name: ec2-terminate-by-id-sa
|
||||
labels:
|
||||
name: ec2-terminate-by-id-sa
|
||||
app.kubernetes.io/part-of: litmus
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: ClusterRole
|
||||
name: ec2-terminate-by-id-sa
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: ec2-terminate-by-id-sa
|
||||
namespace: default
|
||||
```
|
||||
Use this sample RBAC manifest to create a chaosServiceAccount in the desired (app) namespace. This example consists of the minimum necessary role permissions to execute the experiment.
|
||||
??? note "View the Minimal RBAC permissions"
|
||||
|
||||
[embedmd]:# (https://raw.githubusercontent.com/litmuschaos/chaos-charts/master/charts/kube-aws/ec2-terminate-by-id/rbac.yaml yaml)
|
||||
```yaml
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
name: ec2-terminate-by-id-sa
|
||||
namespace: default
|
||||
labels:
|
||||
name: ec2-terminate-by-id-sa
|
||||
app.kubernetes.io/part-of: litmus
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRole
|
||||
metadata:
|
||||
name: ec2-terminate-by-id-sa
|
||||
labels:
|
||||
name: ec2-terminate-by-id-sa
|
||||
app.kubernetes.io/part-of: litmus
|
||||
rules:
|
||||
- apiGroups: [""]
|
||||
resources: ["pods","events","secrets"]
|
||||
verbs: ["create","list","get","patch","update","delete","deletecollection"]
|
||||
- apiGroups: [""]
|
||||
resources: ["pods/exec","pods/log"]
|
||||
verbs: ["create","list","get"]
|
||||
- apiGroups: ["batch"]
|
||||
resources: ["jobs"]
|
||||
verbs: ["create","list","get","delete","deletecollection"]
|
||||
- apiGroups: ["litmuschaos.io"]
|
||||
resources: ["chaosengines","chaosexperiments","chaosresults"]
|
||||
verbs: ["create","list","get","patch","update"]
|
||||
- apiGroups: [""]
|
||||
resources: ["nodes"]
|
||||
verbs: ["patch","get","list"]
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRoleBinding
|
||||
metadata:
|
||||
name: ec2-terminate-by-id-sa
|
||||
labels:
|
||||
name: ec2-terminate-by-id-sa
|
||||
app.kubernetes.io/part-of: litmus
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: ClusterRole
|
||||
name: ec2-terminate-by-id-sa
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: ec2-terminate-by-id-sa
|
||||
namespace: default
|
||||
```
|
||||
Use this sample RBAC manifest to create a chaosServiceAccount in the desired (app) namespace. This example consists of the minimum necessary role permissions to execute the experiment.
|
||||
|
||||
## Experiment tunables
|
||||
|
||||
|
|
|
|||
|
|
@ -14,7 +14,6 @@ When the MANAGED_NODEGROUP is enable then the experiment will not try to start t
|
|||
|
||||
## Prerequisites
|
||||
|
||||
|
||||
??? info "Verify the prerequisites"
|
||||
- Ensure that Kubernetes Version > 1.16
|
||||
- Ensure that the Litmus Chaos Operator is running by executing <code>kubectl get pods</code> in operator namespace (typically, <code>litmus</code>).If not, install from <a herf="https://docs.litmuschaos.io/docs/getstarted/#install-litmus">here</a>
|
||||
|
|
@ -50,61 +49,64 @@ When the MANAGED_NODEGROUP is enable then the experiment will not try to start t
|
|||
|
||||
## Minimal RBAC configuration example (optional)
|
||||
|
||||
??? note "View the Minimal RBAC permissions"
|
||||
!!! tip "NOTE"
|
||||
If you are using this experiment as part of a litmus workflow scheduled constructed & executed from chaos-center, then you may be making use of the [litmus-admin](https://litmuschaos.github.io/litmus/litmus-admin-rbac.yaml) RBAC, which is pre installed in the cluster as part of the agent setup.
|
||||
|
||||
[embedmd]:# (https://raw.githubusercontent.com/litmuschaos/chaos-charts/master/charts/kube-aws/ec2-terminate-by-tag/rbac.yaml yaml)
|
||||
```yaml
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
name: ec2-terminate-by-tag-sa
|
||||
namespace: default
|
||||
labels:
|
||||
name: ec2-terminate-by-tag-sa
|
||||
app.kubernetes.io/part-of: litmus
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRole
|
||||
metadata:
|
||||
name: ec2-terminate-by-tag-sa
|
||||
labels:
|
||||
name: ec2-terminate-by-tag-sa
|
||||
app.kubernetes.io/part-of: litmus
|
||||
rules:
|
||||
- apiGroups: [""]
|
||||
resources: ["pods","events","secrets"]
|
||||
verbs: ["create","list","get","patch","update","delete","deletecollection"]
|
||||
- apiGroups: [""]
|
||||
resources: ["pods/exec","pods/log"]
|
||||
verbs: ["create","list","get"]
|
||||
- apiGroups: ["batch"]
|
||||
resources: ["jobs"]
|
||||
verbs: ["create","list","get","delete","deletecollection"]
|
||||
- apiGroups: ["litmuschaos.io"]
|
||||
resources: ["chaosengines","chaosexperiments","chaosresults"]
|
||||
verbs: ["create","list","get","patch","update"]
|
||||
- apiGroups: [""]
|
||||
resources: ["nodes"]
|
||||
verbs: ["patch","get","list"]
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRoleBinding
|
||||
metadata:
|
||||
name: ec2-terminate-by-tag-sa
|
||||
labels:
|
||||
name: ec2-terminate-by-tag-sa
|
||||
app.kubernetes.io/part-of: litmus
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: ClusterRole
|
||||
name: ec2-terminate-by-tag-sa
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: ec2-terminate-by-tag-sa
|
||||
namespace: default
|
||||
```
|
||||
Use this sample RBAC manifest to create a chaosServiceAccount in the desired (app) namespace. This example consists of the minimum necessary role permissions to execute the experiment.
|
||||
??? note "View the Minimal RBAC permissions"
|
||||
|
||||
[embedmd]:# (https://raw.githubusercontent.com/litmuschaos/chaos-charts/master/charts/kube-aws/ec2-terminate-by-tag/rbac.yaml yaml)
|
||||
```yaml
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
name: ec2-terminate-by-tag-sa
|
||||
namespace: default
|
||||
labels:
|
||||
name: ec2-terminate-by-tag-sa
|
||||
app.kubernetes.io/part-of: litmus
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRole
|
||||
metadata:
|
||||
name: ec2-terminate-by-tag-sa
|
||||
labels:
|
||||
name: ec2-terminate-by-tag-sa
|
||||
app.kubernetes.io/part-of: litmus
|
||||
rules:
|
||||
- apiGroups: [""]
|
||||
resources: ["pods","events","secrets"]
|
||||
verbs: ["create","list","get","patch","update","delete","deletecollection"]
|
||||
- apiGroups: [""]
|
||||
resources: ["pods/exec","pods/log"]
|
||||
verbs: ["create","list","get"]
|
||||
- apiGroups: ["batch"]
|
||||
resources: ["jobs"]
|
||||
verbs: ["create","list","get","delete","deletecollection"]
|
||||
- apiGroups: ["litmuschaos.io"]
|
||||
resources: ["chaosengines","chaosexperiments","chaosresults"]
|
||||
verbs: ["create","list","get","patch","update"]
|
||||
- apiGroups: [""]
|
||||
resources: ["nodes"]
|
||||
verbs: ["patch","get","list"]
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRoleBinding
|
||||
metadata:
|
||||
name: ec2-terminate-by-tag-sa
|
||||
labels:
|
||||
name: ec2-terminate-by-tag-sa
|
||||
app.kubernetes.io/part-of: litmus
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: ClusterRole
|
||||
name: ec2-terminate-by-tag-sa
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: ec2-terminate-by-tag-sa
|
||||
namespace: default
|
||||
```
|
||||
Use this sample RBAC manifest to create a chaosServiceAccount in the desired (app) namespace. This example consists of the minimum necessary role permissions to execute the experiment.
|
||||
|
||||
## Experiment tunables
|
||||
|
||||
|
|
|
|||
|
|
@ -13,7 +13,6 @@
|
|||
|
||||
## Prerequisites
|
||||
|
||||
|
||||
??? info "Verify the prerequisites"
|
||||
- Ensure that Kubernetes Version > 1.16
|
||||
- Ensure that the Litmus Chaos Operator is running by executing <code>kubectl get pods</code> in operator namespace (typically, <code>litmus</code>).If not, install from <a herf="https://docs.litmuschaos.io/docs/getstarted/#install-litmus">here</a>
|
||||
|
|
@ -53,58 +52,61 @@
|
|||
|
||||
## Minimal RBAC configuration example (optional)
|
||||
|
||||
??? note "View the Minimal RBAC permissions"
|
||||
!!! tip "NOTE"
|
||||
If you are using this experiment as part of a litmus workflow scheduled constructed & executed from chaos-center, then you may be making use of the [litmus-admin](https://litmuschaos.github.io/litmus/litmus-admin-rbac.yaml) RBAC, which is pre installed in the cluster as part of the agent setup.
|
||||
|
||||
[embedmd]:# (https://raw.githubusercontent.com/litmuschaos/chaos-charts/master/charts/azure/azure-instance-stop/rbac.yaml yaml)
|
||||
```yaml
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
name: azure-instance-stop-sa
|
||||
namespace: default
|
||||
labels:
|
||||
name: azure-instance-stop-sa
|
||||
app.kubernetes.io/part-of: litmus
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRole
|
||||
metadata:
|
||||
name: azure-instance-stop-sa
|
||||
labels:
|
||||
name: azure-instance-stop-sa
|
||||
app.kubernetes.io/part-of: litmus
|
||||
rules:
|
||||
- apiGroups: [""]
|
||||
resources: ["pods","events","secrets"]
|
||||
verbs: ["create","list","get","patch","update","delete","deletecollection"]
|
||||
- apiGroups: [""]
|
||||
resources: ["pods/exec","pods/log"]
|
||||
verbs: ["create","list","get"]
|
||||
- apiGroups: ["batch"]
|
||||
resources: ["jobs"]
|
||||
verbs: ["create","list","get","delete","deletecollection"]
|
||||
- apiGroups: ["litmuschaos.io"]
|
||||
resources: ["chaosengines","chaosexperiments","chaosresults"]
|
||||
verbs: ["create","list","get","patch","update"]
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRoleBinding
|
||||
metadata:
|
||||
name: azure-instance-stop-sa
|
||||
labels:
|
||||
name: azure-instance-stop-sa
|
||||
app.kubernetes.io/part-of: litmus
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: ClusterRole
|
||||
name: azure-instance-stop-sa
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: azure-instance-stop-sa
|
||||
namespace: default
|
||||
```
|
||||
Use this sample RBAC manifest to create a chaosServiceAccount in the desired (app) namespace. This example consists of the minimum necessary role permissions to execute the experiment.
|
||||
??? note "View the Minimal RBAC permissions"
|
||||
|
||||
[embedmd]:# (https://raw.githubusercontent.com/litmuschaos/chaos-charts/master/charts/azure/azure-instance-stop/rbac.yaml yaml)
|
||||
```yaml
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
name: azure-instance-stop-sa
|
||||
namespace: default
|
||||
labels:
|
||||
name: azure-instance-stop-sa
|
||||
app.kubernetes.io/part-of: litmus
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRole
|
||||
metadata:
|
||||
name: azure-instance-stop-sa
|
||||
labels:
|
||||
name: azure-instance-stop-sa
|
||||
app.kubernetes.io/part-of: litmus
|
||||
rules:
|
||||
- apiGroups: [""]
|
||||
resources: ["pods","events","secrets"]
|
||||
verbs: ["create","list","get","patch","update","delete","deletecollection"]
|
||||
- apiGroups: [""]
|
||||
resources: ["pods/exec","pods/log"]
|
||||
verbs: ["create","list","get"]
|
||||
- apiGroups: ["batch"]
|
||||
resources: ["jobs"]
|
||||
verbs: ["create","list","get","delete","deletecollection"]
|
||||
- apiGroups: ["litmuschaos.io"]
|
||||
resources: ["chaosengines","chaosexperiments","chaosresults"]
|
||||
verbs: ["create","list","get","patch","update"]
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRoleBinding
|
||||
metadata:
|
||||
name: azure-instance-stop-sa
|
||||
labels:
|
||||
name: azure-instance-stop-sa
|
||||
app.kubernetes.io/part-of: litmus
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: ClusterRole
|
||||
name: azure-instance-stop-sa
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: azure-instance-stop-sa
|
||||
namespace: default
|
||||
```
|
||||
Use this sample RBAC manifest to create a chaosServiceAccount in the desired (app) namespace. This example consists of the minimum necessary role permissions to execute the experiment.
|
||||
|
||||
## Experiment tunables
|
||||
|
||||
|
|
|
|||
|
|
@ -13,7 +13,6 @@
|
|||
|
||||
## Prerequisites
|
||||
|
||||
|
||||
??? info "Verify the prerequisites"
|
||||
- Ensure that Kubernetes Version > 1.16
|
||||
- Ensure that the Litmus Chaos Operator is running by executing <code>kubectl get pods</code> in operator namespace (typically, <code>litmus</code>).If not, install from <a herf="https://docs.litmuschaos.io/docs/getstarted/#install-litmus">here</a>
|
||||
|
|
@ -27,64 +26,67 @@
|
|||
|
||||
## Minimal RBAC configuration example (optional)
|
||||
|
||||
??? note "View the Minimal RBAC permissions"
|
||||
!!! tip "NOTE"
|
||||
If you are using this experiment as part of a litmus workflow scheduled constructed & executed from chaos-center, then you may be making use of the [litmus-admin](https://litmuschaos.github.io/litmus/litmus-admin-rbac.yaml) RBAC, which is pre installed in the cluster as part of the agent setup.
|
||||
|
||||
[embedmd]:# (https://raw.githubusercontent.com/litmuschaos/chaos-charts/master/charts/cassandra/cassandra-pod-delete/rbac.yaml yaml)
|
||||
```yaml
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
name: kafka-broker-pod-failure-sa
|
||||
namespace: default
|
||||
labels:
|
||||
name: kafka-broker-pod-failure-sa
|
||||
app.kubernetes.io/part-of: litmus
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRole
|
||||
metadata:
|
||||
name: kafka-broker-pod-failure-sa
|
||||
labels:
|
||||
name: kafka-broker-pod-failure-sa
|
||||
app.kubernetes.io/part-of: litmus
|
||||
rules:
|
||||
- apiGroups: [""]
|
||||
resources: ["pods","events"]
|
||||
verbs: ["create","list","get","patch","update","delete","deletecollection"]
|
||||
- apiGroups: [""]
|
||||
resources: ["pods/exec","pods/log"]
|
||||
verbs: ["create","list","get"]
|
||||
- apiGroups: ["batch"]
|
||||
resources: ["jobs"]
|
||||
verbs: ["create","list","get","delete","deletecollection"]
|
||||
- apiGroups: ["apps"]
|
||||
resources: ["deployments","statefulsets"]
|
||||
verbs: ["list","get"]
|
||||
- apiGroups: ["litmuschaos.io"]
|
||||
resources: ["chaosengines","chaosexperiments","chaosresults"]
|
||||
verbs: ["create","list","get","patch","update"]
|
||||
- apiGroups: [""]
|
||||
resources: ["nodes"]
|
||||
verbs: ["get","list"]
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRoleBinding
|
||||
metadata:
|
||||
name: kafka-broker-pod-failure-sa
|
||||
labels:
|
||||
name: kafka-broker-pod-failure-sa
|
||||
app.kubernetes.io/part-of: litmus
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: ClusterRole
|
||||
name: kafka-broker-pod-failure-sa
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: kafka-broker-pod-failure-sa
|
||||
namespace: default
|
||||
```
|
||||
Use this sample RBAC manifest to create a chaosServiceAccount in the desired (app) namespace. This example consists of the minimum necessary role permissions to execute the experiment.
|
||||
??? note "View the Minimal RBAC permissions"
|
||||
|
||||
[embedmd]:# (https://raw.githubusercontent.com/litmuschaos/chaos-charts/master/charts/cassandra/cassandra-pod-delete/rbac.yaml yaml)
|
||||
```yaml
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
name: kafka-broker-pod-failure-sa
|
||||
namespace: default
|
||||
labels:
|
||||
name: kafka-broker-pod-failure-sa
|
||||
app.kubernetes.io/part-of: litmus
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRole
|
||||
metadata:
|
||||
name: kafka-broker-pod-failure-sa
|
||||
labels:
|
||||
name: kafka-broker-pod-failure-sa
|
||||
app.kubernetes.io/part-of: litmus
|
||||
rules:
|
||||
- apiGroups: [""]
|
||||
resources: ["pods","events"]
|
||||
verbs: ["create","list","get","patch","update","delete","deletecollection"]
|
||||
- apiGroups: [""]
|
||||
resources: ["pods/exec","pods/log"]
|
||||
verbs: ["create","list","get"]
|
||||
- apiGroups: ["batch"]
|
||||
resources: ["jobs"]
|
||||
verbs: ["create","list","get","delete","deletecollection"]
|
||||
- apiGroups: ["apps"]
|
||||
resources: ["deployments","statefulsets"]
|
||||
verbs: ["list","get"]
|
||||
- apiGroups: ["litmuschaos.io"]
|
||||
resources: ["chaosengines","chaosexperiments","chaosresults"]
|
||||
verbs: ["create","list","get","patch","update"]
|
||||
- apiGroups: [""]
|
||||
resources: ["nodes"]
|
||||
verbs: ["get","list"]
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRoleBinding
|
||||
metadata:
|
||||
name: kafka-broker-pod-failure-sa
|
||||
labels:
|
||||
name: kafka-broker-pod-failure-sa
|
||||
app.kubernetes.io/part-of: litmus
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: ClusterRole
|
||||
name: kafka-broker-pod-failure-sa
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: kafka-broker-pod-failure-sa
|
||||
namespace: default
|
||||
```
|
||||
Use this sample RBAC manifest to create a chaosServiceAccount in the desired (app) namespace. This example consists of the minimum necessary role permissions to execute the experiment.
|
||||
|
||||
## Experiment tunables
|
||||
|
||||
|
|
|
|||
|
|
@ -46,58 +46,61 @@
|
|||
|
||||
## Minimal RBAC configuration example (optional)
|
||||
|
||||
??? note "View the Minimal RBAC permissions"
|
||||
!!! tip "NOTE"
|
||||
If you are using this experiment as part of a litmus workflow scheduled constructed & executed from chaos-center, then you may be making use of the [litmus-admin](https://litmuschaos.github.io/litmus/litmus-admin-rbac.yaml) RBAC, which is pre installed in the cluster as part of the agent setup.
|
||||
|
||||
[embedmd]:# (https://raw.githubusercontent.com/litmuschaos/chaos-charts/master/charts/gcp/gcp-vm-disk-loss/rbac.yaml yaml)
|
||||
```yaml
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
name: gcp-vm-disk-loss-sa
|
||||
namespace: default
|
||||
labels:
|
||||
name: gcp-vm-disk-loss-sa
|
||||
app.kubernetes.io/part-of: litmus
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRole
|
||||
metadata:
|
||||
name: gcp-vm-disk-loss-sa
|
||||
labels:
|
||||
name: gcp-vm-disk-loss-sa
|
||||
app.kubernetes.io/part-of: litmus
|
||||
rules:
|
||||
- apiGroups: [""]
|
||||
resources: ["pods","events","secrets"]
|
||||
verbs: ["create","list","get","patch","update","delete","deletecollection"]
|
||||
- apiGroups: [""]
|
||||
resources: ["pods/exec","pods/log"]
|
||||
verbs: ["create","list","get"]
|
||||
- apiGroups: ["batch"]
|
||||
resources: ["jobs"]
|
||||
verbs: ["create","list","get","delete","deletecollection"]
|
||||
- apiGroups: ["litmuschaos.io"]
|
||||
resources: ["chaosengines","chaosexperiments","chaosresults"]
|
||||
verbs: ["create","list","get","patch","update"]
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRoleBinding
|
||||
metadata:
|
||||
name: gcp-vm-disk-loss-sa
|
||||
labels:
|
||||
name: gcp-vm-disk-loss-sa
|
||||
app.kubernetes.io/part-of: litmus
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: ClusterRole
|
||||
name: gcp-vm-disk-loss-sa
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: gcp-vm-disk-loss-sa
|
||||
namespace: default
|
||||
```
|
||||
Use this sample RBAC manifest to create a chaosServiceAccount in the desired (app) namespace. This example consists of the minimum necessary role permissions to execute the experiment.
|
||||
??? note "View the Minimal RBAC permissions"
|
||||
|
||||
[embedmd]:# (https://raw.githubusercontent.com/litmuschaos/chaos-charts/master/charts/gcp/gcp-vm-disk-loss/rbac.yaml yaml)
|
||||
```yaml
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
name: gcp-vm-disk-loss-sa
|
||||
namespace: default
|
||||
labels:
|
||||
name: gcp-vm-disk-loss-sa
|
||||
app.kubernetes.io/part-of: litmus
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRole
|
||||
metadata:
|
||||
name: gcp-vm-disk-loss-sa
|
||||
labels:
|
||||
name: gcp-vm-disk-loss-sa
|
||||
app.kubernetes.io/part-of: litmus
|
||||
rules:
|
||||
- apiGroups: [""]
|
||||
resources: ["pods","events","secrets"]
|
||||
verbs: ["create","list","get","patch","update","delete","deletecollection"]
|
||||
- apiGroups: [""]
|
||||
resources: ["pods/exec","pods/log"]
|
||||
verbs: ["create","list","get"]
|
||||
- apiGroups: ["batch"]
|
||||
resources: ["jobs"]
|
||||
verbs: ["create","list","get","delete","deletecollection"]
|
||||
- apiGroups: ["litmuschaos.io"]
|
||||
resources: ["chaosengines","chaosexperiments","chaosresults"]
|
||||
verbs: ["create","list","get","patch","update"]
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRoleBinding
|
||||
metadata:
|
||||
name: gcp-vm-disk-loss-sa
|
||||
labels:
|
||||
name: gcp-vm-disk-loss-sa
|
||||
app.kubernetes.io/part-of: litmus
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: ClusterRole
|
||||
name: gcp-vm-disk-loss-sa
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: gcp-vm-disk-loss-sa
|
||||
namespace: default
|
||||
```
|
||||
Use this sample RBAC manifest to create a chaosServiceAccount in the desired (app) namespace. This example consists of the minimum necessary role permissions to execute the experiment.
|
||||
|
||||
## Experiment tunables
|
||||
|
||||
|
|
|
|||
|
|
@ -47,61 +47,64 @@
|
|||
|
||||
## Minimal RBAC configuration example (optional)
|
||||
|
||||
??? note "View the Minimal RBAC permissions"
|
||||
!!! tip "NOTE"
|
||||
If you are using this experiment as part of a litmus workflow scheduled constructed & executed from chaos-center, then you may be making use of the [litmus-admin](https://litmuschaos.github.io/litmus/litmus-admin-rbac.yaml) RBAC, which is pre installed in the cluster as part of the agent setup.
|
||||
|
||||
[embedmd]:# (https://raw.githubusercontent.com/litmuschaos/chaos-charts/master/charts/gcp/gcp-vm-instance-stop/rbac.yaml yaml)
|
||||
```yaml
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
name: gcp-vm-instance-stop-sa
|
||||
namespace: default
|
||||
labels:
|
||||
name: gcp-vm-instance-stop-sa
|
||||
app.kubernetes.io/part-of: litmus
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRole
|
||||
metadata:
|
||||
name: gcp-vm-instance-stop-sa
|
||||
labels:
|
||||
name: gcp-vm-instance-stop-sa
|
||||
app.kubernetes.io/part-of: litmus
|
||||
rules:
|
||||
- apiGroups: [""]
|
||||
resources: ["pods","events","secrets"]
|
||||
verbs: ["create","list","get","patch","update","delete","deletecollection"]
|
||||
- apiGroups: [""]
|
||||
resources: ["pods/exec","pods/log"]
|
||||
verbs: ["create","list","get"]
|
||||
- apiGroups: ["batch"]
|
||||
resources: ["jobs"]
|
||||
verbs: ["create","list","get","delete","deletecollection"]
|
||||
- apiGroups: ["litmuschaos.io"]
|
||||
resources: ["chaosengines","chaosexperiments","chaosresults"]
|
||||
verbs: ["create","list","get","patch","update"]
|
||||
- apiGroups: [""]
|
||||
resources: ["nodes"]
|
||||
verbs: ["get","list"]
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRoleBinding
|
||||
metadata:
|
||||
name: gcp-vm-instance-stop-sa
|
||||
labels:
|
||||
name: gcp-vm-instance-stop-sa
|
||||
app.kubernetes.io/part-of: litmus
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: ClusterRole
|
||||
name: gcp-vm-instance-stop-sa
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: gcp-vm-instance-stop-sa
|
||||
namespace: default
|
||||
```
|
||||
Use this sample RBAC manifest to create a chaosServiceAccount in the desired (app) namespace. This example consists of the minimum necessary role permissions to execute the experiment.
|
||||
??? note "View the Minimal RBAC permissions"
|
||||
|
||||
[embedmd]:# (https://raw.githubusercontent.com/litmuschaos/chaos-charts/master/charts/gcp/gcp-vm-instance-stop/rbac.yaml yaml)
|
||||
```yaml
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
name: gcp-vm-instance-stop-sa
|
||||
namespace: default
|
||||
labels:
|
||||
name: gcp-vm-instance-stop-sa
|
||||
app.kubernetes.io/part-of: litmus
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRole
|
||||
metadata:
|
||||
name: gcp-vm-instance-stop-sa
|
||||
labels:
|
||||
name: gcp-vm-instance-stop-sa
|
||||
app.kubernetes.io/part-of: litmus
|
||||
rules:
|
||||
- apiGroups: [""]
|
||||
resources: ["pods","events","secrets"]
|
||||
verbs: ["create","list","get","patch","update","delete","deletecollection"]
|
||||
- apiGroups: [""]
|
||||
resources: ["pods/exec","pods/log"]
|
||||
verbs: ["create","list","get"]
|
||||
- apiGroups: ["batch"]
|
||||
resources: ["jobs"]
|
||||
verbs: ["create","list","get","delete","deletecollection"]
|
||||
- apiGroups: ["litmuschaos.io"]
|
||||
resources: ["chaosengines","chaosexperiments","chaosresults"]
|
||||
verbs: ["create","list","get","patch","update"]
|
||||
- apiGroups: [""]
|
||||
resources: ["nodes"]
|
||||
verbs: ["get","list"]
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRoleBinding
|
||||
metadata:
|
||||
name: gcp-vm-instance-stop-sa
|
||||
labels:
|
||||
name: gcp-vm-instance-stop-sa
|
||||
app.kubernetes.io/part-of: litmus
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: ClusterRole
|
||||
name: gcp-vm-instance-stop-sa
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: gcp-vm-instance-stop-sa
|
||||
namespace: default
|
||||
```
|
||||
Use this sample RBAC manifest to create a chaosServiceAccount in the desired (app) namespace. This example consists of the minimum necessary role permissions to execute the experiment.
|
||||
|
||||
## Experiment tunables
|
||||
|
||||
|
|
|
|||
|
|
@ -14,7 +14,6 @@
|
|||
|
||||
## Prerequisites
|
||||
|
||||
|
||||
??? info "Verify the prerequisites"
|
||||
- Ensure that Kubernetes Version > 1.16
|
||||
- Ensure that the Litmus Chaos Operator is running by executing <code>kubectl get pods</code> in operator namespace (typically, <code>litmus</code>).If not, install from <a herf="https://docs.litmuschaos.io/docs/getstarted/#install-litmus">here</a>
|
||||
|
|
@ -34,64 +33,67 @@
|
|||
|
||||
## Minimal RBAC configuration example (optional)
|
||||
|
||||
??? note "View the Minimal RBAC permissions"
|
||||
!!! tip "NOTE"
|
||||
If you are using this experiment as part of a litmus workflow scheduled constructed & executed from chaos-center, then you may be making use of the [litmus-admin](https://litmuschaos.github.io/litmus/litmus-admin-rbac.yaml) RBAC, which is pre installed in the cluster as part of the agent setup.
|
||||
|
||||
[embedmd]:# (https://raw.githubusercontent.com/litmuschaos/chaos-charts/master/charts/kafka/kafka-broker-pod-failure/rbac.yaml yaml)
|
||||
```yaml
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
name: kafka-broker-pod-failure-sa
|
||||
namespace: default
|
||||
labels:
|
||||
name: kafka-broker-pod-failure-sa
|
||||
app.kubernetes.io/part-of: litmus
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRole
|
||||
metadata:
|
||||
name: kafka-broker-pod-failure-sa
|
||||
labels:
|
||||
name: kafka-broker-pod-failure-sa
|
||||
app.kubernetes.io/part-of: litmus
|
||||
rules:
|
||||
- apiGroups: [""]
|
||||
resources: ["pods","events"]
|
||||
verbs: ["create","list","get","patch","update","delete","deletecollection"]
|
||||
- apiGroups: [""]
|
||||
resources: ["pods/exec","pods/log"]
|
||||
verbs: ["create","list","get"]
|
||||
- apiGroups: ["batch"]
|
||||
resources: ["jobs"]
|
||||
verbs: ["create","list","get","delete","deletecollection"]
|
||||
- apiGroups: ["apps"]
|
||||
resources: ["deployments","statefulsets"]
|
||||
verbs: ["list","get"]
|
||||
- apiGroups: ["litmuschaos.io"]
|
||||
resources: ["chaosengines","chaosexperiments","chaosresults"]
|
||||
verbs: ["create","list","get","patch","update"]
|
||||
- apiGroups: [""]
|
||||
resources: ["nodes"]
|
||||
verbs: ["get","list"]
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRoleBinding
|
||||
metadata:
|
||||
name: kafka-broker-pod-failure-sa
|
||||
labels:
|
||||
name: kafka-broker-pod-failure-sa
|
||||
app.kubernetes.io/part-of: litmus
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: ClusterRole
|
||||
name: kafka-broker-pod-failure-sa
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: kafka-broker-pod-failure-sa
|
||||
namespace: default
|
||||
```
|
||||
Use this sample RBAC manifest to create a chaosServiceAccount in the desired (app) namespace. This example consists of the minimum necessary role permissions to execute the experiment.
|
||||
??? note "View the Minimal RBAC permissions"
|
||||
|
||||
[embedmd]:# (https://raw.githubusercontent.com/litmuschaos/chaos-charts/master/charts/kafka/kafka-broker-pod-failure/rbac.yaml yaml)
|
||||
```yaml
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
name: kafka-broker-pod-failure-sa
|
||||
namespace: default
|
||||
labels:
|
||||
name: kafka-broker-pod-failure-sa
|
||||
app.kubernetes.io/part-of: litmus
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRole
|
||||
metadata:
|
||||
name: kafka-broker-pod-failure-sa
|
||||
labels:
|
||||
name: kafka-broker-pod-failure-sa
|
||||
app.kubernetes.io/part-of: litmus
|
||||
rules:
|
||||
- apiGroups: [""]
|
||||
resources: ["pods","events"]
|
||||
verbs: ["create","list","get","patch","update","delete","deletecollection"]
|
||||
- apiGroups: [""]
|
||||
resources: ["pods/exec","pods/log"]
|
||||
verbs: ["create","list","get"]
|
||||
- apiGroups: ["batch"]
|
||||
resources: ["jobs"]
|
||||
verbs: ["create","list","get","delete","deletecollection"]
|
||||
- apiGroups: ["apps"]
|
||||
resources: ["deployments","statefulsets"]
|
||||
verbs: ["list","get"]
|
||||
- apiGroups: ["litmuschaos.io"]
|
||||
resources: ["chaosengines","chaosexperiments","chaosresults"]
|
||||
verbs: ["create","list","get","patch","update"]
|
||||
- apiGroups: [""]
|
||||
resources: ["nodes"]
|
||||
verbs: ["get","list"]
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRoleBinding
|
||||
metadata:
|
||||
name: kafka-broker-pod-failure-sa
|
||||
labels:
|
||||
name: kafka-broker-pod-failure-sa
|
||||
app.kubernetes.io/part-of: litmus
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: ClusterRole
|
||||
name: kafka-broker-pod-failure-sa
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: kafka-broker-pod-failure-sa
|
||||
namespace: default
|
||||
```
|
||||
Use this sample RBAC manifest to create a chaosServiceAccount in the desired (app) namespace. This example consists of the minimum necessary role permissions to execute the experiment.
|
||||
|
||||
## Experiment tunables
|
||||
|
||||
|
|
|
|||
|
|
@ -29,53 +29,56 @@
|
|||
|
||||
## Minimal RBAC configuration example (optional)
|
||||
|
||||
??? note "View the Minimal RBAC permissions"
|
||||
!!! tip "NOTE"
|
||||
If you are using this experiment as part of a litmus workflow scheduled constructed & executed from chaos-center, then you may be making use of the [litmus-admin](https://litmuschaos.github.io/litmus/litmus-admin-rbac.yaml) RBAC, which is pre installed in the cluster as part of the agent setup.
|
||||
|
||||
[embedmd]:# (https://raw.githubusercontent.com/litmuschaos/chaos-charts/master/charts/generic/docker-service-kill/rbac.yaml yaml)
|
||||
```yaml
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
name: docker-service-kill-sa
|
||||
namespace: default
|
||||
labels:
|
||||
name: docker-service-kill-sa
|
||||
app.kubernetes.io/part-of: litmus
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRole
|
||||
metadata:
|
||||
name: docker-service-kill-sa
|
||||
labels:
|
||||
name: docker-service-kill-sa
|
||||
app.kubernetes.io/part-of: litmus
|
||||
rules:
|
||||
- apiGroups: ["","litmuschaos.io","batch","apps"]
|
||||
resources: ["pods","jobs","pods/log","events","chaosengines","chaosexperiments","chaosresults"]
|
||||
verbs: ["create","list","get","patch","update","delete"]
|
||||
- apiGroups: [""]
|
||||
resources: ["nodes"]
|
||||
verbs: ["get","list"]
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRoleBinding
|
||||
metadata:
|
||||
name: docker-service-kill-sa
|
||||
labels:
|
||||
name: docker-service-kill-sa
|
||||
app.kubernetes.io/part-of: litmus
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: ClusterRole
|
||||
name: docker-service-kill-sa
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: docker-service-kill-sa
|
||||
namespace: default
|
||||
```
|
||||
??? note "View the Minimal RBAC permissions"
|
||||
|
||||
Use this sample RBAC manifest to create a chaosServiceAccount in the desired (app) namespace. This example consists of the minimum necessary role permissions to execute the experiment.
|
||||
[embedmd]:# (https://raw.githubusercontent.com/litmuschaos/chaos-charts/master/charts/generic/docker-service-kill/rbac.yaml yaml)
|
||||
```yaml
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
name: docker-service-kill-sa
|
||||
namespace: default
|
||||
labels:
|
||||
name: docker-service-kill-sa
|
||||
app.kubernetes.io/part-of: litmus
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRole
|
||||
metadata:
|
||||
name: docker-service-kill-sa
|
||||
labels:
|
||||
name: docker-service-kill-sa
|
||||
app.kubernetes.io/part-of: litmus
|
||||
rules:
|
||||
- apiGroups: ["","litmuschaos.io","batch","apps"]
|
||||
resources: ["pods","jobs","pods/log","events","chaosengines","chaosexperiments","chaosresults"]
|
||||
verbs: ["create","list","get","patch","update","delete"]
|
||||
- apiGroups: [""]
|
||||
resources: ["nodes"]
|
||||
verbs: ["get","list"]
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRoleBinding
|
||||
metadata:
|
||||
name: docker-service-kill-sa
|
||||
labels:
|
||||
name: docker-service-kill-sa
|
||||
app.kubernetes.io/part-of: litmus
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: ClusterRole
|
||||
name: docker-service-kill-sa
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: docker-service-kill-sa
|
||||
namespace: default
|
||||
```
|
||||
|
||||
Use this sample RBAC manifest to create a chaosServiceAccount in the desired (app) namespace. This example consists of the minimum necessary role permissions to execute the experiment.
|
||||
|
||||
## Experiment tunables
|
||||
|
||||
|
|
|
|||
|
|
@ -29,62 +29,65 @@
|
|||
|
||||
## Minimal RBAC configuration example (optional)
|
||||
|
||||
??? note "View the Minimal RBAC permissions"
|
||||
!!! tip "NOTE"
|
||||
If you are using this experiment as part of a litmus workflow scheduled constructed & executed from chaos-center, then you may be making use of the [litmus-admin](https://litmuschaos.github.io/litmus/litmus-admin-rbac.yaml) RBAC, which is pre installed in the cluster as part of the agent setup.
|
||||
|
||||
[embedmd]:# (https://raw.githubusercontent.com/litmuschaos/chaos-charts/master/charts/generic/kubelet-service-kill/rbac.yaml yaml)
|
||||
```yaml
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
name: kubelet-service-kill-sa
|
||||
namespace: default
|
||||
labels:
|
||||
name: kubelet-service-kill-sa
|
||||
app.kubernetes.io/part-of: litmus
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRole
|
||||
metadata:
|
||||
name: kubelet-service-kill-sa
|
||||
labels:
|
||||
name: kubelet-service-kill-sa
|
||||
app.kubernetes.io/part-of: litmus
|
||||
rules:
|
||||
- apiGroups: [""]
|
||||
resources: ["pods","events"]
|
||||
verbs: ["create","list","get","patch","update","delete","deletecollection"]
|
||||
- apiGroups: [""]
|
||||
resources: ["pods/exec","pods/log"]
|
||||
verbs: ["create","list","get"]
|
||||
- apiGroups: ["batch"]
|
||||
resources: ["jobs"]
|
||||
verbs: ["create","list","get","delete","deletecollection"]
|
||||
- apiGroups: ["litmuschaos.io"]
|
||||
resources: ["chaosengines","chaosexperiments","chaosresults"]
|
||||
verbs: ["create","list","get","patch","update"]
|
||||
- apiGroups: [""]
|
||||
resources: ["nodes"]
|
||||
verbs: ["get","list"]
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRoleBinding
|
||||
metadata:
|
||||
name: kubelet-service-kill-sa
|
||||
labels:
|
||||
name: kubelet-service-kill-sa
|
||||
app.kubernetes.io/part-of: litmus
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: ClusterRole
|
||||
name: kubelet-service-kill-sa
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: kubelet-service-kill-sa
|
||||
namespace: default
|
||||
```
|
||||
??? note "View the Minimal RBAC permissions"
|
||||
|
||||
Use this sample RBAC manifest to create a chaosServiceAccount in the desired (app) namespace. This example consists of the minimum necessary role permissions to execute the experiment.
|
||||
[embedmd]:# (https://raw.githubusercontent.com/litmuschaos/chaos-charts/master/charts/generic/kubelet-service-kill/rbac.yaml yaml)
|
||||
```yaml
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
name: kubelet-service-kill-sa
|
||||
namespace: default
|
||||
labels:
|
||||
name: kubelet-service-kill-sa
|
||||
app.kubernetes.io/part-of: litmus
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRole
|
||||
metadata:
|
||||
name: kubelet-service-kill-sa
|
||||
labels:
|
||||
name: kubelet-service-kill-sa
|
||||
app.kubernetes.io/part-of: litmus
|
||||
rules:
|
||||
- apiGroups: [""]
|
||||
resources: ["pods","events"]
|
||||
verbs: ["create","list","get","patch","update","delete","deletecollection"]
|
||||
- apiGroups: [""]
|
||||
resources: ["pods/exec","pods/log"]
|
||||
verbs: ["create","list","get"]
|
||||
- apiGroups: ["batch"]
|
||||
resources: ["jobs"]
|
||||
verbs: ["create","list","get","delete","deletecollection"]
|
||||
- apiGroups: ["litmuschaos.io"]
|
||||
resources: ["chaosengines","chaosexperiments","chaosresults"]
|
||||
verbs: ["create","list","get","patch","update"]
|
||||
- apiGroups: [""]
|
||||
resources: ["nodes"]
|
||||
verbs: ["get","list"]
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRoleBinding
|
||||
metadata:
|
||||
name: kubelet-service-kill-sa
|
||||
labels:
|
||||
name: kubelet-service-kill-sa
|
||||
app.kubernetes.io/part-of: litmus
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: ClusterRole
|
||||
name: kubelet-service-kill-sa
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: kubelet-service-kill-sa
|
||||
namespace: default
|
||||
```
|
||||
|
||||
Use this sample RBAC manifest to create a chaosServiceAccount in the desired (app) namespace. This example consists of the minimum necessary role permissions to execute the experiment.
|
||||
|
||||
## Experiment tunables
|
||||
|
||||
|
|
|
|||
|
|
@ -26,62 +26,65 @@ Application implies services. Can be reframed as: Tests application resiliency u
|
|||
|
||||
## Minimal RBAC configuration example (optional)
|
||||
|
||||
??? note "View the Minimal RBAC permissions"
|
||||
!!! tip "NOTE"
|
||||
If you are using this experiment as part of a litmus workflow scheduled constructed & executed from chaos-center, then you may be making use of the [litmus-admin](https://litmuschaos.github.io/litmus/litmus-admin-rbac.yaml) RBAC, which is pre installed in the cluster as part of the agent setup.
|
||||
|
||||
[embedmd]:# (https://raw.githubusercontent.com/litmuschaos/chaos-charts/master/charts/generic/node-cpu-hog/rbac.yaml yaml)
|
||||
```yaml
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
name: node-cpu-hog-sa
|
||||
namespace: default
|
||||
labels:
|
||||
name: node-cpu-hog-sa
|
||||
app.kubernetes.io/part-of: litmus
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRole
|
||||
metadata:
|
||||
name: node-cpu-hog-sa
|
||||
labels:
|
||||
name: node-cpu-hog-sa
|
||||
app.kubernetes.io/part-of: litmus
|
||||
rules:
|
||||
- apiGroups: [""]
|
||||
resources: ["pods","events"]
|
||||
verbs: ["create","list","get","patch","update","delete","deletecollection"]
|
||||
- apiGroups: [""]
|
||||
resources: ["pods/exec","pods/log"]
|
||||
verbs: ["list","get","create"]
|
||||
- apiGroups: ["batch"]
|
||||
resources: ["jobs"]
|
||||
verbs: ["create","list","get","delete","deletecollection"]
|
||||
- apiGroups: ["litmuschaos.io"]
|
||||
resources: ["chaosengines","chaosexperiments","chaosresults"]
|
||||
verbs: ["create","list","get","patch","update"]
|
||||
- apiGroups: [""]
|
||||
resources: ["nodes"]
|
||||
verbs: ["get","list"]
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRoleBinding
|
||||
metadata:
|
||||
name: node-cpu-hog-sa
|
||||
labels:
|
||||
name: node-cpu-hog-sa
|
||||
app.kubernetes.io/part-of: litmus
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: ClusterRole
|
||||
name: node-cpu-hog-sa
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: node-cpu-hog-sa
|
||||
namespace: default
|
||||
```
|
||||
??? note "View the Minimal RBAC permissions"
|
||||
|
||||
Use this sample RBAC manifest to create a chaosServiceAccount in the desired (app) namespace. This example consists of the minimum necessary role permissions to execute the experiment.
|
||||
[embedmd]:# (https://raw.githubusercontent.com/litmuschaos/chaos-charts/master/charts/generic/node-cpu-hog/rbac.yaml yaml)
|
||||
```yaml
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
name: node-cpu-hog-sa
|
||||
namespace: default
|
||||
labels:
|
||||
name: node-cpu-hog-sa
|
||||
app.kubernetes.io/part-of: litmus
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRole
|
||||
metadata:
|
||||
name: node-cpu-hog-sa
|
||||
labels:
|
||||
name: node-cpu-hog-sa
|
||||
app.kubernetes.io/part-of: litmus
|
||||
rules:
|
||||
- apiGroups: [""]
|
||||
resources: ["pods","events"]
|
||||
verbs: ["create","list","get","patch","update","delete","deletecollection"]
|
||||
- apiGroups: [""]
|
||||
resources: ["pods/exec","pods/log"]
|
||||
verbs: ["list","get","create"]
|
||||
- apiGroups: ["batch"]
|
||||
resources: ["jobs"]
|
||||
verbs: ["create","list","get","delete","deletecollection"]
|
||||
- apiGroups: ["litmuschaos.io"]
|
||||
resources: ["chaosengines","chaosexperiments","chaosresults"]
|
||||
verbs: ["create","list","get","patch","update"]
|
||||
- apiGroups: [""]
|
||||
resources: ["nodes"]
|
||||
verbs: ["get","list"]
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRoleBinding
|
||||
metadata:
|
||||
name: node-cpu-hog-sa
|
||||
labels:
|
||||
name: node-cpu-hog-sa
|
||||
app.kubernetes.io/part-of: litmus
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: ClusterRole
|
||||
name: node-cpu-hog-sa
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: node-cpu-hog-sa
|
||||
namespace: default
|
||||
```
|
||||
|
||||
Use this sample RBAC manifest to create a chaosServiceAccount in the desired (app) namespace. This example consists of the minimum necessary role permissions to execute the experiment.
|
||||
|
||||
## Experiment tunables
|
||||
|
||||
|
|
|
|||
|
|
@ -27,65 +27,68 @@
|
|||
|
||||
## Minimal RBAC configuration example (optional)
|
||||
|
||||
??? note "View the Minimal RBAC permissions"
|
||||
!!! tip "NOTE"
|
||||
If you are using this experiment as part of a litmus workflow scheduled constructed & executed from chaos-center, then you may be making use of the [litmus-admin](https://litmuschaos.github.io/litmus/litmus-admin-rbac.yaml) RBAC, which is pre installed in the cluster as part of the agent setup.
|
||||
|
||||
[embedmd]:# (https://raw.githubusercontent.com/litmuschaos/chaos-charts/master/charts/generic/node-drain/rbac.yaml yaml)
|
||||
```yaml
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
name: node-drain-sa
|
||||
namespace: default
|
||||
labels:
|
||||
name: node-drain-sa
|
||||
app.kubernetes.io/part-of: litmus
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRole
|
||||
metadata:
|
||||
name: node-drain-sa
|
||||
labels:
|
||||
name: node-drain-sa
|
||||
app.kubernetes.io/part-of: litmus
|
||||
rules:
|
||||
- apiGroups: [""]
|
||||
resources: ["pods","events"]
|
||||
verbs: ["create","list","get","patch","update","delete","deletecollection"]
|
||||
- apiGroups: [""]
|
||||
resources: ["pods/exec","pods/log","pods/eviction"]
|
||||
verbs: ["list","get","create"]
|
||||
- apiGroups: ["batch"]
|
||||
resources: ["jobs"]
|
||||
verbs: ["create","list","get","delete","deletecollection"]
|
||||
- apiGroups: ["apps"]
|
||||
resources: ["daemonsets"]
|
||||
verbs: ["list","get","delete"]
|
||||
- apiGroups: ["litmuschaos.io"]
|
||||
resources: ["chaosengines","chaosexperiments","chaosresults"]
|
||||
verbs: ["create","list","get","patch","update"]
|
||||
- apiGroups: [""]
|
||||
resources: ["nodes"]
|
||||
verbs: ["patch","get","list"]
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRoleBinding
|
||||
metadata:
|
||||
name: node-drain-sa
|
||||
labels:
|
||||
name: node-drain-sa
|
||||
app.kubernetes.io/part-of: litmus
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: ClusterRole
|
||||
name: node-drain-sa
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: node-drain-sa
|
||||
namespace: default
|
||||
```
|
||||
??? note "View the Minimal RBAC permissions"
|
||||
|
||||
Use this sample RBAC manifest to create a chaosServiceAccount in the desired (app) namespace. This example consists of the minimum necessary role permissions to execute the experiment.
|
||||
[embedmd]:# (https://raw.githubusercontent.com/litmuschaos/chaos-charts/master/charts/generic/node-drain/rbac.yaml yaml)
|
||||
```yaml
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
name: node-drain-sa
|
||||
namespace: default
|
||||
labels:
|
||||
name: node-drain-sa
|
||||
app.kubernetes.io/part-of: litmus
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRole
|
||||
metadata:
|
||||
name: node-drain-sa
|
||||
labels:
|
||||
name: node-drain-sa
|
||||
app.kubernetes.io/part-of: litmus
|
||||
rules:
|
||||
- apiGroups: [""]
|
||||
resources: ["pods","events"]
|
||||
verbs: ["create","list","get","patch","update","delete","deletecollection"]
|
||||
- apiGroups: [""]
|
||||
resources: ["pods/exec","pods/log","pods/eviction"]
|
||||
verbs: ["list","get","create"]
|
||||
- apiGroups: ["batch"]
|
||||
resources: ["jobs"]
|
||||
verbs: ["create","list","get","delete","deletecollection"]
|
||||
- apiGroups: ["apps"]
|
||||
resources: ["daemonsets"]
|
||||
verbs: ["list","get","delete"]
|
||||
- apiGroups: ["litmuschaos.io"]
|
||||
resources: ["chaosengines","chaosexperiments","chaosresults"]
|
||||
verbs: ["create","list","get","patch","update"]
|
||||
- apiGroups: [""]
|
||||
resources: ["nodes"]
|
||||
verbs: ["patch","get","list"]
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRoleBinding
|
||||
metadata:
|
||||
name: node-drain-sa
|
||||
labels:
|
||||
name: node-drain-sa
|
||||
app.kubernetes.io/part-of: litmus
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: ClusterRole
|
||||
name: node-drain-sa
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: node-drain-sa
|
||||
namespace: default
|
||||
```
|
||||
|
||||
Use this sample RBAC manifest to create a chaosServiceAccount in the desired (app) namespace. This example consists of the minimum necessary role permissions to execute the experiment.
|
||||
|
||||
## Experiment tunables
|
||||
|
||||
|
|
|
|||
|
|
@ -26,62 +26,65 @@
|
|||
|
||||
## Minimal RBAC configuration example (optional)
|
||||
|
||||
??? note "View the Minimal RBAC permissions"
|
||||
!!! tip "NOTE"
|
||||
If you are using this experiment as part of a litmus workflow scheduled constructed & executed from chaos-center, then you may be making use of the [litmus-admin](https://litmuschaos.github.io/litmus/litmus-admin-rbac.yaml) RBAC, which is pre installed in the cluster as part of the agent setup.
|
||||
|
||||
[embedmd]:# (https://raw.githubusercontent.com/litmuschaos/chaos-charts/master/charts/generic/node-io-stress/rbac.yaml yaml)
|
||||
```yaml
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
name: node-io-stress-sa
|
||||
namespace: default
|
||||
labels:
|
||||
name: node-io-stress-sa
|
||||
app.kubernetes.io/part-of: litmus
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRole
|
||||
metadata:
|
||||
name: node-io-stress-sa
|
||||
labels:
|
||||
name: node-io-stress-sa
|
||||
app.kubernetes.io/part-of: litmus
|
||||
rules:
|
||||
- apiGroups: [""]
|
||||
resources: ["pods","events"]
|
||||
verbs: ["create","list","get","patch","update","delete","deletecollection"]
|
||||
- apiGroups: [""]
|
||||
resources: ["pods/exec","pods/log"]
|
||||
verbs: ["create","list","get"]
|
||||
- apiGroups: ["batch"]
|
||||
resources: ["jobs"]
|
||||
verbs: ["create","list","get","delete","deletecollection"]
|
||||
- apiGroups: ["litmuschaos.io"]
|
||||
resources: ["chaosengines","chaosexperiments","chaosresults"]
|
||||
verbs: ["create","list","get","patch","update"]
|
||||
- apiGroups: [""]
|
||||
resources: ["nodes"]
|
||||
verbs: ["get","list"]
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRoleBinding
|
||||
metadata:
|
||||
name: node-io-stress-sa
|
||||
labels:
|
||||
name: node-io-stress-sa
|
||||
app.kubernetes.io/part-of: litmus
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: ClusterRole
|
||||
name: node-io-stress-sa
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: node-io-stress-sa
|
||||
namespace: default
|
||||
```
|
||||
??? note "View the Minimal RBAC permissions"
|
||||
|
||||
Use this sample RBAC manifest to create a chaosServiceAccount in the desired (app) namespace. This example consists of the minimum necessary role permissions to execute the experiment.
|
||||
[embedmd]:# (https://raw.githubusercontent.com/litmuschaos/chaos-charts/master/charts/generic/node-io-stress/rbac.yaml yaml)
|
||||
```yaml
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
name: node-io-stress-sa
|
||||
namespace: default
|
||||
labels:
|
||||
name: node-io-stress-sa
|
||||
app.kubernetes.io/part-of: litmus
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRole
|
||||
metadata:
|
||||
name: node-io-stress-sa
|
||||
labels:
|
||||
name: node-io-stress-sa
|
||||
app.kubernetes.io/part-of: litmus
|
||||
rules:
|
||||
- apiGroups: [""]
|
||||
resources: ["pods","events"]
|
||||
verbs: ["create","list","get","patch","update","delete","deletecollection"]
|
||||
- apiGroups: [""]
|
||||
resources: ["pods/exec","pods/log"]
|
||||
verbs: ["create","list","get"]
|
||||
- apiGroups: ["batch"]
|
||||
resources: ["jobs"]
|
||||
verbs: ["create","list","get","delete","deletecollection"]
|
||||
- apiGroups: ["litmuschaos.io"]
|
||||
resources: ["chaosengines","chaosexperiments","chaosresults"]
|
||||
verbs: ["create","list","get","patch","update"]
|
||||
- apiGroups: [""]
|
||||
resources: ["nodes"]
|
||||
verbs: ["get","list"]
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRoleBinding
|
||||
metadata:
|
||||
name: node-io-stress-sa
|
||||
labels:
|
||||
name: node-io-stress-sa
|
||||
app.kubernetes.io/part-of: litmus
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: ClusterRole
|
||||
name: node-io-stress-sa
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: node-io-stress-sa
|
||||
namespace: default
|
||||
```
|
||||
|
||||
Use this sample RBAC manifest to create a chaosServiceAccount in the desired (app) namespace. This example consists of the minimum necessary role permissions to execute the experiment.
|
||||
|
||||
## Experiment tunables
|
||||
|
||||
|
|
|
|||
|
|
@ -26,62 +26,65 @@
|
|||
|
||||
## Minimal RBAC configuration example (optional)
|
||||
|
||||
??? note "View the Minimal RBAC permissions"
|
||||
!!! tip "NOTE"
|
||||
If you are using this experiment as part of a litmus workflow scheduled constructed & executed from chaos-center, then you may be making use of the [litmus-admin](https://litmuschaos.github.io/litmus/litmus-admin-rbac.yaml) RBAC, which is pre installed in the cluster as part of the agent setup.
|
||||
|
||||
[embedmd]:# (https://raw.githubusercontent.com/litmuschaos/chaos-charts/master/charts/generic/node-memory-hog/rbac.yaml yaml)
|
||||
```yaml
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
name: node-memory-hog-sa
|
||||
namespace: default
|
||||
labels:
|
||||
name: node-memory-hog-sa
|
||||
app.kubernetes.io/part-of: litmus
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRole
|
||||
metadata:
|
||||
name: node-memory-hog-sa
|
||||
labels:
|
||||
name: node-memory-hog-sa
|
||||
app.kubernetes.io/part-of: litmus
|
||||
rules:
|
||||
- apiGroups: [""]
|
||||
resources: ["pods","events"]
|
||||
verbs: ["create","list","get","patch","update","delete","deletecollection"]
|
||||
- apiGroups: [""]
|
||||
resources: ["pods/exec","pods/log"]
|
||||
verbs: ["create","list","get"]
|
||||
- apiGroups: ["batch"]
|
||||
resources: ["jobs"]
|
||||
verbs: ["create","list","get","delete","deletecollection"]
|
||||
- apiGroups: ["litmuschaos.io"]
|
||||
resources: ["chaosengines","chaosexperiments","chaosresults"]
|
||||
verbs: ["create","list","get","patch","update"]
|
||||
- apiGroups: [""]
|
||||
resources: ["nodes"]
|
||||
verbs: ["get","list"]
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRoleBinding
|
||||
metadata:
|
||||
name: node-memory-hog-sa
|
||||
labels:
|
||||
name: node-memory-hog-sa
|
||||
app.kubernetes.io/part-of: litmus
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: ClusterRole
|
||||
name: node-memory-hog-sa
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: node-memory-hog-sa
|
||||
namespace: default
|
||||
```
|
||||
??? note "View the Minimal RBAC permissions"
|
||||
|
||||
Use this sample RBAC manifest to create a chaosServiceAccount in the desired (app) namespace. This example consists of the minimum necessary role permissions to execute the experiment.
|
||||
[embedmd]:# (https://raw.githubusercontent.com/litmuschaos/chaos-charts/master/charts/generic/node-memory-hog/rbac.yaml yaml)
|
||||
```yaml
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
name: node-memory-hog-sa
|
||||
namespace: default
|
||||
labels:
|
||||
name: node-memory-hog-sa
|
||||
app.kubernetes.io/part-of: litmus
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRole
|
||||
metadata:
|
||||
name: node-memory-hog-sa
|
||||
labels:
|
||||
name: node-memory-hog-sa
|
||||
app.kubernetes.io/part-of: litmus
|
||||
rules:
|
||||
- apiGroups: [""]
|
||||
resources: ["pods","events"]
|
||||
verbs: ["create","list","get","patch","update","delete","deletecollection"]
|
||||
- apiGroups: [""]
|
||||
resources: ["pods/exec","pods/log"]
|
||||
verbs: ["create","list","get"]
|
||||
- apiGroups: ["batch"]
|
||||
resources: ["jobs"]
|
||||
verbs: ["create","list","get","delete","deletecollection"]
|
||||
- apiGroups: ["litmuschaos.io"]
|
||||
resources: ["chaosengines","chaosexperiments","chaosresults"]
|
||||
verbs: ["create","list","get","patch","update"]
|
||||
- apiGroups: [""]
|
||||
resources: ["nodes"]
|
||||
verbs: ["get","list"]
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRoleBinding
|
||||
metadata:
|
||||
name: node-memory-hog-sa
|
||||
labels:
|
||||
name: node-memory-hog-sa
|
||||
app.kubernetes.io/part-of: litmus
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: ClusterRole
|
||||
name: node-memory-hog-sa
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: node-memory-hog-sa
|
||||
namespace: default
|
||||
```
|
||||
|
||||
Use this sample RBAC manifest to create a chaosServiceAccount in the desired (app) namespace. This example consists of the minimum necessary role permissions to execute the experiment.
|
||||
|
||||
## Experiment tunables
|
||||
|
||||
|
|
|
|||
|
|
@ -51,62 +51,65 @@
|
|||
|
||||
## Minimal RBAC configuration example (optional)
|
||||
|
||||
??? note "View the Minimal RBAC permissions"
|
||||
!!! tip "NOTE"
|
||||
If you are using this experiment as part of a litmus workflow scheduled constructed & executed from chaos-center, then you may be making use of the [litmus-admin](https://litmuschaos.github.io/litmus/litmus-admin-rbac.yaml) RBAC, which is pre installed in the cluster as part of the agent setup.
|
||||
|
||||
[embedmd]:# (https://raw.githubusercontent.com/litmuschaos/chaos-charts/master/charts/generic/node-restart/rbac.yaml yaml)
|
||||
```yaml
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
name: node-restart-sa
|
||||
namespace: default
|
||||
labels:
|
||||
name: node-restart-sa
|
||||
app.kubernetes.io/part-of: litmus
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRole
|
||||
metadata:
|
||||
name: node-restart-sa
|
||||
labels:
|
||||
name: node-restart-sa
|
||||
app.kubernetes.io/part-of: litmus
|
||||
rules:
|
||||
- apiGroups: [""]
|
||||
resources: ["pods","events","secrets"]
|
||||
verbs: ["create","list","get","patch","update","delete","deletecollection"]
|
||||
- apiGroups: [""]
|
||||
resources: ["pods/exec","pods/log"]
|
||||
verbs: ["create","list","get"]
|
||||
- apiGroups: ["batch"]
|
||||
resources: ["jobs"]
|
||||
verbs: ["create","list","get","delete","deletecollection"]
|
||||
- apiGroups: ["litmuschaos.io"]
|
||||
resources: ["chaosengines","chaosexperiments","chaosresults"]
|
||||
verbs: ["create","list","get","patch","update"]
|
||||
- apiGroups: [""]
|
||||
resources: ["nodes"]
|
||||
verbs: ["get","list"]
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRoleBinding
|
||||
metadata:
|
||||
name: node-restart-sa
|
||||
labels:
|
||||
name: node-restart-sa
|
||||
app.kubernetes.io/part-of: litmus
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: ClusterRole
|
||||
name: node-restart-sa
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: node-restart-sa
|
||||
namespace: default
|
||||
```
|
||||
??? note "View the Minimal RBAC permissions"
|
||||
|
||||
Use this sample RBAC manifest to create a chaosServiceAccount in the desired (app) namespace. This example consists of the minimum necessary role permissions to execute the experiment.
|
||||
[embedmd]:# (https://raw.githubusercontent.com/litmuschaos/chaos-charts/master/charts/generic/node-restart/rbac.yaml yaml)
|
||||
```yaml
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
name: node-restart-sa
|
||||
namespace: default
|
||||
labels:
|
||||
name: node-restart-sa
|
||||
app.kubernetes.io/part-of: litmus
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRole
|
||||
metadata:
|
||||
name: node-restart-sa
|
||||
labels:
|
||||
name: node-restart-sa
|
||||
app.kubernetes.io/part-of: litmus
|
||||
rules:
|
||||
- apiGroups: [""]
|
||||
resources: ["pods","events","secrets"]
|
||||
verbs: ["create","list","get","patch","update","delete","deletecollection"]
|
||||
- apiGroups: [""]
|
||||
resources: ["pods/exec","pods/log"]
|
||||
verbs: ["create","list","get"]
|
||||
- apiGroups: ["batch"]
|
||||
resources: ["jobs"]
|
||||
verbs: ["create","list","get","delete","deletecollection"]
|
||||
- apiGroups: ["litmuschaos.io"]
|
||||
resources: ["chaosengines","chaosexperiments","chaosresults"]
|
||||
verbs: ["create","list","get","patch","update"]
|
||||
- apiGroups: [""]
|
||||
resources: ["nodes"]
|
||||
verbs: ["get","list"]
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRoleBinding
|
||||
metadata:
|
||||
name: node-restart-sa
|
||||
labels:
|
||||
name: node-restart-sa
|
||||
app.kubernetes.io/part-of: litmus
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: ClusterRole
|
||||
name: node-restart-sa
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: node-restart-sa
|
||||
namespace: default
|
||||
```
|
||||
|
||||
Use this sample RBAC manifest to create a chaosServiceAccount in the desired (app) namespace. This example consists of the minimum necessary role permissions to execute the experiment.
|
||||
|
||||
## Experiment tunables
|
||||
|
||||
|
|
|
|||
|
|
@ -27,65 +27,68 @@
|
|||
|
||||
## Minimal RBAC configuration example (optional)
|
||||
|
||||
??? note "View the Minimal RBAC permissions"
|
||||
!!! tip "NOTE"
|
||||
If you are using this experiment as part of a litmus workflow scheduled constructed & executed from chaos-center, then you may be making use of the [litmus-admin](https://litmuschaos.github.io/litmus/litmus-admin-rbac.yaml) RBAC, which is pre installed in the cluster as part of the agent setup.
|
||||
|
||||
[embedmd]:# (https://raw.githubusercontent.com/litmuschaos/chaos-charts/master/charts/generic/node-taint/rbac.yaml yaml)
|
||||
```yaml
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
name: node-taint-sa
|
||||
namespace: default
|
||||
labels:
|
||||
name: node-taint-sa
|
||||
app.kubernetes.io/part-of: litmus
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRole
|
||||
metadata:
|
||||
name: node-taint-sa
|
||||
labels:
|
||||
name: node-taint-sa
|
||||
app.kubernetes.io/part-of: litmus
|
||||
rules:
|
||||
- apiGroups: [""]
|
||||
resources: ["pods","events"]
|
||||
verbs: ["create","list","get","patch","update","delete","deletecollection"]
|
||||
- apiGroups: [""]
|
||||
resources: ["pods/exec","pods/log","pods/eviction"]
|
||||
verbs: ["create","list","get"]
|
||||
- apiGroups: ["batch"]
|
||||
resources: ["jobs"]
|
||||
verbs: ["create","list","get","delete","deletecollection"]
|
||||
- apiGroups: ["apps"]
|
||||
resources: ["daemonsets"]
|
||||
verbs: ["list","get","delete"]
|
||||
- apiGroups: ["litmuschaos.io"]
|
||||
resources: ["chaosengines","chaosexperiments","chaosresults"]
|
||||
verbs: ["create","list","get","patch","update"]
|
||||
- apiGroups: [""]
|
||||
resources: ["nodes"]
|
||||
verbs: ["patch","get","list","update"]
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRoleBinding
|
||||
metadata:
|
||||
name: node-taint-sa
|
||||
labels:
|
||||
name: node-taint-sa
|
||||
app.kubernetes.io/part-of: litmus
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: ClusterRole
|
||||
name: node-taint-sa
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: node-taint-sa
|
||||
namespace: default
|
||||
```
|
||||
??? note "View the Minimal RBAC permissions"
|
||||
|
||||
Use this sample RBAC manifest to create a chaosServiceAccount in the desired (app) namespace. This example consists of the minimum necessary role permissions to execute the experiment.
|
||||
[embedmd]:# (https://raw.githubusercontent.com/litmuschaos/chaos-charts/master/charts/generic/node-taint/rbac.yaml yaml)
|
||||
```yaml
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
name: node-taint-sa
|
||||
namespace: default
|
||||
labels:
|
||||
name: node-taint-sa
|
||||
app.kubernetes.io/part-of: litmus
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRole
|
||||
metadata:
|
||||
name: node-taint-sa
|
||||
labels:
|
||||
name: node-taint-sa
|
||||
app.kubernetes.io/part-of: litmus
|
||||
rules:
|
||||
- apiGroups: [""]
|
||||
resources: ["pods","events"]
|
||||
verbs: ["create","list","get","patch","update","delete","deletecollection"]
|
||||
- apiGroups: [""]
|
||||
resources: ["pods/exec","pods/log","pods/eviction"]
|
||||
verbs: ["create","list","get"]
|
||||
- apiGroups: ["batch"]
|
||||
resources: ["jobs"]
|
||||
verbs: ["create","list","get","delete","deletecollection"]
|
||||
- apiGroups: ["apps"]
|
||||
resources: ["daemonsets"]
|
||||
verbs: ["list","get","delete"]
|
||||
- apiGroups: ["litmuschaos.io"]
|
||||
resources: ["chaosengines","chaosexperiments","chaosresults"]
|
||||
verbs: ["create","list","get","patch","update"]
|
||||
- apiGroups: [""]
|
||||
resources: ["nodes"]
|
||||
verbs: ["patch","get","list","update"]
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRoleBinding
|
||||
metadata:
|
||||
name: node-taint-sa
|
||||
labels:
|
||||
name: node-taint-sa
|
||||
app.kubernetes.io/part-of: litmus
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: ClusterRole
|
||||
name: node-taint-sa
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: node-taint-sa
|
||||
namespace: default
|
||||
```
|
||||
|
||||
Use this sample RBAC manifest to create a chaosServiceAccount in the desired (app) namespace. This example consists of the minimum necessary role permissions to execute the experiment.
|
||||
|
||||
## Experiment tunables
|
||||
|
||||
|
|
|
|||
|
|
@ -26,69 +26,72 @@
|
|||
|
||||
## Minimal RBAC configuration example (optional)
|
||||
|
||||
??? note "View the Minimal RBAC permissions"
|
||||
!!! tip "NOTE"
|
||||
If you are using this experiment as part of a litmus workflow scheduled constructed & executed from chaos-center, then you may be making use of the [litmus-admin](https://litmuschaos.github.io/litmus/litmus-admin-rbac.yaml) RBAC, which is pre installed in the cluster as part of the agent setup.
|
||||
|
||||
[embedmd]:# (https://raw.githubusercontent.com/litmuschaos/chaos-charts/master/charts/generic/container-kill/rbac.yaml yaml)
|
||||
```yaml
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
name: container-kill-sa
|
||||
namespace: default
|
||||
labels:
|
||||
name: container-kill-sa
|
||||
app.kubernetes.io/part-of: litmus
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: Role
|
||||
metadata:
|
||||
name: container-kill-sa
|
||||
namespace: default
|
||||
labels:
|
||||
name: container-kill-sa
|
||||
app.kubernetes.io/part-of: litmus
|
||||
rules:
|
||||
- apiGroups: [""]
|
||||
resources: ["pods","events"]
|
||||
verbs: ["create","list","get","patch","update","delete","deletecollection"]
|
||||
- apiGroups: [""]
|
||||
resources: ["pods/exec","pods/log","replicationcontrollers"]
|
||||
verbs: ["list","get","create"]
|
||||
- apiGroups: ["batch"]
|
||||
resources: ["jobs"]
|
||||
verbs: ["create","list","get","delete","deletecollection"]
|
||||
- apiGroups: ["apps"]
|
||||
resources: ["deployments","statefulsets","daemonsets","replicasets"]
|
||||
verbs: ["list","get"]
|
||||
- apiGroups: ["apps.openshift.io"]
|
||||
resources: ["deploymentconfigs"]
|
||||
verbs: ["list","get"]
|
||||
- apiGroups: ["argoproj.io"]
|
||||
resources: ["rollouts"]
|
||||
verbs: ["list","get"]
|
||||
- apiGroups: ["litmuschaos.io"]
|
||||
resources: ["chaosengines","chaosexperiments","chaosresults"]
|
||||
verbs: ["create","list","get","patch","update"]
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: RoleBinding
|
||||
metadata:
|
||||
name: container-kill-sa
|
||||
namespace: default
|
||||
labels:
|
||||
name: container-kill-sa
|
||||
app.kubernetes.io/part-of: litmus
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: Role
|
||||
name: container-kill-sa
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: container-kill-sa
|
||||
namespace: default
|
||||
```
|
||||
Use this sample RBAC manifest to create a chaosServiceAccount in the desired (app) namespace. This example consists of the minimum necessary role permissions to execute the experiment.
|
||||
??? note "View the Minimal RBAC permissions"
|
||||
|
||||
[embedmd]:# (https://raw.githubusercontent.com/litmuschaos/chaos-charts/master/charts/generic/container-kill/rbac.yaml yaml)
|
||||
```yaml
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
name: container-kill-sa
|
||||
namespace: default
|
||||
labels:
|
||||
name: container-kill-sa
|
||||
app.kubernetes.io/part-of: litmus
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: Role
|
||||
metadata:
|
||||
name: container-kill-sa
|
||||
namespace: default
|
||||
labels:
|
||||
name: container-kill-sa
|
||||
app.kubernetes.io/part-of: litmus
|
||||
rules:
|
||||
- apiGroups: [""]
|
||||
resources: ["pods","events"]
|
||||
verbs: ["create","list","get","patch","update","delete","deletecollection"]
|
||||
- apiGroups: [""]
|
||||
resources: ["pods/exec","pods/log","replicationcontrollers"]
|
||||
verbs: ["list","get","create"]
|
||||
- apiGroups: ["batch"]
|
||||
resources: ["jobs"]
|
||||
verbs: ["create","list","get","delete","deletecollection"]
|
||||
- apiGroups: ["apps"]
|
||||
resources: ["deployments","statefulsets","daemonsets","replicasets"]
|
||||
verbs: ["list","get"]
|
||||
- apiGroups: ["apps.openshift.io"]
|
||||
resources: ["deploymentconfigs"]
|
||||
verbs: ["list","get"]
|
||||
- apiGroups: ["argoproj.io"]
|
||||
resources: ["rollouts"]
|
||||
verbs: ["list","get"]
|
||||
- apiGroups: ["litmuschaos.io"]
|
||||
resources: ["chaosengines","chaosexperiments","chaosresults"]
|
||||
verbs: ["create","list","get","patch","update"]
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: RoleBinding
|
||||
metadata:
|
||||
name: container-kill-sa
|
||||
namespace: default
|
||||
labels:
|
||||
name: container-kill-sa
|
||||
app.kubernetes.io/part-of: litmus
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: Role
|
||||
name: container-kill-sa
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: container-kill-sa
|
||||
namespace: default
|
||||
```
|
||||
Use this sample RBAC manifest to create a chaosServiceAccount in the desired (app) namespace. This example consists of the minimum necessary role permissions to execute the experiment.
|
||||
|
||||
## Experiment tunables
|
||||
|
||||
|
|
|
|||
|
|
@ -53,69 +53,72 @@
|
|||
|
||||
## Minimal RBAC configuration example (optional)
|
||||
|
||||
??? note "View the Minimal RBAC permissions"
|
||||
!!! tip "NOTE"
|
||||
If you are using this experiment as part of a litmus workflow scheduled constructed & executed from chaos-center, then you may be making use of the [litmus-admin](https://litmuschaos.github.io/litmus/litmus-admin-rbac.yaml) RBAC, which is pre installed in the cluster as part of the agent setup.
|
||||
|
||||
[embedmd]:# (https://raw.githubusercontent.com/litmuschaos/chaos-charts/master/charts/generic/disk-fill/rbac.yaml yaml)
|
||||
```yaml
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
name: disk-fill-sa
|
||||
namespace: default
|
||||
labels:
|
||||
name: disk-fill-sa
|
||||
app.kubernetes.io/part-of: litmus
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: Role
|
||||
metadata:
|
||||
name: disk-fill-sa
|
||||
namespace: default
|
||||
labels:
|
||||
name: disk-fill-sa
|
||||
app.kubernetes.io/part-of: litmus
|
||||
rules:
|
||||
- apiGroups: [""]
|
||||
resources: ["pods","events"]
|
||||
verbs: ["create","list","get","patch","update","delete","deletecollection"]
|
||||
- apiGroups: [""]
|
||||
resources: ["pods/exec","pods/log","replicationcontrollers"]
|
||||
verbs: ["list","get","create"]
|
||||
- apiGroups: ["batch"]
|
||||
resources: ["jobs"]
|
||||
verbs: ["create","list","get","delete","deletecollection"]
|
||||
- apiGroups: ["apps"]
|
||||
resources: ["deployments","statefulsets","daemonsets","replicasets"]
|
||||
verbs: ["list","get"]
|
||||
- apiGroups: ["apps.openshift.io"]
|
||||
resources: ["deploymentconfigs"]
|
||||
verbs: ["list","get"]
|
||||
- apiGroups: ["argoproj.io"]
|
||||
resources: ["rollouts"]
|
||||
verbs: ["list","get"]
|
||||
- apiGroups: ["litmuschaos.io"]
|
||||
resources: ["chaosengines","chaosexperiments","chaosresults"]
|
||||
verbs: ["create","list","get","patch","update"]
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: RoleBinding
|
||||
metadata:
|
||||
name: disk-fill-sa
|
||||
namespace: default
|
||||
labels:
|
||||
name: disk-fill-sa
|
||||
app.kubernetes.io/part-of: litmus
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: Role
|
||||
name: disk-fill-sa
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: disk-fill-sa
|
||||
namespace: default
|
||||
```
|
||||
Use this sample RBAC manifest to create a chaosServiceAccount in the desired (app) namespace. This example consists of the minimum necessary role permissions to execute the experiment.
|
||||
??? note "View the Minimal RBAC permissions"
|
||||
|
||||
[embedmd]:# (https://raw.githubusercontent.com/litmuschaos/chaos-charts/master/charts/generic/disk-fill/rbac.yaml yaml)
|
||||
```yaml
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
name: disk-fill-sa
|
||||
namespace: default
|
||||
labels:
|
||||
name: disk-fill-sa
|
||||
app.kubernetes.io/part-of: litmus
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: Role
|
||||
metadata:
|
||||
name: disk-fill-sa
|
||||
namespace: default
|
||||
labels:
|
||||
name: disk-fill-sa
|
||||
app.kubernetes.io/part-of: litmus
|
||||
rules:
|
||||
- apiGroups: [""]
|
||||
resources: ["pods","events"]
|
||||
verbs: ["create","list","get","patch","update","delete","deletecollection"]
|
||||
- apiGroups: [""]
|
||||
resources: ["pods/exec","pods/log","replicationcontrollers"]
|
||||
verbs: ["list","get","create"]
|
||||
- apiGroups: ["batch"]
|
||||
resources: ["jobs"]
|
||||
verbs: ["create","list","get","delete","deletecollection"]
|
||||
- apiGroups: ["apps"]
|
||||
resources: ["deployments","statefulsets","daemonsets","replicasets"]
|
||||
verbs: ["list","get"]
|
||||
- apiGroups: ["apps.openshift.io"]
|
||||
resources: ["deploymentconfigs"]
|
||||
verbs: ["list","get"]
|
||||
- apiGroups: ["argoproj.io"]
|
||||
resources: ["rollouts"]
|
||||
verbs: ["list","get"]
|
||||
- apiGroups: ["litmuschaos.io"]
|
||||
resources: ["chaosengines","chaosexperiments","chaosresults"]
|
||||
verbs: ["create","list","get","patch","update"]
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: RoleBinding
|
||||
metadata:
|
||||
name: disk-fill-sa
|
||||
namespace: default
|
||||
labels:
|
||||
name: disk-fill-sa
|
||||
app.kubernetes.io/part-of: litmus
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: Role
|
||||
name: disk-fill-sa
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: disk-fill-sa
|
||||
namespace: default
|
||||
```
|
||||
Use this sample RBAC manifest to create a chaosServiceAccount in the desired (app) namespace. This example consists of the minimum necessary role permissions to execute the experiment.
|
||||
|
||||
## Experiment tunables
|
||||
|
||||
|
|
|
|||
|
|
@ -26,61 +26,64 @@
|
|||
|
||||
## Minimal RBAC configuration example (optional)
|
||||
|
||||
??? note "View the Minimal RBAC permissions"
|
||||
!!! tip "NOTE"
|
||||
If you are using this experiment as part of a litmus workflow scheduled constructed & executed from chaos-center, then you may be making use of the [litmus-admin](https://litmuschaos.github.io/litmus/litmus-admin-rbac.yaml) RBAC, which is pre installed in the cluster as part of the agent setup.
|
||||
|
||||
[embedmd]:# (https://raw.githubusercontent.com/litmuschaos/chaos-charts/master/charts/generic/pod-autoscaler/rbac.yaml yaml)
|
||||
```yaml
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
name: pod-autoscaler-sa
|
||||
namespace: default
|
||||
labels:
|
||||
name: pod-autoscaler-sa
|
||||
app.kubernetes.io/part-of: litmus
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRole
|
||||
metadata:
|
||||
name: pod-autoscaler-sa
|
||||
labels:
|
||||
name: pod-autoscaler-sa
|
||||
app.kubernetes.io/part-of: litmus
|
||||
rules:
|
||||
- apiGroups: [""]
|
||||
resources: ["pods","events"]
|
||||
verbs: ["create","list","get","patch","update","delete","deletecollection"]
|
||||
- apiGroups: [""]
|
||||
resources: ["pods/exec","pods/log"]
|
||||
verbs: ["create","list","get"]
|
||||
- apiGroups: ["batch"]
|
||||
resources: ["jobs"]
|
||||
verbs: ["create","list","get","delete","deletecollection"]
|
||||
- apiGroups: ["apps"]
|
||||
resources: ["deployments","statefulsets"]
|
||||
verbs: ["list","get","patch","update"]
|
||||
- apiGroups: ["litmuschaos.io"]
|
||||
resources: ["chaosengines","chaosexperiments","chaosresults"]
|
||||
verbs: ["create","list","get","patch","update"]
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRoleBinding
|
||||
metadata:
|
||||
name: pod-autoscaler-sa
|
||||
labels:
|
||||
name: pod-autoscaler-sa
|
||||
app.kubernetes.io/part-of: litmus
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: ClusterRole
|
||||
name: pod-autoscaler-sa
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: pod-autoscaler-sa
|
||||
namespace: default
|
||||
```
|
||||
Use this sample RBAC manifest to create a chaosServiceAccount in the desired (app) namespace. This example consists of the minimum necessary role permissions to execute the experiment.
|
||||
??? note "View the Minimal RBAC permissions"
|
||||
|
||||
[embedmd]:# (https://raw.githubusercontent.com/litmuschaos/chaos-charts/master/charts/generic/pod-autoscaler/rbac.yaml yaml)
|
||||
```yaml
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
name: pod-autoscaler-sa
|
||||
namespace: default
|
||||
labels:
|
||||
name: pod-autoscaler-sa
|
||||
app.kubernetes.io/part-of: litmus
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRole
|
||||
metadata:
|
||||
name: pod-autoscaler-sa
|
||||
labels:
|
||||
name: pod-autoscaler-sa
|
||||
app.kubernetes.io/part-of: litmus
|
||||
rules:
|
||||
- apiGroups: [""]
|
||||
resources: ["pods","events"]
|
||||
verbs: ["create","list","get","patch","update","delete","deletecollection"]
|
||||
- apiGroups: [""]
|
||||
resources: ["pods/exec","pods/log"]
|
||||
verbs: ["create","list","get"]
|
||||
- apiGroups: ["batch"]
|
||||
resources: ["jobs"]
|
||||
verbs: ["create","list","get","delete","deletecollection"]
|
||||
- apiGroups: ["apps"]
|
||||
resources: ["deployments","statefulsets"]
|
||||
verbs: ["list","get","patch","update"]
|
||||
- apiGroups: ["litmuschaos.io"]
|
||||
resources: ["chaosengines","chaosexperiments","chaosresults"]
|
||||
verbs: ["create","list","get","patch","update"]
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRoleBinding
|
||||
metadata:
|
||||
name: pod-autoscaler-sa
|
||||
labels:
|
||||
name: pod-autoscaler-sa
|
||||
app.kubernetes.io/part-of: litmus
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: ClusterRole
|
||||
name: pod-autoscaler-sa
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: pod-autoscaler-sa
|
||||
namespace: default
|
||||
```
|
||||
Use this sample RBAC manifest to create a chaosServiceAccount in the desired (app) namespace. This example consists of the minimum necessary role permissions to execute the experiment.
|
||||
|
||||
## Experiment tunables
|
||||
|
||||
|
|
|
|||
|
|
@ -28,69 +28,72 @@
|
|||
|
||||
## Minimal RBAC configuration example (optional)
|
||||
|
||||
??? note "View the Minimal RBAC permissions"
|
||||
!!! tip "NOTE"
|
||||
If you are using this experiment as part of a litmus workflow scheduled constructed & executed from chaos-center, then you may be making use of the [litmus-admin](https://litmuschaos.github.io/litmus/litmus-admin-rbac.yaml) RBAC, which is pre installed in the cluster as part of the agent setup.
|
||||
|
||||
[embedmd]:# (https://raw.githubusercontent.com/litmuschaos/chaos-charts/master/charts/generic/pod-cpu-hog-exec/rbac.yaml yaml)
|
||||
```yaml
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
name: pod-cpu-hog-exec-sa
|
||||
namespace: default
|
||||
labels:
|
||||
name: pod-cpu-hog-exec-sa
|
||||
app.kubernetes.io/part-of: litmus
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: Role
|
||||
metadata:
|
||||
name: pod-cpu-hog-exec-sa
|
||||
namespace: default
|
||||
labels:
|
||||
name: pod-cpu-hog-exec-sa
|
||||
app.kubernetes.io/part-of: litmus
|
||||
rules:
|
||||
- apiGroups: [""]
|
||||
resources: ["pods","events"]
|
||||
verbs: ["create","list","get","patch","update","delete","deletecollection"]
|
||||
- apiGroups: [""]
|
||||
resources: ["pods/exec","pods/log","replicationcontrollers"]
|
||||
verbs: ["create","list","get"]
|
||||
- apiGroups: ["batch"]
|
||||
resources: ["jobs"]
|
||||
verbs: ["create","list","get","delete","deletecollection"]
|
||||
- apiGroups: ["apps"]
|
||||
resources: ["deployments","statefulsets","daemonsets","replicasets"]
|
||||
verbs: ["list","get"]
|
||||
- apiGroups: ["apps.openshift.io"]
|
||||
resources: ["deploymentconfigs"]
|
||||
verbs: ["list","get"]
|
||||
- apiGroups: ["argoproj.io"]
|
||||
resources: ["rollouts"]
|
||||
verbs: ["list","get"]
|
||||
- apiGroups: ["litmuschaos.io"]
|
||||
resources: ["chaosengines","chaosexperiments","chaosresults"]
|
||||
verbs: ["create","list","get","patch","update"]
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: RoleBinding
|
||||
metadata:
|
||||
name: pod-cpu-hog-exec-sa
|
||||
namespace: default
|
||||
labels:
|
||||
name: pod-cpu-hog-exec-sa
|
||||
app.kubernetes.io/part-of: litmus
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: Role
|
||||
name: pod-cpu-hog-exec-sa
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: pod-cpu-hog-exec-sa
|
||||
namespace: default
|
||||
```
|
||||
Use this sample RBAC manifest to create a chaosServiceAccount in the desired (app) namespace. This example consists of the minimum necessary role permissions to execute the experiment.
|
||||
??? note "View the Minimal RBAC permissions"
|
||||
|
||||
[embedmd]:# (https://raw.githubusercontent.com/litmuschaos/chaos-charts/master/charts/generic/pod-cpu-hog-exec/rbac.yaml yaml)
|
||||
```yaml
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
name: pod-cpu-hog-exec-sa
|
||||
namespace: default
|
||||
labels:
|
||||
name: pod-cpu-hog-exec-sa
|
||||
app.kubernetes.io/part-of: litmus
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: Role
|
||||
metadata:
|
||||
name: pod-cpu-hog-exec-sa
|
||||
namespace: default
|
||||
labels:
|
||||
name: pod-cpu-hog-exec-sa
|
||||
app.kubernetes.io/part-of: litmus
|
||||
rules:
|
||||
- apiGroups: [""]
|
||||
resources: ["pods","events"]
|
||||
verbs: ["create","list","get","patch","update","delete","deletecollection"]
|
||||
- apiGroups: [""]
|
||||
resources: ["pods/exec","pods/log","replicationcontrollers"]
|
||||
verbs: ["create","list","get"]
|
||||
- apiGroups: ["batch"]
|
||||
resources: ["jobs"]
|
||||
verbs: ["create","list","get","delete","deletecollection"]
|
||||
- apiGroups: ["apps"]
|
||||
resources: ["deployments","statefulsets","daemonsets","replicasets"]
|
||||
verbs: ["list","get"]
|
||||
- apiGroups: ["apps.openshift.io"]
|
||||
resources: ["deploymentconfigs"]
|
||||
verbs: ["list","get"]
|
||||
- apiGroups: ["argoproj.io"]
|
||||
resources: ["rollouts"]
|
||||
verbs: ["list","get"]
|
||||
- apiGroups: ["litmuschaos.io"]
|
||||
resources: ["chaosengines","chaosexperiments","chaosresults"]
|
||||
verbs: ["create","list","get","patch","update"]
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: RoleBinding
|
||||
metadata:
|
||||
name: pod-cpu-hog-exec-sa
|
||||
namespace: default
|
||||
labels:
|
||||
name: pod-cpu-hog-exec-sa
|
||||
app.kubernetes.io/part-of: litmus
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: Role
|
||||
name: pod-cpu-hog-exec-sa
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: pod-cpu-hog-exec-sa
|
||||
namespace: default
|
||||
```
|
||||
Use this sample RBAC manifest to create a chaosServiceAccount in the desired (app) namespace. This example consists of the minimum necessary role permissions to execute the experiment.
|
||||
|
||||
## Experiment tunables
|
||||
|
||||
|
|
|
|||
|
|
@ -28,70 +28,73 @@
|
|||
|
||||
## Minimal RBAC configuration example (optional)
|
||||
|
||||
??? note "View the Minimal RBAC permissions"
|
||||
!!! tip "NOTE"
|
||||
If you are using this experiment as part of a litmus workflow scheduled constructed & executed from chaos-center, then you may be making use of the [litmus-admin](https://litmuschaos.github.io/litmus/litmus-admin-rbac.yaml) RBAC, which is pre installed in the cluster as part of the agent setup.
|
||||
|
||||
[embedmd]:# (https://raw.githubusercontent.com/litmuschaos/chaos-charts/master/charts/generic/pod-cpu-hog/rbac.yaml yaml)
|
||||
```yaml
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
name: pod-cpu-hog-sa
|
||||
namespace: default
|
||||
labels:
|
||||
name: pod-cpu-hog-sa
|
||||
app.kubernetes.io/part-of: litmus
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: Role
|
||||
metadata:
|
||||
name: pod-cpu-hog-sa
|
||||
namespace: default
|
||||
labels:
|
||||
name: pod-cpu-hog-sa
|
||||
app.kubernetes.io/part-of: litmus
|
||||
rules:
|
||||
- apiGroups: [""]
|
||||
resources: ["pods","events"]
|
||||
verbs: ["create","list","get","patch","update","delete","deletecollection"]
|
||||
- apiGroups: [""]
|
||||
resources: ["pods/exec","pods/log","replicationcontrollers"]
|
||||
verbs: ["create","list","get"]
|
||||
- apiGroups: ["batch"]
|
||||
resources: ["jobs"]
|
||||
verbs: ["create","list","get","delete","deletecollection"]
|
||||
- apiGroups: ["apps"]
|
||||
resources: ["deployments","statefulsets","daemonsets","replicasets"]
|
||||
verbs: ["list","get"]
|
||||
- apiGroups: ["apps.openshift.io"]
|
||||
resources: ["deploymentconfigs"]
|
||||
verbs: ["list","get"]
|
||||
- apiGroups: ["argoproj.io"]
|
||||
resources: ["rollouts"]
|
||||
verbs: ["list","get"]
|
||||
- apiGroups: ["litmuschaos.io"]
|
||||
resources: ["chaosengines","chaosexperiments","chaosresults"]
|
||||
verbs: ["create","list","get","patch","update"]
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: RoleBinding
|
||||
metadata:
|
||||
name: pod-cpu-hog-sa
|
||||
namespace: default
|
||||
labels:
|
||||
name: pod-cpu-hog-sa
|
||||
app.kubernetes.io/part-of: litmus
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: Role
|
||||
name: pod-cpu-hog-sa
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: pod-cpu-hog-sa
|
||||
namespace: default
|
||||
```
|
||||
??? note "View the Minimal RBAC permissions"
|
||||
|
||||
Use this sample RBAC manifest to create a chaosServiceAccount in the desired (app) namespace. This example consists of the minimum necessary role permissions to execute the experiment.
|
||||
[embedmd]:# (https://raw.githubusercontent.com/litmuschaos/chaos-charts/master/charts/generic/pod-cpu-hog/rbac.yaml yaml)
|
||||
```yaml
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
name: pod-cpu-hog-sa
|
||||
namespace: default
|
||||
labels:
|
||||
name: pod-cpu-hog-sa
|
||||
app.kubernetes.io/part-of: litmus
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: Role
|
||||
metadata:
|
||||
name: pod-cpu-hog-sa
|
||||
namespace: default
|
||||
labels:
|
||||
name: pod-cpu-hog-sa
|
||||
app.kubernetes.io/part-of: litmus
|
||||
rules:
|
||||
- apiGroups: [""]
|
||||
resources: ["pods","events"]
|
||||
verbs: ["create","list","get","patch","update","delete","deletecollection"]
|
||||
- apiGroups: [""]
|
||||
resources: ["pods/exec","pods/log","replicationcontrollers"]
|
||||
verbs: ["create","list","get"]
|
||||
- apiGroups: ["batch"]
|
||||
resources: ["jobs"]
|
||||
verbs: ["create","list","get","delete","deletecollection"]
|
||||
- apiGroups: ["apps"]
|
||||
resources: ["deployments","statefulsets","daemonsets","replicasets"]
|
||||
verbs: ["list","get"]
|
||||
- apiGroups: ["apps.openshift.io"]
|
||||
resources: ["deploymentconfigs"]
|
||||
verbs: ["list","get"]
|
||||
- apiGroups: ["argoproj.io"]
|
||||
resources: ["rollouts"]
|
||||
verbs: ["list","get"]
|
||||
- apiGroups: ["litmuschaos.io"]
|
||||
resources: ["chaosengines","chaosexperiments","chaosresults"]
|
||||
verbs: ["create","list","get","patch","update"]
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: RoleBinding
|
||||
metadata:
|
||||
name: pod-cpu-hog-sa
|
||||
namespace: default
|
||||
labels:
|
||||
name: pod-cpu-hog-sa
|
||||
app.kubernetes.io/part-of: litmus
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: Role
|
||||
name: pod-cpu-hog-sa
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: pod-cpu-hog-sa
|
||||
namespace: default
|
||||
```
|
||||
|
||||
Use this sample RBAC manifest to create a chaosServiceAccount in the desired (app) namespace. This example consists of the minimum necessary role permissions to execute the experiment.
|
||||
|
||||
## Experiment tunables
|
||||
|
||||
|
|
|
|||
|
|
@ -28,68 +28,71 @@
|
|||
|
||||
## Minimal RBAC configuration example (optional)
|
||||
|
||||
??? note "View the Minimal RBAC permissions"
|
||||
[embedmd]:# (https://raw.githubusercontent.com/litmuschaos/chaos-charts/master/charts/generic/pod-delete/rbac.yaml yaml)
|
||||
```yaml
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
name: pod-delete-sa
|
||||
namespace: default
|
||||
labels:
|
||||
name: pod-delete-sa
|
||||
app.kubernetes.io/part-of: litmus
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: Role
|
||||
metadata:
|
||||
name: pod-delete-sa
|
||||
namespace: default
|
||||
labels:
|
||||
name: pod-delete-sa
|
||||
app.kubernetes.io/part-of: litmus
|
||||
rules:
|
||||
- apiGroups: [""]
|
||||
resources: ["pods","events"]
|
||||
verbs: ["create","list","get","patch","update","delete","deletecollection"]
|
||||
- apiGroups: [""]
|
||||
resources: ["pods/exec","pods/log","replicationcontrollers"]
|
||||
verbs: ["create","list","get"]
|
||||
- apiGroups: ["batch"]
|
||||
resources: ["jobs"]
|
||||
verbs: ["create","list","get","delete","deletecollection"]
|
||||
- apiGroups: ["apps"]
|
||||
resources: ["deployments","statefulsets","daemonsets","replicasets"]
|
||||
verbs: ["list","get"]
|
||||
- apiGroups: ["apps.openshift.io"]
|
||||
resources: ["deploymentconfigs"]
|
||||
verbs: ["list","get"]
|
||||
- apiGroups: ["argoproj.io"]
|
||||
resources: ["rollouts"]
|
||||
verbs: ["list","get"]
|
||||
- apiGroups: ["litmuschaos.io"]
|
||||
resources: ["chaosengines","chaosexperiments","chaosresults"]
|
||||
verbs: ["create","list","get","patch","update"]
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: RoleBinding
|
||||
metadata:
|
||||
name: pod-delete-sa
|
||||
namespace: default
|
||||
labels:
|
||||
name: pod-delete-sa
|
||||
app.kubernetes.io/part-of: litmus
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: Role
|
||||
name: pod-delete-sa
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: pod-delete-sa
|
||||
namespace: default
|
||||
```
|
||||
Use this sample RBAC manifest to create a chaosServiceAccount in the desired (app) namespace. This example consists of the minimum necessary role permissions to execute the experiment.
|
||||
!!! tip "NOTE"
|
||||
If you are using this experiment as part of a litmus workflow scheduled constructed & executed from chaos-center, then you may be making use of the [litmus-admin](https://litmuschaos.github.io/litmus/litmus-admin-rbac.yaml) RBAC, which is pre installed in the cluster as part of the agent setup.
|
||||
|
||||
??? note "View the Minimal RBAC permissions"
|
||||
[embedmd]:# (https://raw.githubusercontent.com/litmuschaos/chaos-charts/master/charts/generic/pod-delete/rbac.yaml yaml)
|
||||
```yaml
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
name: pod-delete-sa
|
||||
namespace: default
|
||||
labels:
|
||||
name: pod-delete-sa
|
||||
app.kubernetes.io/part-of: litmus
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: Role
|
||||
metadata:
|
||||
name: pod-delete-sa
|
||||
namespace: default
|
||||
labels:
|
||||
name: pod-delete-sa
|
||||
app.kubernetes.io/part-of: litmus
|
||||
rules:
|
||||
- apiGroups: [""]
|
||||
resources: ["pods","events"]
|
||||
verbs: ["create","list","get","patch","update","delete","deletecollection"]
|
||||
- apiGroups: [""]
|
||||
resources: ["pods/exec","pods/log","replicationcontrollers"]
|
||||
verbs: ["create","list","get"]
|
||||
- apiGroups: ["batch"]
|
||||
resources: ["jobs"]
|
||||
verbs: ["create","list","get","delete","deletecollection"]
|
||||
- apiGroups: ["apps"]
|
||||
resources: ["deployments","statefulsets","daemonsets","replicasets"]
|
||||
verbs: ["list","get"]
|
||||
- apiGroups: ["apps.openshift.io"]
|
||||
resources: ["deploymentconfigs"]
|
||||
verbs: ["list","get"]
|
||||
- apiGroups: ["argoproj.io"]
|
||||
resources: ["rollouts"]
|
||||
verbs: ["list","get"]
|
||||
- apiGroups: ["litmuschaos.io"]
|
||||
resources: ["chaosengines","chaosexperiments","chaosresults"]
|
||||
verbs: ["create","list","get","patch","update"]
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: RoleBinding
|
||||
metadata:
|
||||
name: pod-delete-sa
|
||||
namespace: default
|
||||
labels:
|
||||
name: pod-delete-sa
|
||||
app.kubernetes.io/part-of: litmus
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: Role
|
||||
name: pod-delete-sa
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: pod-delete-sa
|
||||
namespace: default
|
||||
```
|
||||
Use this sample RBAC manifest to create a chaosServiceAccount in the desired (app) namespace. This example consists of the minimum necessary role permissions to execute the experiment.
|
||||
|
||||
## Experiment tunables
|
||||
|
||||
|
|
|
|||
|
|
@ -25,70 +25,73 @@
|
|||
|
||||
## Minimal RBAC configuration example (optional)
|
||||
|
||||
??? note "View the Minimal RBAC permissions"
|
||||
!!! tip "NOTE"
|
||||
If you are using this experiment as part of a litmus workflow scheduled constructed & executed from chaos-center, then you may be making use of the [litmus-admin](https://litmuschaos.github.io/litmus/litmus-admin-rbac.yaml) RBAC, which is pre installed in the cluster as part of the agent setup.
|
||||
|
||||
[embedmd]:# (https://raw.githubusercontent.com/litmuschaos/chaos-charts/master/charts/generic/pod-dns-error/rbac.yaml yaml)
|
||||
```yaml
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
name: pod-dns-error-sa
|
||||
namespace: default
|
||||
labels:
|
||||
name: pod-dns-error-sa
|
||||
app.kubernetes.io/part-of: litmus
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: Role
|
||||
metadata:
|
||||
name: pod-dns-error-sa
|
||||
namespace: default
|
||||
labels:
|
||||
name: pod-dns-error-sa
|
||||
app.kubernetes.io/part-of: litmus
|
||||
rules:
|
||||
- apiGroups: [""]
|
||||
resources: ["pods", "events"]
|
||||
verbs:
|
||||
["create", "list", "get", "patch", "update", "delete", "deletecollection"]
|
||||
- apiGroups: [""]
|
||||
resources: ["pods/exec", "pods/log", "replicationcontrollers"]
|
||||
verbs: ["create", "list", "get"]
|
||||
- apiGroups: ["batch"]
|
||||
resources: ["jobs"]
|
||||
verbs: ["create", "list", "get", "delete", "deletecollection"]
|
||||
- apiGroups: ["apps"]
|
||||
resources: ["deployments", "statefulsets", "daemonsets", "replicasets"]
|
||||
verbs: ["list", "get"]
|
||||
- apiGroups: ["apps.openshift.io"]
|
||||
resources: ["deploymentconfigs"]
|
||||
verbs: ["list", "get"]
|
||||
- apiGroups: ["argoproj.io"]
|
||||
resources: ["rollouts"]
|
||||
verbs: ["list", "get"]
|
||||
- apiGroups: ["litmuschaos.io"]
|
||||
resources: ["chaosengines", "chaosexperiments", "chaosresults"]
|
||||
verbs: ["create", "list", "get", "patch", "update"]
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: RoleBinding
|
||||
metadata:
|
||||
name: pod-dns-error-sa
|
||||
namespace: default
|
||||
labels:
|
||||
name: pod-dns-error-sa
|
||||
app.kubernetes.io/part-of: litmus
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: Role
|
||||
name: pod-dns-error-sa
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: pod-dns-error-sa
|
||||
namespace: default
|
||||
```
|
||||
Use this sample RBAC manifest to create a chaosServiceAccount in the desired (app) namespace. This example consists of the minimum necessary role permissions to execute the experiment.
|
||||
??? note "View the Minimal RBAC permissions"
|
||||
|
||||
[embedmd]:# (https://raw.githubusercontent.com/litmuschaos/chaos-charts/master/charts/generic/pod-dns-error/rbac.yaml yaml)
|
||||
```yaml
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
name: pod-dns-error-sa
|
||||
namespace: default
|
||||
labels:
|
||||
name: pod-dns-error-sa
|
||||
app.kubernetes.io/part-of: litmus
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: Role
|
||||
metadata:
|
||||
name: pod-dns-error-sa
|
||||
namespace: default
|
||||
labels:
|
||||
name: pod-dns-error-sa
|
||||
app.kubernetes.io/part-of: litmus
|
||||
rules:
|
||||
- apiGroups: [""]
|
||||
resources: ["pods", "events"]
|
||||
verbs:
|
||||
["create", "list", "get", "patch", "update", "delete", "deletecollection"]
|
||||
- apiGroups: [""]
|
||||
resources: ["pods/exec", "pods/log", "replicationcontrollers"]
|
||||
verbs: ["create", "list", "get"]
|
||||
- apiGroups: ["batch"]
|
||||
resources: ["jobs"]
|
||||
verbs: ["create", "list", "get", "delete", "deletecollection"]
|
||||
- apiGroups: ["apps"]
|
||||
resources: ["deployments", "statefulsets", "daemonsets", "replicasets"]
|
||||
verbs: ["list", "get"]
|
||||
- apiGroups: ["apps.openshift.io"]
|
||||
resources: ["deploymentconfigs"]
|
||||
verbs: ["list", "get"]
|
||||
- apiGroups: ["argoproj.io"]
|
||||
resources: ["rollouts"]
|
||||
verbs: ["list", "get"]
|
||||
- apiGroups: ["litmuschaos.io"]
|
||||
resources: ["chaosengines", "chaosexperiments", "chaosresults"]
|
||||
verbs: ["create", "list", "get", "patch", "update"]
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: RoleBinding
|
||||
metadata:
|
||||
name: pod-dns-error-sa
|
||||
namespace: default
|
||||
labels:
|
||||
name: pod-dns-error-sa
|
||||
app.kubernetes.io/part-of: litmus
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: Role
|
||||
name: pod-dns-error-sa
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: pod-dns-error-sa
|
||||
namespace: default
|
||||
```
|
||||
Use this sample RBAC manifest to create a chaosServiceAccount in the desired (app) namespace. This example consists of the minimum necessary role permissions to execute the experiment.
|
||||
|
||||
## Experiment tunables
|
||||
|
||||
|
|
|
|||
|
|
@ -25,70 +25,73 @@
|
|||
|
||||
## Minimal RBAC configuration example (optional)
|
||||
|
||||
??? note "View the Minimal RBAC permissions"
|
||||
!!! tip "NOTE"
|
||||
If you are using this experiment as part of a litmus workflow scheduled constructed & executed from chaos-center, then you may be making use of the [litmus-admin](https://litmuschaos.github.io/litmus/litmus-admin-rbac.yaml) RBAC, which is pre installed in the cluster as part of the agent setup.
|
||||
|
||||
[embedmd]:# (https://raw.githubusercontent.com/litmuschaos/chaos-charts/master/charts/generic/pod-dns-spoof/rbac.yaml yaml)
|
||||
```yaml
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
name: pod-dns-spoof-sa
|
||||
namespace: default
|
||||
labels:
|
||||
name: pod-dns-spoof-sa
|
||||
app.kubernetes.io/part-of: litmus
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: Role
|
||||
metadata:
|
||||
name: pod-dns-spoof-sa
|
||||
namespace: default
|
||||
labels:
|
||||
name: pod-dns-spoof-sa
|
||||
app.kubernetes.io/part-of: litmus
|
||||
rules:
|
||||
- apiGroups: [""]
|
||||
resources: ["pods", "events"]
|
||||
verbs:
|
||||
["create", "list", "get", "patch", "update", "delete", "deletecollection"]
|
||||
- apiGroups: [""]
|
||||
resources: ["pods/exec", "pods/log", "replicationcontrollers"]
|
||||
verbs: ["create", "list", "get"]
|
||||
- apiGroups: ["batch"]
|
||||
resources: ["jobs"]
|
||||
verbs: ["create", "list", "get", "delete", "deletecollection"]
|
||||
- apiGroups: ["apps"]
|
||||
resources: ["deployments", "statefulsets", "daemonsets", "replicasets"]
|
||||
verbs: ["list", "get"]
|
||||
- apiGroups: ["apps.openshift.io"]
|
||||
resources: ["deploymentconfigs"]
|
||||
verbs: ["list", "get"]
|
||||
- apiGroups: ["argoproj.io"]
|
||||
resources: ["rollouts"]
|
||||
verbs: ["list", "get"]
|
||||
- apiGroups: ["litmuschaos.io"]
|
||||
resources: ["chaosengines", "chaosexperiments", "chaosresults"]
|
||||
verbs: ["create", "list", "get", "patch", "update"]
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: RoleBinding
|
||||
metadata:
|
||||
name: pod-dns-spoof-sa
|
||||
namespace: default
|
||||
labels:
|
||||
name: pod-dns-spoof-sa
|
||||
app.kubernetes.io/part-of: litmus
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: Role
|
||||
name: pod-dns-spoof-sa
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: pod-dns-spoof-sa
|
||||
namespace: default
|
||||
```
|
||||
Use this sample RBAC manifest to create a chaosServiceAccount in the desired (app) namespace. This example consists of the minimum necessary role permissions to execute the experiment.
|
||||
??? note "View the Minimal RBAC permissions"
|
||||
|
||||
[embedmd]:# (https://raw.githubusercontent.com/litmuschaos/chaos-charts/master/charts/generic/pod-dns-spoof/rbac.yaml yaml)
|
||||
```yaml
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
name: pod-dns-spoof-sa
|
||||
namespace: default
|
||||
labels:
|
||||
name: pod-dns-spoof-sa
|
||||
app.kubernetes.io/part-of: litmus
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: Role
|
||||
metadata:
|
||||
name: pod-dns-spoof-sa
|
||||
namespace: default
|
||||
labels:
|
||||
name: pod-dns-spoof-sa
|
||||
app.kubernetes.io/part-of: litmus
|
||||
rules:
|
||||
- apiGroups: [""]
|
||||
resources: ["pods", "events"]
|
||||
verbs:
|
||||
["create", "list", "get", "patch", "update", "delete", "deletecollection"]
|
||||
- apiGroups: [""]
|
||||
resources: ["pods/exec", "pods/log", "replicationcontrollers"]
|
||||
verbs: ["create", "list", "get"]
|
||||
- apiGroups: ["batch"]
|
||||
resources: ["jobs"]
|
||||
verbs: ["create", "list", "get", "delete", "deletecollection"]
|
||||
- apiGroups: ["apps"]
|
||||
resources: ["deployments", "statefulsets", "daemonsets", "replicasets"]
|
||||
verbs: ["list", "get"]
|
||||
- apiGroups: ["apps.openshift.io"]
|
||||
resources: ["deploymentconfigs"]
|
||||
verbs: ["list", "get"]
|
||||
- apiGroups: ["argoproj.io"]
|
||||
resources: ["rollouts"]
|
||||
verbs: ["list", "get"]
|
||||
- apiGroups: ["litmuschaos.io"]
|
||||
resources: ["chaosengines", "chaosexperiments", "chaosresults"]
|
||||
verbs: ["create", "list", "get", "patch", "update"]
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: RoleBinding
|
||||
metadata:
|
||||
name: pod-dns-spoof-sa
|
||||
namespace: default
|
||||
labels:
|
||||
name: pod-dns-spoof-sa
|
||||
app.kubernetes.io/part-of: litmus
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: Role
|
||||
name: pod-dns-spoof-sa
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: pod-dns-spoof-sa
|
||||
namespace: default
|
||||
```
|
||||
Use this sample RBAC manifest to create a chaosServiceAccount in the desired (app) namespace. This example consists of the minimum necessary role permissions to execute the experiment.
|
||||
|
||||
## Experiment tunables
|
||||
|
||||
|
|
|
|||
|
|
@ -26,69 +26,72 @@
|
|||
|
||||
## Minimal RBAC configuration example (optional)
|
||||
|
||||
??? note "View the Minimal RBAC permissions"
|
||||
!!! tip "NOTE"
|
||||
If you are using this experiment as part of a litmus workflow scheduled constructed & executed from chaos-center, then you may be making use of the [litmus-admin](https://litmuschaos.github.io/litmus/litmus-admin-rbac.yaml) RBAC, which is pre installed in the cluster as part of the agent setup..
|
||||
|
||||
[embedmd]:# (https://raw.githubusercontent.com/litmuschaos/chaos-charts/master/charts/generic/pod-io-stress/rbac.yaml yaml)
|
||||
```yaml
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
name: pod-io-stress-sa
|
||||
namespace: default
|
||||
labels:
|
||||
name: pod-io-stress-sa
|
||||
app.kubernetes.io/part-of: litmus
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: Role
|
||||
metadata:
|
||||
name: pod-io-stress-sa
|
||||
namespace: default
|
||||
labels:
|
||||
name: pod-io-stress-sa
|
||||
app.kubernetes.io/part-of: litmus
|
||||
rules:
|
||||
- apiGroups: [""]
|
||||
resources: ["pods","events"]
|
||||
verbs: ["create","list","get","patch","update","delete","deletecollection"]
|
||||
- apiGroups: [""]
|
||||
resources: ["pods/exec","pods/log","replicationcontrollers"]
|
||||
verbs: ["create","list","get"]
|
||||
- apiGroups: ["batch"]
|
||||
resources: ["jobs"]
|
||||
verbs: ["create","list","get","delete","deletecollection"]
|
||||
- apiGroups: ["apps"]
|
||||
resources: ["deployments","statefulsets","daemonsets","replicasets"]
|
||||
verbs: ["list","get"]
|
||||
- apiGroups: ["apps.openshift.io"]
|
||||
resources: ["deploymentconfigs"]
|
||||
verbs: ["list","get"]
|
||||
- apiGroups: ["argoproj.io"]
|
||||
resources: ["rollouts"]
|
||||
verbs: ["list","get"]
|
||||
- apiGroups: ["litmuschaos.io"]
|
||||
resources: ["chaosengines","chaosexperiments","chaosresults"]
|
||||
verbs: ["create","list","get","patch","update"]
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: RoleBinding
|
||||
metadata:
|
||||
name: pod-io-stress-sa
|
||||
namespace: default
|
||||
labels:
|
||||
name: pod-io-stress-sa
|
||||
app.kubernetes.io/part-of: litmus
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: Role
|
||||
name: pod-io-stress-sa
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: pod-io-stress-sa
|
||||
namespace: default
|
||||
```
|
||||
Use this sample RBAC manifest to create a chaosServiceAccount in the desired (app) namespace. This example consists of the minimum necessary role permissions to execute the experiment.
|
||||
??? note "View the Minimal RBAC permissions"
|
||||
|
||||
[embedmd]:# (https://raw.githubusercontent.com/litmuschaos/chaos-charts/master/charts/generic/pod-io-stress/rbac.yaml yaml)
|
||||
```yaml
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
name: pod-io-stress-sa
|
||||
namespace: default
|
||||
labels:
|
||||
name: pod-io-stress-sa
|
||||
app.kubernetes.io/part-of: litmus
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: Role
|
||||
metadata:
|
||||
name: pod-io-stress-sa
|
||||
namespace: default
|
||||
labels:
|
||||
name: pod-io-stress-sa
|
||||
app.kubernetes.io/part-of: litmus
|
||||
rules:
|
||||
- apiGroups: [""]
|
||||
resources: ["pods","events"]
|
||||
verbs: ["create","list","get","patch","update","delete","deletecollection"]
|
||||
- apiGroups: [""]
|
||||
resources: ["pods/exec","pods/log","replicationcontrollers"]
|
||||
verbs: ["create","list","get"]
|
||||
- apiGroups: ["batch"]
|
||||
resources: ["jobs"]
|
||||
verbs: ["create","list","get","delete","deletecollection"]
|
||||
- apiGroups: ["apps"]
|
||||
resources: ["deployments","statefulsets","daemonsets","replicasets"]
|
||||
verbs: ["list","get"]
|
||||
- apiGroups: ["apps.openshift.io"]
|
||||
resources: ["deploymentconfigs"]
|
||||
verbs: ["list","get"]
|
||||
- apiGroups: ["argoproj.io"]
|
||||
resources: ["rollouts"]
|
||||
verbs: ["list","get"]
|
||||
- apiGroups: ["litmuschaos.io"]
|
||||
resources: ["chaosengines","chaosexperiments","chaosresults"]
|
||||
verbs: ["create","list","get","patch","update"]
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: RoleBinding
|
||||
metadata:
|
||||
name: pod-io-stress-sa
|
||||
namespace: default
|
||||
labels:
|
||||
name: pod-io-stress-sa
|
||||
app.kubernetes.io/part-of: litmus
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: Role
|
||||
name: pod-io-stress-sa
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: pod-io-stress-sa
|
||||
namespace: default
|
||||
```
|
||||
Use this sample RBAC manifest to create a chaosServiceAccount in the desired (app) namespace. This example consists of the minimum necessary role permissions to execute the experiment.
|
||||
|
||||
## Experiment tunables
|
||||
|
||||
|
|
|
|||
|
|
@ -28,69 +28,72 @@
|
|||
|
||||
## Minimal RBAC configuration example (optional)
|
||||
|
||||
??? note "View the Minimal RBAC permissions"
|
||||
!!! tip "NOTE"
|
||||
If you are using this experiment as part of a litmus workflow scheduled constructed & executed from chaos-center, then you may be making use of the [litmus-admin](https://litmuschaos.github.io/litmus/litmus-admin-rbac.yaml) RBAC, which is pre installed in the cluster as part of the agent setup.
|
||||
|
||||
[embedmd]:# (https://raw.githubusercontent.com/litmuschaos/chaos-charts/master/charts/generic/pod-memory-hog-exec/rbac.yaml yaml)
|
||||
```yaml
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
name: pod-memory-hog-exec-sa
|
||||
namespace: default
|
||||
labels:
|
||||
name: pod-memory-hog-exec-sa
|
||||
app.kubernetes.io/part-of: litmus
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: Role
|
||||
metadata:
|
||||
name: pod-memory-hog-exec-sa
|
||||
namespace: default
|
||||
labels:
|
||||
name: pod-memory-hog-exec-sa
|
||||
app.kubernetes.io/part-of: litmus
|
||||
rules:
|
||||
- apiGroups: [""]
|
||||
resources: ["pods","events"]
|
||||
verbs: ["create","list","get","patch","update","delete","deletecollection"]
|
||||
- apiGroups: [""]
|
||||
resources: ["pods/exec","pods/log","replicationcontrollers"]
|
||||
verbs: ["create","list","get"]
|
||||
- apiGroups: ["batch"]
|
||||
resources: ["jobs"]
|
||||
verbs: ["create","list","get","delete","deletecollection"]
|
||||
- apiGroups: ["apps"]
|
||||
resources: ["deployments","statefulsets","daemonsets","replicasets"]
|
||||
verbs: ["list","get"]
|
||||
- apiGroups: ["apps.openshift.io"]
|
||||
resources: ["deploymentconfigs"]
|
||||
verbs: ["list","get"]
|
||||
- apiGroups: ["argoproj.io"]
|
||||
resources: ["rollouts"]
|
||||
verbs: ["list","get"]
|
||||
- apiGroups: ["litmuschaos.io"]
|
||||
resources: ["chaosengines","chaosexperiments","chaosresults"]
|
||||
verbs: ["create","list","get","patch","update"]
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: RoleBinding
|
||||
metadata:
|
||||
name: pod-memory-hog-exec-sa
|
||||
namespace: default
|
||||
labels:
|
||||
name: pod-memory-hog-exec-sa
|
||||
app.kubernetes.io/part-of: litmus
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: Role
|
||||
name: pod-memory-hog-exec-sa
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: pod-memory-hog-exec-sa
|
||||
namespace: default
|
||||
```
|
||||
Use this sample RBAC manifest to create a chaosServiceAccount in the desired (app) namespace. This example consists of the minimum necessary role permissions to execute the experiment.
|
||||
??? note "View the Minimal RBAC permissions"
|
||||
|
||||
[embedmd]:# (https://raw.githubusercontent.com/litmuschaos/chaos-charts/master/charts/generic/pod-memory-hog-exec/rbac.yaml yaml)
|
||||
```yaml
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
name: pod-memory-hog-exec-sa
|
||||
namespace: default
|
||||
labels:
|
||||
name: pod-memory-hog-exec-sa
|
||||
app.kubernetes.io/part-of: litmus
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: Role
|
||||
metadata:
|
||||
name: pod-memory-hog-exec-sa
|
||||
namespace: default
|
||||
labels:
|
||||
name: pod-memory-hog-exec-sa
|
||||
app.kubernetes.io/part-of: litmus
|
||||
rules:
|
||||
- apiGroups: [""]
|
||||
resources: ["pods","events"]
|
||||
verbs: ["create","list","get","patch","update","delete","deletecollection"]
|
||||
- apiGroups: [""]
|
||||
resources: ["pods/exec","pods/log","replicationcontrollers"]
|
||||
verbs: ["create","list","get"]
|
||||
- apiGroups: ["batch"]
|
||||
resources: ["jobs"]
|
||||
verbs: ["create","list","get","delete","deletecollection"]
|
||||
- apiGroups: ["apps"]
|
||||
resources: ["deployments","statefulsets","daemonsets","replicasets"]
|
||||
verbs: ["list","get"]
|
||||
- apiGroups: ["apps.openshift.io"]
|
||||
resources: ["deploymentconfigs"]
|
||||
verbs: ["list","get"]
|
||||
- apiGroups: ["argoproj.io"]
|
||||
resources: ["rollouts"]
|
||||
verbs: ["list","get"]
|
||||
- apiGroups: ["litmuschaos.io"]
|
||||
resources: ["chaosengines","chaosexperiments","chaosresults"]
|
||||
verbs: ["create","list","get","patch","update"]
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: RoleBinding
|
||||
metadata:
|
||||
name: pod-memory-hog-exec-sa
|
||||
namespace: default
|
||||
labels:
|
||||
name: pod-memory-hog-exec-sa
|
||||
app.kubernetes.io/part-of: litmus
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: Role
|
||||
name: pod-memory-hog-exec-sa
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: pod-memory-hog-exec-sa
|
||||
namespace: default
|
||||
```
|
||||
Use this sample RBAC manifest to create a chaosServiceAccount in the desired (app) namespace. This example consists of the minimum necessary role permissions to execute the experiment.
|
||||
|
||||
## Experiment tunables
|
||||
|
||||
|
|
|
|||
|
|
@ -27,69 +27,72 @@
|
|||
|
||||
## Minimal RBAC configuration example (optional)
|
||||
|
||||
??? note "View the Minimal RBAC permissions"
|
||||
!!! tip "NOTE"
|
||||
If you are using this experiment as part of a litmus workflow scheduled constructed & executed from chaos-center, then you may be making use of the [litmus-admin](https://litmuschaos.github.io/litmus/litmus-admin-rbac.yaml) RBAC, which is pre installed in the cluster as part of the agent setup.
|
||||
|
||||
[embedmd]:# (https://raw.githubusercontent.com/litmuschaos/chaos-charts/master/charts/generic/pod-memory-hog/rbac.yaml yaml)
|
||||
```yaml
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
name: pod-memory-hog-sa
|
||||
namespace: default
|
||||
labels:
|
||||
name: pod-memory-hog-sa
|
||||
app.kubernetes.io/part-of: litmus
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: Role
|
||||
metadata:
|
||||
name: pod-memory-hog-sa
|
||||
namespace: default
|
||||
labels:
|
||||
name: pod-memory-hog-sa
|
||||
app.kubernetes.io/part-of: litmus
|
||||
rules:
|
||||
- apiGroups: [""]
|
||||
resources: ["pods","events"]
|
||||
verbs: ["create","list","get","patch","update","delete","deletecollection"]
|
||||
- apiGroups: [""]
|
||||
resources: ["pods/exec","pods/log","replicationcontrollers"]
|
||||
verbs: ["create","list","get"]
|
||||
- apiGroups: ["batch"]
|
||||
resources: ["jobs"]
|
||||
verbs: ["create","list","get","delete","deletecollection"]
|
||||
- apiGroups: ["apps"]
|
||||
resources: ["deployments","statefulsets","daemonsets","replicasets"]
|
||||
verbs: ["list","get"]
|
||||
- apiGroups: ["apps.openshift.io"]
|
||||
resources: ["deploymentconfigs"]
|
||||
verbs: ["list","get"]
|
||||
- apiGroups: ["argoproj.io"]
|
||||
resources: ["rollouts"]
|
||||
verbs: ["list","get"]
|
||||
- apiGroups: ["litmuschaos.io"]
|
||||
resources: ["chaosengines","chaosexperiments","chaosresults"]
|
||||
verbs: ["create","list","get","patch","update"]
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: RoleBinding
|
||||
metadata:
|
||||
name: pod-memory-hog-sa
|
||||
namespace: default
|
||||
labels:
|
||||
name: pod-memory-hog-sa
|
||||
app.kubernetes.io/part-of: litmus
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: Role
|
||||
name: pod-memory-hog-sa
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: pod-memory-hog-sa
|
||||
namespace: default
|
||||
```
|
||||
Use this sample RBAC manifest to create a chaosServiceAccount in the desired (app) namespace. This example consists of the minimum necessary role permissions to execute the experiment.
|
||||
??? note "View the Minimal RBAC permissions"
|
||||
|
||||
[embedmd]:# (https://raw.githubusercontent.com/litmuschaos/chaos-charts/master/charts/generic/pod-memory-hog/rbac.yaml yaml)
|
||||
```yaml
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
name: pod-memory-hog-sa
|
||||
namespace: default
|
||||
labels:
|
||||
name: pod-memory-hog-sa
|
||||
app.kubernetes.io/part-of: litmus
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: Role
|
||||
metadata:
|
||||
name: pod-memory-hog-sa
|
||||
namespace: default
|
||||
labels:
|
||||
name: pod-memory-hog-sa
|
||||
app.kubernetes.io/part-of: litmus
|
||||
rules:
|
||||
- apiGroups: [""]
|
||||
resources: ["pods","events"]
|
||||
verbs: ["create","list","get","patch","update","delete","deletecollection"]
|
||||
- apiGroups: [""]
|
||||
resources: ["pods/exec","pods/log","replicationcontrollers"]
|
||||
verbs: ["create","list","get"]
|
||||
- apiGroups: ["batch"]
|
||||
resources: ["jobs"]
|
||||
verbs: ["create","list","get","delete","deletecollection"]
|
||||
- apiGroups: ["apps"]
|
||||
resources: ["deployments","statefulsets","daemonsets","replicasets"]
|
||||
verbs: ["list","get"]
|
||||
- apiGroups: ["apps.openshift.io"]
|
||||
resources: ["deploymentconfigs"]
|
||||
verbs: ["list","get"]
|
||||
- apiGroups: ["argoproj.io"]
|
||||
resources: ["rollouts"]
|
||||
verbs: ["list","get"]
|
||||
- apiGroups: ["litmuschaos.io"]
|
||||
resources: ["chaosengines","chaosexperiments","chaosresults"]
|
||||
verbs: ["create","list","get","patch","update"]
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: RoleBinding
|
||||
metadata:
|
||||
name: pod-memory-hog-sa
|
||||
namespace: default
|
||||
labels:
|
||||
name: pod-memory-hog-sa
|
||||
app.kubernetes.io/part-of: litmus
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: Role
|
||||
name: pod-memory-hog-sa
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: pod-memory-hog-sa
|
||||
namespace: default
|
||||
```
|
||||
Use this sample RBAC manifest to create a chaosServiceAccount in the desired (app) namespace. This example consists of the minimum necessary role permissions to execute the experiment.
|
||||
|
||||
## Experiment tunables
|
||||
|
||||
|
|
|
|||
|
|
@ -25,69 +25,72 @@
|
|||
|
||||
## Minimal RBAC configuration example (optional)
|
||||
|
||||
??? note "View the Minimal RBAC permissions"
|
||||
!!! tip "NOTE"
|
||||
If you are using this experiment as part of a litmus workflow scheduled constructed & executed from chaos-center, then you may be making use of the [litmus-admin](https://litmuschaos.github.io/litmus/litmus-admin-rbac.yaml) RBAC, which is pre installed in the cluster as part of the agent setup.
|
||||
|
||||
[embedmd]:# (https://raw.githubusercontent.com/litmuschaos/chaos-charts/master/charts/generic/pod-network-corruption/rbac.yaml yaml)
|
||||
```yaml
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
name: pod-network-corruption-sa
|
||||
namespace: default
|
||||
labels:
|
||||
name: pod-network-corruption-sa
|
||||
app.kubernetes.io/part-of: litmus
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: Role
|
||||
metadata:
|
||||
name: pod-network-corruption-sa
|
||||
namespace: default
|
||||
labels:
|
||||
name: pod-network-corruption-sa
|
||||
app.kubernetes.io/part-of: litmus
|
||||
rules:
|
||||
- apiGroups: [""]
|
||||
resources: ["pods","events"]
|
||||
verbs: ["create","list","get","patch","update","delete","deletecollection"]
|
||||
- apiGroups: [""]
|
||||
resources: ["pods/exec","pods/log","replicationcontrollers"]
|
||||
verbs: ["create","list","get"]
|
||||
- apiGroups: ["batch"]
|
||||
resources: ["jobs"]
|
||||
verbs: ["create","list","get","delete","deletecollection"]
|
||||
- apiGroups: ["apps"]
|
||||
resources: ["deployments","statefulsets","daemonsets","replicasets"]
|
||||
verbs: ["list","get"]
|
||||
- apiGroups: ["apps.openshift.io"]
|
||||
resources: ["deploymentconfigs"]
|
||||
verbs: ["list","get"]
|
||||
- apiGroups: ["argoproj.io"]
|
||||
resources: ["rollouts"]
|
||||
verbs: ["list","get"]
|
||||
- apiGroups: ["litmuschaos.io"]
|
||||
resources: ["chaosengines","chaosexperiments","chaosresults"]
|
||||
verbs: ["create","list","get","patch","update"]
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: RoleBinding
|
||||
metadata:
|
||||
name: pod-network-corruption-sa
|
||||
namespace: default
|
||||
labels:
|
||||
name: pod-network-corruption-sa
|
||||
app.kubernetes.io/part-of: litmus
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: Role
|
||||
name: pod-network-corruption-sa
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: pod-network-corruption-sa
|
||||
namespace: default
|
||||
```
|
||||
Use this sample RBAC manifest to create a chaosServiceAccount in the desired (app) namespace. This example consists of the minimum necessary role permissions to execute the experiment.
|
||||
??? note "View the Minimal RBAC permissions"
|
||||
|
||||
[embedmd]:# (https://raw.githubusercontent.com/litmuschaos/chaos-charts/master/charts/generic/pod-network-corruption/rbac.yaml yaml)
|
||||
```yaml
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
name: pod-network-corruption-sa
|
||||
namespace: default
|
||||
labels:
|
||||
name: pod-network-corruption-sa
|
||||
app.kubernetes.io/part-of: litmus
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: Role
|
||||
metadata:
|
||||
name: pod-network-corruption-sa
|
||||
namespace: default
|
||||
labels:
|
||||
name: pod-network-corruption-sa
|
||||
app.kubernetes.io/part-of: litmus
|
||||
rules:
|
||||
- apiGroups: [""]
|
||||
resources: ["pods","events"]
|
||||
verbs: ["create","list","get","patch","update","delete","deletecollection"]
|
||||
- apiGroups: [""]
|
||||
resources: ["pods/exec","pods/log","replicationcontrollers"]
|
||||
verbs: ["create","list","get"]
|
||||
- apiGroups: ["batch"]
|
||||
resources: ["jobs"]
|
||||
verbs: ["create","list","get","delete","deletecollection"]
|
||||
- apiGroups: ["apps"]
|
||||
resources: ["deployments","statefulsets","daemonsets","replicasets"]
|
||||
verbs: ["list","get"]
|
||||
- apiGroups: ["apps.openshift.io"]
|
||||
resources: ["deploymentconfigs"]
|
||||
verbs: ["list","get"]
|
||||
- apiGroups: ["argoproj.io"]
|
||||
resources: ["rollouts"]
|
||||
verbs: ["list","get"]
|
||||
- apiGroups: ["litmuschaos.io"]
|
||||
resources: ["chaosengines","chaosexperiments","chaosresults"]
|
||||
verbs: ["create","list","get","patch","update"]
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: RoleBinding
|
||||
metadata:
|
||||
name: pod-network-corruption-sa
|
||||
namespace: default
|
||||
labels:
|
||||
name: pod-network-corruption-sa
|
||||
app.kubernetes.io/part-of: litmus
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: Role
|
||||
name: pod-network-corruption-sa
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: pod-network-corruption-sa
|
||||
namespace: default
|
||||
```
|
||||
Use this sample RBAC manifest to create a chaosServiceAccount in the desired (app) namespace. This example consists of the minimum necessary role permissions to execute the experiment.
|
||||
|
||||
## Experiment tunables
|
||||
|
||||
|
|
|
|||
|
|
@ -25,68 +25,71 @@
|
|||
|
||||
## Minimal RBAC configuration example (optional)
|
||||
|
||||
??? note "View the Minimal RBAC permissions"
|
||||
!!! tip "NOTE"
|
||||
If you are using this experiment as part of a litmus workflow scheduled constructed & executed from chaos-center, then you may be making use of the [litmus-admin](https://litmuschaos.github.io/litmus/litmus-admin-rbac.yaml) RBAC, which is pre installed in the cluster as part of the agent setup.
|
||||
|
||||
[embedmd]:# (https://raw.githubusercontent.com/litmuschaos/chaos-charts/master/charts/generic/pod-network-duplication/rbac.yaml yaml)
|
||||
```yaml
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
name: pod-network-duplication-sa
|
||||
namespace: default
|
||||
labels:
|
||||
name: pod-network-duplication-sa
|
||||
app.kubernetes.io/part-of: litmus
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: Role
|
||||
metadata:
|
||||
name: pod-network-duplication-sa
|
||||
namespace: default
|
||||
labels:
|
||||
name: pod-network-duplication-sa
|
||||
app.kubernetes.io/part-of: litmus
|
||||
rules:
|
||||
- apiGroups: [""]
|
||||
resources: ["pods","events"]
|
||||
verbs: ["create","list","get","patch","update","delete","deletecollection"]
|
||||
- apiGroups: [""]
|
||||
resources: ["pods/exec","pods/log","replicationcontrollers"]
|
||||
verbs: ["create","list","get"]
|
||||
- apiGroups: ["batch"]
|
||||
resources: ["jobs"]
|
||||
verbs: ["create","list","get","delete","deletecollection"]
|
||||
- apiGroups: ["apps"]
|
||||
resources: ["deployments","statefulsets","daemonsets","replicasets"]
|
||||
verbs: ["list","get"]
|
||||
- apiGroups: ["apps.openshift.io"]
|
||||
resources: ["deploymentconfigs"]
|
||||
verbs: ["list","get"]
|
||||
- apiGroups: ["argoproj.io"]
|
||||
resources: ["rollouts"]
|
||||
verbs: ["list","get"]
|
||||
- apiGroups: ["litmuschaos.io"]
|
||||
resources: ["chaosengines","chaosexperiments","chaosresults"]
|
||||
verbs: ["create","list","get","patch","update"]
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: RoleBinding
|
||||
metadata:
|
||||
name: pod-network-duplication-sa
|
||||
namespace: default
|
||||
labels:
|
||||
name: pod-network-duplication-sa
|
||||
app.kubernetes.io/part-of: litmus
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: Role
|
||||
name: pod-network-duplication-sa
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: pod-network-duplication-sa
|
||||
namespace: default
|
||||
```
|
||||
Use this sample RBAC manifest to create a chaosServiceAccount in the desired (app) namespace. This example consists of the minimum necessary role permissions to execute the experiment.
|
||||
??? note "View the Minimal RBAC permissions"
|
||||
|
||||
[embedmd]:# (https://raw.githubusercontent.com/litmuschaos/chaos-charts/master/charts/generic/pod-network-duplication/rbac.yaml yaml)
|
||||
```yaml
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
name: pod-network-duplication-sa
|
||||
namespace: default
|
||||
labels:
|
||||
name: pod-network-duplication-sa
|
||||
app.kubernetes.io/part-of: litmus
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: Role
|
||||
metadata:
|
||||
name: pod-network-duplication-sa
|
||||
namespace: default
|
||||
labels:
|
||||
name: pod-network-duplication-sa
|
||||
app.kubernetes.io/part-of: litmus
|
||||
rules:
|
||||
- apiGroups: [""]
|
||||
resources: ["pods","events"]
|
||||
verbs: ["create","list","get","patch","update","delete","deletecollection"]
|
||||
- apiGroups: [""]
|
||||
resources: ["pods/exec","pods/log","replicationcontrollers"]
|
||||
verbs: ["create","list","get"]
|
||||
- apiGroups: ["batch"]
|
||||
resources: ["jobs"]
|
||||
verbs: ["create","list","get","delete","deletecollection"]
|
||||
- apiGroups: ["apps"]
|
||||
resources: ["deployments","statefulsets","daemonsets","replicasets"]
|
||||
verbs: ["list","get"]
|
||||
- apiGroups: ["apps.openshift.io"]
|
||||
resources: ["deploymentconfigs"]
|
||||
verbs: ["list","get"]
|
||||
- apiGroups: ["argoproj.io"]
|
||||
resources: ["rollouts"]
|
||||
verbs: ["list","get"]
|
||||
- apiGroups: ["litmuschaos.io"]
|
||||
resources: ["chaosengines","chaosexperiments","chaosresults"]
|
||||
verbs: ["create","list","get","patch","update"]
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: RoleBinding
|
||||
metadata:
|
||||
name: pod-network-duplication-sa
|
||||
namespace: default
|
||||
labels:
|
||||
name: pod-network-duplication-sa
|
||||
app.kubernetes.io/part-of: litmus
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: Role
|
||||
name: pod-network-duplication-sa
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: pod-network-duplication-sa
|
||||
namespace: default
|
||||
```
|
||||
Use this sample RBAC manifest to create a chaosServiceAccount in the desired (app) namespace. This example consists of the minimum necessary role permissions to execute the experiment.
|
||||
|
||||
## Experiment tunables
|
||||
|
||||
|
|
|
|||
|
|
@ -30,69 +30,72 @@
|
|||
|
||||
## Minimal RBAC configuration example (optional)
|
||||
|
||||
??? note "View the Minimal RBAC permissions"
|
||||
!!! tip "NOTE"
|
||||
If you are using this experiment as part of a litmus workflow scheduled constructed & executed from chaos-center, then you may be making use of the [litmus-admin](https://litmuschaos.github.io/litmus/litmus-admin-rbac.yaml) RBAC, which is pre installed in the cluster as part of the agent setup.
|
||||
|
||||
[embedmd]:# (https://raw.githubusercontent.com/litmuschaos/chaos-charts/master/charts/generic/pod-network-latency/rbac.yaml yaml)
|
||||
```yaml
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
name: pod-network-latency-sa
|
||||
namespace: default
|
||||
labels:
|
||||
name: pod-network-latency-sa
|
||||
app.kubernetes.io/part-of: litmus
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: Role
|
||||
metadata:
|
||||
name: pod-network-latency-sa
|
||||
namespace: default
|
||||
labels:
|
||||
name: pod-network-latency-sa
|
||||
app.kubernetes.io/part-of: litmus
|
||||
rules:
|
||||
- apiGroups: [""]
|
||||
resources: ["pods","events"]
|
||||
verbs: ["create","list","get","patch","update","delete","deletecollection"]
|
||||
- apiGroups: [""]
|
||||
resources: ["pods/exec","pods/log","replicationcontrollers"]
|
||||
verbs: ["create","list","get"]
|
||||
- apiGroups: ["batch"]
|
||||
resources: ["jobs"]
|
||||
verbs: ["create","list","get","delete","deletecollection"]
|
||||
- apiGroups: ["apps"]
|
||||
resources: ["deployments","statefulsets","daemonsets","replicasets"]
|
||||
verbs: ["list","get"]
|
||||
- apiGroups: ["apps.openshift.io"]
|
||||
resources: ["deploymentconfigs"]
|
||||
verbs: ["list","get"]
|
||||
- apiGroups: ["argoproj.io"]
|
||||
resources: ["rollouts"]
|
||||
verbs: ["list","get"]
|
||||
- apiGroups: ["litmuschaos.io"]
|
||||
resources: ["chaosengines","chaosexperiments","chaosresults"]
|
||||
verbs: ["create","list","get","patch","update"]
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: RoleBinding
|
||||
metadata:
|
||||
name: pod-network-latency-sa
|
||||
namespace: default
|
||||
labels:
|
||||
name: pod-network-latency-sa
|
||||
app.kubernetes.io/part-of: litmus
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: Role
|
||||
name: pod-network-latency-sa
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: pod-network-latency-sa
|
||||
namespace: default
|
||||
```
|
||||
Use this sample RBAC manifest to create a chaosServiceAccount in the desired (app) namespace. This example consists of the minimum necessary role permissions to execute the experiment.
|
||||
??? note "View the Minimal RBAC permissions"
|
||||
|
||||
[embedmd]:# (https://raw.githubusercontent.com/litmuschaos/chaos-charts/master/charts/generic/pod-network-latency/rbac.yaml yaml)
|
||||
```yaml
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
name: pod-network-latency-sa
|
||||
namespace: default
|
||||
labels:
|
||||
name: pod-network-latency-sa
|
||||
app.kubernetes.io/part-of: litmus
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: Role
|
||||
metadata:
|
||||
name: pod-network-latency-sa
|
||||
namespace: default
|
||||
labels:
|
||||
name: pod-network-latency-sa
|
||||
app.kubernetes.io/part-of: litmus
|
||||
rules:
|
||||
- apiGroups: [""]
|
||||
resources: ["pods","events"]
|
||||
verbs: ["create","list","get","patch","update","delete","deletecollection"]
|
||||
- apiGroups: [""]
|
||||
resources: ["pods/exec","pods/log","replicationcontrollers"]
|
||||
verbs: ["create","list","get"]
|
||||
- apiGroups: ["batch"]
|
||||
resources: ["jobs"]
|
||||
verbs: ["create","list","get","delete","deletecollection"]
|
||||
- apiGroups: ["apps"]
|
||||
resources: ["deployments","statefulsets","daemonsets","replicasets"]
|
||||
verbs: ["list","get"]
|
||||
- apiGroups: ["apps.openshift.io"]
|
||||
resources: ["deploymentconfigs"]
|
||||
verbs: ["list","get"]
|
||||
- apiGroups: ["argoproj.io"]
|
||||
resources: ["rollouts"]
|
||||
verbs: ["list","get"]
|
||||
- apiGroups: ["litmuschaos.io"]
|
||||
resources: ["chaosengines","chaosexperiments","chaosresults"]
|
||||
verbs: ["create","list","get","patch","update"]
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: RoleBinding
|
||||
metadata:
|
||||
name: pod-network-latency-sa
|
||||
namespace: default
|
||||
labels:
|
||||
name: pod-network-latency-sa
|
||||
app.kubernetes.io/part-of: litmus
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: Role
|
||||
name: pod-network-latency-sa
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: pod-network-latency-sa
|
||||
namespace: default
|
||||
```
|
||||
Use this sample RBAC manifest to create a chaosServiceAccount in the desired (app) namespace. This example consists of the minimum necessary role permissions to execute the experiment.
|
||||
|
||||
## Experiment tunables
|
||||
|
||||
|
|
|
|||
|
|
@ -25,68 +25,71 @@
|
|||
|
||||
## Minimal RBAC configuration example (optional)
|
||||
|
||||
??? note "View the Minimal RBAC permissions"
|
||||
!!! tip "NOTE"
|
||||
If you are using this experiment as part of a litmus workflow scheduled constructed & executed from chaos-center, then you may be making use of the [litmus-admin](https://litmuschaos.github.io/litmus/litmus-admin-rbac.yaml) RBAC, which is pre installed in the cluster as part of the agent setup.
|
||||
|
||||
[embedmd]:# (https://raw.githubusercontent.com/litmuschaos/chaos-charts/master/charts/generic/pod-network-loss/rbac.yaml yaml)
|
||||
```yaml
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
name: pod-network-loss-sa
|
||||
namespace: default
|
||||
labels:
|
||||
name: pod-network-loss-sa
|
||||
app.kubernetes.io/part-of: litmus
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: Role
|
||||
metadata:
|
||||
name: pod-network-loss-sa
|
||||
namespace: default
|
||||
labels:
|
||||
name: pod-network-loss-sa
|
||||
app.kubernetes.io/part-of: litmus
|
||||
rules:
|
||||
- apiGroups: [""]
|
||||
resources: ["pods","events"]
|
||||
verbs: ["create","list","get","patch","update","delete","deletecollection"]
|
||||
- apiGroups: [""]
|
||||
resources: ["pods/exec","pods/log","replicationcontrollers"]
|
||||
verbs: ["create","list","get"]
|
||||
- apiGroups: ["batch"]
|
||||
resources: ["jobs"]
|
||||
verbs: ["create","list","get","delete","deletecollection"]
|
||||
- apiGroups: ["apps"]
|
||||
resources: ["deployments","statefulsets","daemonsets","replicasets"]
|
||||
verbs: ["list","get"]
|
||||
- apiGroups: ["apps.openshift.io"]
|
||||
resources: ["deploymentconfigs"]
|
||||
verbs: ["list","get"]
|
||||
- apiGroups: ["argoproj.io"]
|
||||
resources: ["rollouts"]
|
||||
verbs: ["list","get"]
|
||||
- apiGroups: ["litmuschaos.io"]
|
||||
resources: ["chaosengines","chaosexperiments","chaosresults"]
|
||||
verbs: ["create","list","get","patch","update"]
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: RoleBinding
|
||||
metadata:
|
||||
name: pod-network-loss-sa
|
||||
namespace: default
|
||||
labels:
|
||||
name: pod-network-loss-sa
|
||||
app.kubernetes.io/part-of: litmus
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: Role
|
||||
name: pod-network-loss-sa
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: pod-network-loss-sa
|
||||
namespace: default
|
||||
```
|
||||
Use this sample RBAC manifest to create a chaosServiceAccount in the desired (app) namespace. This example consists of the minimum necessary role permissions to execute the experiment.
|
||||
??? note "View the Minimal RBAC permissions"
|
||||
|
||||
[embedmd]:# (https://raw.githubusercontent.com/litmuschaos/chaos-charts/master/charts/generic/pod-network-loss/rbac.yaml yaml)
|
||||
```yaml
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
name: pod-network-loss-sa
|
||||
namespace: default
|
||||
labels:
|
||||
name: pod-network-loss-sa
|
||||
app.kubernetes.io/part-of: litmus
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: Role
|
||||
metadata:
|
||||
name: pod-network-loss-sa
|
||||
namespace: default
|
||||
labels:
|
||||
name: pod-network-loss-sa
|
||||
app.kubernetes.io/part-of: litmus
|
||||
rules:
|
||||
- apiGroups: [""]
|
||||
resources: ["pods","events"]
|
||||
verbs: ["create","list","get","patch","update","delete","deletecollection"]
|
||||
- apiGroups: [""]
|
||||
resources: ["pods/exec","pods/log","replicationcontrollers"]
|
||||
verbs: ["create","list","get"]
|
||||
- apiGroups: ["batch"]
|
||||
resources: ["jobs"]
|
||||
verbs: ["create","list","get","delete","deletecollection"]
|
||||
- apiGroups: ["apps"]
|
||||
resources: ["deployments","statefulsets","daemonsets","replicasets"]
|
||||
verbs: ["list","get"]
|
||||
- apiGroups: ["apps.openshift.io"]
|
||||
resources: ["deploymentconfigs"]
|
||||
verbs: ["list","get"]
|
||||
- apiGroups: ["argoproj.io"]
|
||||
resources: ["rollouts"]
|
||||
verbs: ["list","get"]
|
||||
- apiGroups: ["litmuschaos.io"]
|
||||
resources: ["chaosengines","chaosexperiments","chaosresults"]
|
||||
verbs: ["create","list","get","patch","update"]
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: RoleBinding
|
||||
metadata:
|
||||
name: pod-network-loss-sa
|
||||
namespace: default
|
||||
labels:
|
||||
name: pod-network-loss-sa
|
||||
app.kubernetes.io/part-of: litmus
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: Role
|
||||
name: pod-network-loss-sa
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: pod-network-loss-sa
|
||||
namespace: default
|
||||
```
|
||||
Use this sample RBAC manifest to create a chaosServiceAccount in the desired (app) namespace. This example consists of the minimum necessary role permissions to execute the experiment.
|
||||
|
||||
## Experiment tunables
|
||||
|
||||
|
|
|
|||
|
|
@ -43,58 +43,61 @@ Experiment uses vmware api's to start/stop the target vm.
|
|||
|
||||
## Minimal RBAC configuration example (optional)
|
||||
|
||||
??? note "View the Minimal RBAC permissions"
|
||||
!!! tip "NOTE"
|
||||
If you are using this experiment as part of a litmus workflow scheduled constructed & executed from chaos-center, then you may be making use of the [litmus-admin](https://litmuschaos.github.io/litmus/litmus-admin-rbac.yaml) RBAC, which is pre installed in the cluster as part of the agent setup.
|
||||
|
||||
[embedmd]:# (https://raw.githubusercontent.com/litmuschaos/chaos-charts/master/charts/vmware/vm-poweroff/rbac.yaml yaml)
|
||||
```yaml
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
name: vm-poweroff-sa
|
||||
namespace: default
|
||||
labels:
|
||||
name: vm-poweroff-sa
|
||||
app.kubernetes.io/part-of: litmus
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRole
|
||||
metadata:
|
||||
name: vm-poweroff-sa
|
||||
labels:
|
||||
name: vm-poweroff-sa
|
||||
app.kubernetes.io/part-of: litmus
|
||||
rules:
|
||||
- apiGroups: [""]
|
||||
resources: ["pods","events","secrets"]
|
||||
verbs: ["create","list","get","patch","update","delete","deletecollection"]
|
||||
- apiGroups: [""]
|
||||
resources: ["pods/exec","pods/log"]
|
||||
verbs: ["create","list","get"]
|
||||
- apiGroups: ["batch"]
|
||||
resources: ["jobs"]
|
||||
verbs: ["create","list","get","delete","deletecollection"]
|
||||
- apiGroups: ["litmuschaos.io"]
|
||||
resources: ["chaosengines","chaosexperiments","chaosresults"]
|
||||
verbs: ["create","list","get","patch","update"]
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRoleBinding
|
||||
metadata:
|
||||
name: vm-poweroff-sa
|
||||
labels:
|
||||
name: vm-poweroff-sa
|
||||
app.kubernetes.io/part-of: litmus
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: ClusterRole
|
||||
name: vm-poweroff-sa
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: vm-poweroff-sa
|
||||
namespace: default
|
||||
```
|
||||
Use this sample RBAC manifest to create a chaosServiceAccount in the desired (app) namespace. This example consists of the minimum necessary role permissions to execute the experiment.
|
||||
??? note "View the Minimal RBAC permissions"
|
||||
|
||||
[embedmd]:# (https://raw.githubusercontent.com/litmuschaos/chaos-charts/master/charts/vmware/vm-poweroff/rbac.yaml yaml)
|
||||
```yaml
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
name: vm-poweroff-sa
|
||||
namespace: default
|
||||
labels:
|
||||
name: vm-poweroff-sa
|
||||
app.kubernetes.io/part-of: litmus
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRole
|
||||
metadata:
|
||||
name: vm-poweroff-sa
|
||||
labels:
|
||||
name: vm-poweroff-sa
|
||||
app.kubernetes.io/part-of: litmus
|
||||
rules:
|
||||
- apiGroups: [""]
|
||||
resources: ["pods","events","secrets"]
|
||||
verbs: ["create","list","get","patch","update","delete","deletecollection"]
|
||||
- apiGroups: [""]
|
||||
resources: ["pods/exec","pods/log"]
|
||||
verbs: ["create","list","get"]
|
||||
- apiGroups: ["batch"]
|
||||
resources: ["jobs"]
|
||||
verbs: ["create","list","get","delete","deletecollection"]
|
||||
- apiGroups: ["litmuschaos.io"]
|
||||
resources: ["chaosengines","chaosexperiments","chaosresults"]
|
||||
verbs: ["create","list","get","patch","update"]
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRoleBinding
|
||||
metadata:
|
||||
name: vm-poweroff-sa
|
||||
labels:
|
||||
name: vm-poweroff-sa
|
||||
app.kubernetes.io/part-of: litmus
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: ClusterRole
|
||||
name: vm-poweroff-sa
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: vm-poweroff-sa
|
||||
namespace: default
|
||||
```
|
||||
Use this sample RBAC manifest to create a chaosServiceAccount in the desired (app) namespace. This example consists of the minimum necessary role permissions to execute the experiment.
|
||||
|
||||
## Experiment tunables
|
||||
|
||||
|
|
|
|||
|
|
@ -13,31 +13,31 @@ This section describes the fields in the ChaosEngine spec and the possible value
|
|||
<tr>
|
||||
<td>State Specification</td>
|
||||
<td>It defines the state of the chaosengine</td>
|
||||
<td><a href="/litmus/experiments/chaos-resources/chaos-engine/engine-state">State Specifications</a></td>
|
||||
<td><a href="/litmus/experiments/concepts/chaos-resources/chaos-engine/engine-state">State Specifications</a></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Application Specification</td>
|
||||
<td>It defines the details of AUT and auxiliary applications</td>
|
||||
<td><a href="/litmus/experiments/chaos-resources/chaos-engine/application-details">Application Specifications</a></td>
|
||||
<td><a href="/litmus/experiments/concepts/chaos-resources/chaos-engine/application-details">Application Specifications</a></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>RBAC Specification</td>
|
||||
<td>It defines the chaos-service-account name</td>
|
||||
<td><a href="/litmus/experiments/chaos-resources/chaos-engine/rbac-details">RBAC Specifications</a></td>
|
||||
<td><a href="/litmus/experiments/concepts/chaos-resources/chaos-engine/rbac-details">RBAC Specifications</a></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Runtime Specification</td>
|
||||
<td>It defines the runtime details of the chaosengine</td>
|
||||
<td><a href="/litmus/experiments/chaos-resources/chaos-engine/runtime-details">Runtime Specifications</a></td>
|
||||
<td><a href="/litmus/experiments/concepts/chaos-resources/chaos-engine/runtime-details">Runtime Specifications</a></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Runner Specification</td>
|
||||
<td>It defines the runner pod specifications</td>
|
||||
<td><a href="/litmus/experiments/chaos-resources/chaos-engine/runner-components">Runner Specifications</a></td>
|
||||
<td><a href="/litmus/experiments/concepts/chaos-resources/chaos-engine/runner-components">Runner Specifications</a></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Experiment Specification</td>
|
||||
<td>It defines the experiment pod specifications</td>
|
||||
<td><a href="/litmus/experiments/chaos-resources/chaos-engine/experiment-components">Experiment Specifications</a></td>
|
||||
<td><a href="/litmus/experiments/concepts/chaos-resources/chaos-engine/experiment-components">Experiment Specifications</a></td>
|
||||
</tr>
|
||||
</table>
|
||||
|
|
@ -13,21 +13,21 @@ This section describes the fields in the ChaosScheduler and the possible values
|
|||
<tr>
|
||||
<td>Schedule Once</td>
|
||||
<td>Schedule chaos once on specified time or now</td>
|
||||
<td><a href="/litmus/experiments/chaos-resources/chaos-scheduler/schedule-once">Schedule Once</a></td>
|
||||
<td><a href="/litmus/experiments/concepts/chaos-resources/chaos-scheduler/schedule-once">Schedule Once</a></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Repeat Schedule</td>
|
||||
<td>Schedule chaos in repeat mode</td>
|
||||
<td><a href="/litmus/experiments/chaos-resources/chaos-scheduler/schedule-repeat">Repeat Schedule</a></td>
|
||||
<td><a href="/litmus/experiments/concepts/chaos-resources/chaos-scheduler/schedule-repeat">Repeat Schedule</a></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Schedule State</td>
|
||||
<td>Defines the state of the schedule</td>
|
||||
<td><a href="/litmus/experiments/chaos-resources/chaos-scheduler/state">Schedule State</a></td>
|
||||
<td><a href="/litmus/experiments/concepts/chaos-resources/chaos-scheduler/state">Schedule State</a></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Engine Specifications</td>
|
||||
<td>Defines the chaosengine specifications</td>
|
||||
<td><a href="/litmus/experiments/chaos-resources/chaos-scheduler/engine-specification">Engine Specifications</a></td>
|
||||
<td><a href="/litmus/experiments/concepts/chaos-resources/chaos-scheduler/engine-specification">Engine Specifications</a></td>
|
||||
</tr>
|
||||
</table>
|
||||
|
|
@ -11,26 +11,26 @@ At the heart of the Litmus Platform are the chaos custom resources. This section
|
|||
<tr>
|
||||
<td>ChaosEngine</td>
|
||||
<td>Contains the ChaosEngine specifications user-guide</td>
|
||||
<td><a href="/litmus/experiments/chaos-resources/chaos-engine/contents/">ChaosEngine</a></td>
|
||||
<td><a href="/litmus/experiments/concepts/chaos-resources/chaos-engine/contents/">ChaosEngine</a></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>ChaosExperiment</td>
|
||||
<td>Contains the ChaosExperiment specifications user-guide</td>
|
||||
<td><a href="/litmus/experiments/chaos-resources/chaos-experiment/contents/">ChaosExperiment</a></td>
|
||||
<td><a href="/litmus/experiments/concepts/chaos-resources/chaos-experiment/contents/">ChaosExperiment</a></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>ChaosResult</td>
|
||||
<td>Contains the ChaosResult specifications user-guide</td>
|
||||
<td><a href="/litmus/experiments/chaos-resources/chaos-result/contents/">ChaosResult</a></td>
|
||||
<td><a href="/litmus/experiments/concepts/chaos-resources/chaos-result/contents/">ChaosResult</a></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>ChaosScheduler</td>
|
||||
<td>Contains the ChaosScheduler specifications user-guide</td>
|
||||
<td><a href="/litmus/experiments/chaos-resources/chaos-scheduler/contents/">ChaosScheduler</a></td>
|
||||
<td><a href="/litmus/experiments/concepts/chaos-resources/chaos-scheduler/contents/">ChaosScheduler</a></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Probes</td>
|
||||
<td>Contains the Probes specifications user-guide</td>
|
||||
<td><a href="/litmus/experiments/chaos-resources/probes/contents/">Probes</a></td>
|
||||
<td><a href="/litmus/experiments/concepts/chaos-resources/probes/contents/">Probes</a></td>
|
||||
</tr>
|
||||
</table>
|
||||
|
|
@ -11,21 +11,21 @@ Litmus probes are pluggable checks that can be defined within the ChaosEngine fo
|
|||
<tr>
|
||||
<td>Command Probe</td>
|
||||
<td>It defines the command probes</td>
|
||||
<td><a href="/litmus/experiments/chaos-resources/probes/cmdProbe">Command Probe</a></td>
|
||||
<td><a href="/litmus/experiments/concepts/chaos-resources/probes/cmdProbe">Command Probe</a></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>HTTP Probe</td>
|
||||
<td>It defines the http probes</td>
|
||||
<td><a href="/litmus/experiments/chaos-resources/probes/httpProbe">HTTP Probe</a></td>
|
||||
<td><a href="/litmus/experiments/concepts/chaos-resources/probes/httpProbe">HTTP Probe</a></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>K8S Probe</td>
|
||||
<td>It defines the k8s probes</td>
|
||||
<td><a href="/litmus/experiments/chaos-resources/probes/k8sProbe">K8S Probe</a></td>
|
||||
<td><a href="/litmus/experiments/concepts/chaos-resources/probes/k8sProbe">K8S Probe</a></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Prometheus Probe</td>
|
||||
<td>It defines the prometheus probes</td>
|
||||
<td><a href="/litmus/experiments/chaos-resources/probes/promProbe">Prometheus Probe</a></td>
|
||||
<td><a href="/litmus/experiments/concepts/chaos-resources/probes/promProbe">Prometheus Probe</a></td>
|
||||
</tr>
|
||||
</table>
|
||||
Some files were not shown because too many files have changed in this diff Show More
Loading…
Reference in New Issue