Skip to content

docs(operator): document the operator's cluster-wide permissions #576

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We鈥檒l occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
sklarsa merged 3 commits into from
Oct 13, 2026
Merged

docs(operator): document the operator's cluster-wide permissions #576

Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
d836190
docs(operator): document the operator's cluster-wide permissions
sklarsa Oct 9, 2026
4383956
docs(operator): drop the per-resource permissions table
sklarsa Oct 9, 2026
ab14760
docs(operator): fix double blank line
sklarsa Oct 9, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
39 changes: 39 additions & 0 deletions documentation/enterprise-kubernetes-operator/installation.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -50,6 +50,45 @@ Follow the complete cloud checklist before installing:
- [Amazon EKS onboarding](/docs/enterprise-kubernetes-operator/getting-started/aws/)
- [Azure AKS onboarding](/docs/enterprise-kubernetes-operator/getting-started/azure/)

## Operator permissions

The chart binds the operator's ServiceAccount to the
`questdb-operator-manager-role` ClusterRole with a ClusterRoleBinding, so its
permissions apply in every namespace. There is no namespace-scoped install mode:
one operator watches `QuestDBCluster` objects in all namespaces.

The full list of rules is in the chart's `templates/rbac/role.yaml`.

The chart also creates a namespaced Role in the operator's namespace for leader
election (Leases, ConfigMaps, Events), and, when metrics are enabled, a
ClusterRole to create TokenReviews and SubjectAccessReviews so it can check who
is reading `/metrics`.

### Secrets

The operator reads Secrets you point it at: the admin password
(`spec.auth.adminSecret`), object-store credentials, and PGWire TLS
certificates. It creates and updates Secrets of its own: a generated admin
password if you don't supply one, its own database login, the object-store
connection strings handed to the pods, and the webhook certificate in
self-signed mode.

It watches Secrets in every namespace so that a renewed TLS certificate takes
effect, but it keeps only their metadata (names and labels) in memory, never the
contents. It reads contents directly from the Kubernetes API when it needs them.

The role has no `delete` on Secrets, on purpose. The operator never deletes a
Secret. The ones it creates for a cluster are owned by that `QuestDBCluster`,
and Kubernetes removes them when you delete the cluster. The webhook certificate
Secret in the operator's namespace is never removed by the operator.

### Object store

The operator never touches your object store and has no cloud permissions. It
does not create or delete buckets, containers, or IAM roles, and never reads or
writes your data there. The QuestDB pods do all object-store I/O, with the
identity or credentials you configure.

## Canonical Helm install

The OCI chart on GHCR is public; its operator image is private. Replace the
Expand Down
Loading