Kubernetes service accounts and permissions

This reference describes the service accounts used in Mission Control and their associated permissions.

Each service account is granted the minimum permissions required to perform its specific tasks.

Service accounts

Service account Name Namespace Purpose Cluster Roles

Service account	Name	Namespace	Purpose	Cluster Roles
Agent	`mission-control-agent`	`mission-control`	Collects host-level metrics and logs	`mission-control-agent`
Aggregator	`mission-control-aggregator`	`mission-control`	Aggregates metrics and logs from all deployed and managed resources
Cass operator	`mission-control-cass-operator`	`mission-control`	Handles the lifecycle of all Apache Cassandra®, DataStax Enterprise (DSE), and Hyper-Converged Database (HCD) logical datacenters	`mission-control-cass-operator` Additional roles: `mission-control-cass-operator-leader`
CRD upgrader	`mission-control-crd-upgrader`	`mission-control`	Handles the upgrade of any Mission Control custom resource definition (CRD)	`mission-control-crd-upgrader`
Dex	`mission-control-dex`	`mission-control`	Handles the routing of authentication requests to the appropriate identity provider	`mission-control-dex` Additional roles: `mission-control-dex`
K8ssandra operator	`mission-control-k8ssandra-operator`	`mission-control`	Handles the lifecycle of all K8ssandra resources including cluster definitions, Reaper, and Medusa components	`mission-control-k8ssandra-operator` Additional roles: `mission-control-k8ssandra-operator-leader-election-role`
Kube state metrics	`mission-control-kube-state-metrics`	`mission-control`	Collects metrics from the Kubernetes API server and Kubelet	`mission-control-kube-state-metrics`
Loki	`loki`	`mission-control`	Stores and indexes log data	`mission-control-loki-clusterrole`
Mimir	`mission-control-mimir`	`mission-control`	Stores and indexes metrics data
Minio sa	`minio-sa`	`mission-control`	Object storage provider
Mission Control	`mission-control`	`mission-control`	Core platform management and orchestration of all Mission Control components	`mission-control-manager-role` The `mission-control-manager-role` is used by the `mission-control` service account to manage the core platform functionality.

Agent

mission-control-agent

mission-control

Collects host-level metrics and logs

mission-control-agent

Aggregator

mission-control-aggregator

mission-control

Aggregates metrics and logs from all deployed and managed resources

Cass operator

mission-control-cass-operator

mission-control

Handles the lifecycle of all Apache Cassandra®, DataStax Enterprise (DSE), and Hyper-Converged Database (HCD) logical datacenters

mission-control-cass-operator

Additional roles: mission-control-cass-operator-leader

CRD upgrader

mission-control-crd-upgrader

mission-control

Handles the upgrade of any Mission Control custom resource definition (CRD)

mission-control-crd-upgrader

Dex

mission-control-dex

mission-control

Handles the routing of authentication requests to the appropriate identity provider

mission-control-dex

Additional roles: mission-control-dex

K8ssandra operator

mission-control-k8ssandra-operator

mission-control

Handles the lifecycle of all K8ssandra resources including cluster definitions, Reaper, and Medusa components

mission-control-k8ssandra-operator

Additional roles: mission-control-k8ssandra-operator-leader-election-role

Kube state metrics

mission-control-kube-state-metrics

mission-control

Collects metrics from the Kubernetes API server and Kubelet

mission-control-kube-state-metrics

Loki

loki

mission-control

Stores and indexes log data

mission-control-loki-clusterrole

Mimir

mission-control-mimir

mission-control

Stores and indexes metrics data

Minio sa

minio-sa

mission-control

Object storage provider

Mission Control

mission-control

Core platform management and orchestration of all Mission Control components

mission-control-manager-role

The mission-control-manager-role is used by the mission-control service account to manage the core platform functionality.

Cluster role permissions

Cluster role API groups Resources Verbs

Cluster role	API groups	Resources	Verbs
Agent cluster role	core	`namespaces`, `nodes`, `pods`	`list`, `watch`
Cass operator cluster role	core	`configmaps`, `endpoints`, `events`, `persistentvolumeclaims`, `pods`, `secrets`, `services`	`create`, `delete`, `get`, `list`, `patch`, `update`, `watch`
Cass operator cluster role	core	`namespaces`	`get`
Cass operator cluster role	core	`persistentvolumes`	`get`, `list`, `watch`
Cass operator cluster role	storage.k8s.io	`storageclasses`	`get`, `list`, `watch`
Cass operator cluster role	apps	`daemonsets`, `deployments`, `replicasets`, `statefulsets`	`create`, `delete`, `get`, `list`, `patch`, `update`, `watch`
Cass operator cluster role	apps	`deployments/finalizers`	`update`
Cass operator cluster role	`cassandra.datastax.com`	`cassandradatacenters`	`create`, `delete`, `get`, `list`, `patch`, `update`, `watch`
Cass operator cluster role	`cassandra.datastax.com`	`cassandradatacenters/finalizers`	`delete`, `update`
Cass operator cluster role	`cassandra.datastax.com`	`cassandradatacenters/status`	`get`, `patch`, `update`
Cass operator cluster role	`control.k8ssandra.io`	`cassandratasks`	`create`, `delete`, `get`, `list`, `patch`, `update`, `watch`
Cass operator cluster role	`control.k8ssandra.io`	`cassandratasks/finalizers`	`update`
Cass operator cluster role	`control.k8ssandra.io`	`cassandratasks/status`	`get`, `patch`, `update`
Cass operator cluster role	policy	`poddisruptionbudgets`	`create`, `delete`, `get`, `list`, `patch`, `update`, `watch`
CRD upgrader cluster role	`apiextensions.k8s.io`	`customresourcedefinitions`	`create`, `get`, `watch`, `list`, `update`, `patch`
Dex cluster role	`apiextensions.k8s.io`	`customresourcedefinitions`	`list`, `create`
K8ssandra operator cluster role	`core`	`configmaps`, `endpoints`, `events`, `namespaces`, `nodes`, `pods`, `secrets`, `secrets/finalizer`, `services`	`create`, `delete`, `get`, `list`, `patch`, `update`, `watch`
K8ssandra operator cluster role	`apps`	`deployments`	`create`, `delete`, `get`, `list`, `patch`, `update`, `watch`
K8ssandra operator cluster role	`batch`	`cronjobs`	`create`, `delete`, `get`, `list`, `patch`, `update`, `watch`
K8ssandra operator cluster role	`networking.k8s.io`	`networkpolicies`	`create`, `delete`, `get`, `list`, `patch`, `update`, `watch`
K8ssandra operator cluster role	`storage.k8s.io`	`storageclasses`	`get`, `list`
K8ssandra operator cluster role	`cassandra.datastax.com`	`cassandradatacenters`	`create`, `delete`, `get`, `list`, `patch`, `update`, `watch`
K8ssandra operator cluster role	`cert-manager.io`	`certificates`	`create`, `delete`, `get`, `list`, `patch`, `update`, `watch`
K8ssandra operator cluster role	`cert-manager.io`	`issuers`	`create`, `delete`, `get`, `list`, `patch`, `update`, `watch`
K8ssandra operator cluster role	`config.k8ssandra.io`	`clientconfigs`	`get`, `list`, `patch`, `update`, `watch`
K8ssandra operator cluster role	`control.k8ssandra.io`	`cassandratasks`	`create`, `delete`, `get`, `list`, `patch`, `update`, `watch`
K8ssandra operator cluster role	`control.k8ssandra.io`	`k8ssandratasks`	`create`, `list`
K8ssandra operator cluster role	`k8ssandra.io`	`k8ssandraclusters`	`create`, `delete`, `get`, `list`, `patch`, `update`, `watch`
K8ssandra operator cluster role	`k8ssandra.io`	`k8ssandraclusters/finalizers`	`update`
K8ssandra operator cluster role	`k8ssandra.io`	`k8ssandraclusters/status`	`get`, `patch`, `update`
K8ssandra operator cluster role	`medusa.k8ssandra.io`	`medusabackupjobs`	`create`, `get`, `list`
K8ssandra operator cluster role	`medusa.k8ssandra.io`	`medusabackups`	`get`, `list`
K8ssandra operator cluster role	`medusa.k8ssandra.io`	`medusabackupschedules`	`create`, `delete`, `get`, `list`, `patch`
K8ssandra operator cluster role	`medusa.k8ssandra.io`	`medusaconfigurations`	`create`, `delete`, `get`, `list`, `patch`
K8ssandra operator cluster role	`medusa.k8ssandra.io`	`medusarestorejobs`	`create`, `delete`, `get`, `list`, `patch`
K8ssandra operator cluster role	`medusa.k8ssandra.io`	`medusatasks`	`create`, `delete`, `get`, `list`, `patch`
K8ssandra operator cluster role	`missioncontrol.datastax.com`	`missioncontrolclusters`	`create`, `delete`, `get`, `list`, `patch`, `update`, `watch`
K8ssandra operator cluster role	`missioncontrol.datastax.com`	`missioncontrolclusters/finalizers`	`update`
K8ssandra operator cluster role	`missioncontrol.datastax.com`	`missioncontrolclusters/status`	`get`, `patch`, `update`
K8ssandra operator cluster role	`monitoring.coreos.com`	`servicemonitors`	`create`, `delete`, `deletecollection`, `get`, `list`, `patch`, `update`, `watch`
K8ssandra operator cluster role	`reaper.k8ssandra.io`	`reapers`	`create`, `delete`, `get`, `list`, `patch`, `update`, `watch`
K8ssandra operator cluster role	`replication.k8ssandra.io`	`replicatedsecrets`	`create`, `delete`, `get`, `list`, `patch`, `update`, `watch`
K8ssandra operator cluster role	`security.openshift.io`	`securitycontextconstraints`	`use`
K8ssandra operator cluster role	`stargate.k8ssandra.io`	`stargates`	`create`, `delete`, `get`, `list`, `patch`, `update`, `watch`
Kube state metrics cluster role	`core`	`configmaps`, `endpoints`, `limitranges`, `namespaces`, `nodes`, `persistentvolumeclaims`, `persistentvolumes`, `pods`, `replicationcontrollers`, `resourcequotas`, `secrets`, `services`	`list`, `watch`
Kube state metrics cluster role	`admissionregistration.k8s.io`	`mutatingwebhookconfigurations`, `validatingwebhookconfigurations`	`list`, `watch`
Kube state metrics cluster role	`autoscaling`	`horizontalpodautoscalers`	`list`, `watch`
Kube state metrics cluster role	`batch`	`cronjobs`, `jobs`	`list`, `watch`
Kube state metrics cluster role	`certificates.k8s.io`	`certificatesigningrequests`	`list`, `watch`
Kube state metrics cluster role	`coordination.k8s.io`	`leases`	`list`, `watch`
Kube state metrics cluster role	`extensions`, `apps`	`daemonsets`, `deployments`, `replicasets`	`list`, `watch`
Kube state metrics cluster role	`extensions`, `networking.k8s.io`	`ingresses`	`list`, `watch`
Kube state metrics cluster role	`networking.k8s.io`	`networkpolicies`	`list`, `watch`
Kube state metrics cluster role	`policy`	`poddisruptionbudgets`	`list`, `watch`
Kube state metrics cluster role	`apps`	`statefulsets`	`list`, `watch`
Kube state metrics cluster role	`storage.k8s.io`	`storageclasses`, `volumeattachments`	`list`, `watch`
Loki cluster role	`core`	`configmaps`, `secrets`	`get`, `watch`, `list`
Manager cluster role	`core`	`configmaps`, `endpoints`, `events`, `namespaces`, `pods`, `secrets`, `secrets/finalizer`, `services`	`create`, `delete`, `get`, `list`, `patch`, `update`, `watch`
Manager cluster role	`apps`	`deployments`	`create`, `delete`, `get`, `list`, `patch`, `update`, `watch`
Manager cluster role	`batch`	`cronjobs`	`create`, `delete`, `get`, `list`, `patch`, `update`, `watch`
Manager cluster role	`networking.k8s.io`	`networkpolicies`	`create`, `delete`, `get`, `list`, `patch`, `update`, `watch`
Manager cluster role	`storage.k8s.io`	`storageclasses`	`get`, `list`
Manager cluster role	`cassandra.datastax.com`	`cassandradatacenters`	`create`, `delete`, `get`, `list`, `patch`, `update`, `watch`
Manager cluster role	`cert-manager.io`	`certificates`	`create`, `delete`, `get`, `list`, `patch`, `update`, `watch`
Manager cluster role	`cert-manager.io`	`issuers`	`create`, `delete`, `get`, `list`, `patch`, `update`, `watch`
Manager cluster role	`config.k8ssandra.io`	`clientconfigs`	`get`, `list`, `patch`, `update`, `watch`
Manager cluster role	`control.k8ssandra.io`	`cassandratasks`	`create`, `delete`, `get`, `list`, `patch`, `update`, `watch`
Manager cluster role	`control.k8ssandra.io`	`k8ssandratasks`	`create`, `list`
Manager cluster role	`k8ssandra.io`	`k8ssandraclusters`	`create`, `delete`, `get`, `list`, `patch`, `update`, `watch`
Manager cluster role	`k8ssandra.io`	`k8ssandraclusters/finalizers`	`update`
Manager cluster role	`k8ssandra.io`	`k8ssandraclusters/status`	`get`, `patch`, `update`
Manager cluster role	`medusa.k8ssandra.io`	`medusabackupjobs`	`create`, `get`, `list`
Manager cluster role	`medusa.k8ssandra.io`	`medusabackups`	`get`, `list`
Manager cluster role	`medusa.k8ssandra.io`	`medusabackupschedules`	`create`, `delete`, `get`, `list`, `patch`
Manager cluster role	`medusa.k8ssandra.io`	`medusaconfigurations`	`create`, `delete`, `get`, `list`, `patch`
Manager cluster role	`medusa.k8ssandra.io`	`medusarestorejobs`	`create`, `delete`, `get`, `list`, `patch`
Manager cluster role	`medusa.k8ssandra.io`	`medusatasks`	`create`, `delete`, `get`, `list`, `patch`
Manager cluster role	`missioncontrol.datastax.com`	`missioncontrolclusters`	`create`, `delete`, `get`, `list`, `patch`, `update`, `watch`
Manager cluster role	`missioncontrol.datastax.com`	`missioncontrolclusters/finalizers`	`update`
Manager cluster role	`missioncontrol.datastax.com`	`missioncontrolclusters/status`	`get`, `patch`, `update`
Manager cluster role	`monitoring.coreos.com`	`servicemonitors`	`create`, `delete`, `deletecollection`, `get`, `list`, `patch`, `update`, `watch`
Manager cluster role	`reaper.k8ssandra.io`	`reapers`	`create`, `delete`, `get`, `list`, `patch`, `update`, `watch`
Manager cluster role	`replication.k8ssandra.io`	`replicatedsecrets`	`create`, `delete`, `get`, `list`, `patch`, `update`, `watch`
Manager cluster role	`security.openshift.io`	`securitycontextconstraints`	`use`
Manager cluster role	`stargate.k8ssandra.io`	`stargates`	`create`, `delete`, `get`, `list`, `patch`, `update`, `watch`

Agent cluster role

core

namespaces, nodes, pods

list, watch

Cass operator cluster role

core

configmaps, endpoints, events, persistentvolumeclaims, pods, secrets, services

create, delete, get, list, patch, update, watch

Cass operator cluster role

core

namespaces

get

Cass operator cluster role

core

persistentvolumes

get, list, watch

Cass operator cluster role

storage.k8s.io

storageclasses

get, list, watch

Cass operator cluster role

apps

daemonsets, deployments, replicasets, statefulsets

create, delete, get, list, patch, update, watch

Cass operator cluster role

apps

deployments/finalizers

update

Cass operator cluster role

cassandra.datastax.com

cassandradatacenters

create, delete, get, list, patch, update, watch

Cass operator cluster role

cassandra.datastax.com

cassandradatacenters/finalizers

delete, update

Cass operator cluster role

cassandra.datastax.com

cassandradatacenters/status

get, patch, update

Cass operator cluster role

control.k8ssandra.io

cassandratasks

create, delete, get, list, patch, update, watch

Cass operator cluster role

control.k8ssandra.io

cassandratasks/finalizers

update

Cass operator cluster role

control.k8ssandra.io

cassandratasks/status

get, patch, update

Cass operator cluster role

policy

poddisruptionbudgets

create, delete, get, list, patch, update, watch

CRD upgrader cluster role

apiextensions.k8s.io

customresourcedefinitions

create, get, watch, list, update, patch

Dex cluster role

apiextensions.k8s.io

customresourcedefinitions

list, create

K8ssandra operator cluster role

core

configmaps, endpoints, events, namespaces, nodes, pods, secrets, secrets/finalizer, services

create, delete, get, list, patch, update, watch

K8ssandra operator cluster role

apps

deployments

create, delete, get, list, patch, update, watch

K8ssandra operator cluster role

batch

cronjobs

create, delete, get, list, patch, update, watch

K8ssandra operator cluster role

networking.k8s.io

networkpolicies

create, delete, get, list, patch, update, watch

K8ssandra operator cluster role

storage.k8s.io

storageclasses

get, list

K8ssandra operator cluster role

cassandra.datastax.com

cassandradatacenters

create, delete, get, list, patch, update, watch

K8ssandra operator cluster role

cert-manager.io

certificates

create, delete, get, list, patch, update, watch

K8ssandra operator cluster role

cert-manager.io

issuers

create, delete, get, list, patch, update, watch

K8ssandra operator cluster role

config.k8ssandra.io

clientconfigs

get, list, patch, update, watch

K8ssandra operator cluster role

control.k8ssandra.io

cassandratasks

create, delete, get, list, patch, update, watch

K8ssandra operator cluster role

control.k8ssandra.io

k8ssandratasks

create, list

K8ssandra operator cluster role

k8ssandra.io

k8ssandraclusters

create, delete, get, list, patch, update, watch

K8ssandra operator cluster role

k8ssandra.io

k8ssandraclusters/finalizers

update

K8ssandra operator cluster role

k8ssandra.io

k8ssandraclusters/status

get, patch, update

K8ssandra operator cluster role

medusa.k8ssandra.io

medusabackupjobs

create, get, list

K8ssandra operator cluster role

medusa.k8ssandra.io

medusabackups

get, list

K8ssandra operator cluster role

medusa.k8ssandra.io

medusabackupschedules

create, delete, get, list, patch

K8ssandra operator cluster role

medusa.k8ssandra.io

medusaconfigurations

create, delete, get, list, patch

K8ssandra operator cluster role

medusa.k8ssandra.io

medusarestorejobs

create, delete, get, list, patch

K8ssandra operator cluster role

medusa.k8ssandra.io

medusatasks

create, delete, get, list, patch

K8ssandra operator cluster role

missioncontrol.datastax.com

missioncontrolclusters

create, delete, get, list, patch, update, watch

K8ssandra operator cluster role

missioncontrol.datastax.com

missioncontrolclusters/finalizers

update

K8ssandra operator cluster role

missioncontrol.datastax.com

missioncontrolclusters/status

get, patch, update

K8ssandra operator cluster role

monitoring.coreos.com

servicemonitors

create, delete, deletecollection, get, list, patch, update, watch

K8ssandra operator cluster role

reaper.k8ssandra.io

reapers

create, delete, get, list, patch, update, watch

K8ssandra operator cluster role

replication.k8ssandra.io

replicatedsecrets

create, delete, get, list, patch, update, watch

K8ssandra operator cluster role

security.openshift.io

securitycontextconstraints

use

K8ssandra operator cluster role

stargate.k8ssandra.io

stargates

create, delete, get, list, patch, update, watch

Kube state metrics cluster role

core

configmaps, endpoints, limitranges, namespaces, nodes, persistentvolumeclaims, persistentvolumes, pods, replicationcontrollers, resourcequotas, secrets, services

list, watch

Kube state metrics cluster role

admissionregistration.k8s.io

mutatingwebhookconfigurations, validatingwebhookconfigurations

list, watch

Kube state metrics cluster role

autoscaling

horizontalpodautoscalers

list, watch

Kube state metrics cluster role

batch

cronjobs, jobs

list, watch

Kube state metrics cluster role

certificates.k8s.io

certificatesigningrequests

list, watch

Kube state metrics cluster role

coordination.k8s.io

leases

list, watch

Kube state metrics cluster role

extensions, apps

daemonsets, deployments, replicasets

list, watch

Kube state metrics cluster role

extensions, networking.k8s.io

ingresses

list, watch

Kube state metrics cluster role

networking.k8s.io

networkpolicies

list, watch

Kube state metrics cluster role

policy

poddisruptionbudgets

list, watch

Kube state metrics cluster role

apps

statefulsets

list, watch

Kube state metrics cluster role

storage.k8s.io

storageclasses, volumeattachments

list, watch

Loki cluster role

core

configmaps, secrets

get, watch, list

Manager cluster role

core

configmaps, endpoints, events, namespaces, pods, secrets, secrets/finalizer, services

create, delete, get, list, patch, update, watch

Manager cluster role

apps

deployments

create, delete, get, list, patch, update, watch

Manager cluster role

batch

cronjobs

create, delete, get, list, patch, update, watch

Manager cluster role

networking.k8s.io

networkpolicies

create, delete, get, list, patch, update, watch

Manager cluster role

storage.k8s.io

storageclasses

get, list

Manager cluster role

cassandra.datastax.com

cassandradatacenters

create, delete, get, list, patch, update, watch

Manager cluster role

cert-manager.io

certificates

create, delete, get, list, patch, update, watch

Manager cluster role

cert-manager.io

issuers

create, delete, get, list, patch, update, watch

Manager cluster role

config.k8ssandra.io

clientconfigs

get, list, patch, update, watch

Manager cluster role

control.k8ssandra.io

cassandratasks

create, delete, get, list, patch, update, watch

Manager cluster role

control.k8ssandra.io

k8ssandratasks

create, list

Manager cluster role

k8ssandra.io

k8ssandraclusters

create, delete, get, list, patch, update, watch

Manager cluster role

k8ssandra.io

k8ssandraclusters/finalizers

update

Manager cluster role

k8ssandra.io

k8ssandraclusters/status

get, patch, update

Manager cluster role

medusa.k8ssandra.io

medusabackupjobs

create, get, list

Manager cluster role

medusa.k8ssandra.io

medusabackups

get, list

Manager cluster role

medusa.k8ssandra.io

medusabackupschedules

create, delete, get, list, patch

Manager cluster role

medusa.k8ssandra.io

medusaconfigurations

create, delete, get, list, patch

Manager cluster role

medusa.k8ssandra.io

medusarestorejobs

create, delete, get, list, patch

Manager cluster role

medusa.k8ssandra.io

medusatasks

create, delete, get, list, patch

Manager cluster role

missioncontrol.datastax.com

missioncontrolclusters

create, delete, get, list, patch, update, watch

Manager cluster role

missioncontrol.datastax.com

missioncontrolclusters/finalizers

update

Manager cluster role

missioncontrol.datastax.com

missioncontrolclusters/status

get, patch, update

Manager cluster role

monitoring.coreos.com

servicemonitors

create, delete, deletecollection, get, list, patch, update, watch

Manager cluster role

reaper.k8ssandra.io

reapers

create, delete, get, list, patch, update, watch

Manager cluster role

replication.k8ssandra.io

replicatedsecrets

create, delete, get, list, patch, update, watch

Manager cluster role

security.openshift.io

securitycontextconstraints

use

Manager cluster role

stargate.k8ssandra.io

stargates

create, delete, get, list, patch, update, watch

Kubernetes service accounts and permissions

Service accounts

Cluster role permissions

Was this helpful?

Give Feedback