Understand the Kubernetes Cluster Access provided to Run:ai¶

Run:ai has configuration flags that control specific behavioral aspects of Run:ai. Specifically, those which require additional permissions. Such as automatic namespace/project creation, secret propagation, and more.

The purpose of this document is to provide security officers with the ability to review what cluster-wide access Run:ai requires, and verify that it is in line with organizational policy, before installing the Run:ai cluster.

Review Cluster Access Roles¶

Run the following:

helm repo add runai https://run-ai-charts.storage.googleapis.com
helm repo update
helm install runai-cluster runai/runai-cluster -n runai -f runai-<cluster-name>.yaml \
        --dry-run > cluster-all.yaml

The file cluster-all.yaml can be then be reviewed. You can use the internal filenames (provided in comments within the file) to gain more understanding according to the table below: