--- schema_version: "1" id: 98687992d789fc9eff4b5fcde7b88ddfa6d70e90df2e7fbdab001b482a1785f5 title: RTFCTL Kubernetes Permissions collection: mulesoft version: current locale: en-us portal_url: https://docs.salesforce.com/mulesoft/current/en-us/runtime-fabric/2.7/rtfctl-permissions.md canonical_url: https://docs.mulesoft.com/runtime-fabric/2.7/rtfctl-permissions source_site: docs.mulesoft.com content_type: documentation content_hash: 2e8748a4082ab08f4700ede23637c016b0b8b9a9075b5e074d54f41427ac7150 description: MuleSoft Documentation Site release: "2.7" latest: false --- --- product: Runtime Fabric version: 2.7 --- # RTFCTL Kubernetes Permissions > For the full documentation index, see: https://docs.mulesoft.com/llms.txt To successfully run `rtfctl` commands, you must understand and enable specific role permissions over Kubernetes resources. The following table lists the permissions that you configure using Kubernetes (K8s) RBACs ([role-based access control](https://kubernetes.io/docs/reference/access-authn-authz/rbac/)):

rtfctl Command	Namespace	API Groups	Kubernetes Resources	Verbs
`apply`	rtf		configmaps	create, get, patch, update
	rtf		pods	deletecollection
	<app-namespace>		secrets	get, list, watch
	rtfctl-audit		secrets	create, get, patch, update
			namespaces	create, get, list, watch
			secrets	create, get, patch, update
`update`	rtf		configmaps, secrets	get
	rtfctl-audit		secrets	create, get, patch, update
	rtfctl-audit		namespaces	create
`wait`	rtf		configmaps, secret	get
	rtfctl-audit		secrets	create, get, patch, update
		apps	daemonsets, deployments	get, list, watch
			namespaces	create
`install`	rtf		configmaps, pods/log	get
			pods	get, list, watch
			secrets	create, get
			serviceaccounts	create
		batch	jobs	create, get
	rtfctl-audit		secrets	create, get, patch, update
			namespaces	create
		rbac.authorization.k8s.io	clusterrolebindings, clusterroles	create
`backup`	rtfctl-audit		secrets	create, get, patch, update
			namespaces	create, get, list, watch
			configmaps, namespaces, secrets, serviceaccounts, services	get, list, watch
		apiextensions.k8s.io	customresourcedefinitions	get
		apps	daemonsets, deployments	get, list, watch
		batch	cronjobs	get, list, watch
		networking.k8s.io	ingresses	get, list, watch
		rbac.authorization.k8s.io	clusterrolebindings, clusterroles, rolebindings, roles	get, list, watch
		rtf.mulesoft.com	persistencegateways	get, list, watch
		scheduling.k8s.io	priorityclasses	get
`restore`	rtf	apps	daemonsets	create, get, patch, update
		batch	cronjobs	create, get, patch, update
		rtf.mulesoft.com	persistencegateways	get, list, watch
	rtfctl-audit		secrets	create, get, patch, update
			configmaps, namespaces, secrets, serviceaccounts, services	create, get, patch, update
		apiextensions.k8s.io	customresourcedefinitions	get, patch, update
		apps	deployments	create, get, patch, update
		networking.k8s.io	ingresses	create, get, patch, update
		rbac.authorization.k8s.io	clusterrolebindings, clusterroles	create, get, patch, update
		scheduling.k8s.io	priorityclasses	create, get, patch, update
`validate`	rtf		configmaps	get
			pods	deletecollection
			secrets	delete, get
		batch	jobs	delete
	rtf-validate		namespaces	delete, get
			pods/log	get
			secrets, serviceaccounts	create
		batch	jobs	create, get
	rtfctl-audit		secrets	create, get, patch, update
			namespaces	create
			nodes, pods	get, list, watch
		authorization.k8s.io	selfsubjectaccessreviews	create
		rbac.authorization.k8s.io	clusterrolebindings, clusterroles	create, delete
`version`	rtf		configmaps, secrets	get
	rtfctl-audit		secrets	create, get, patch, update
			namespaces	create
`delete`	<app-namespace>		pods	get, list, watch
	<app-namespace>		secrets	get, list, patch, update, watch
	rtf		configmaps, secrets	get
	rtfctl-audit		secrets	create, get, patch, update
			namespaces	create
`describe`	<app-namespace>		pods	get, list, watch
	rtf		configmaps, secrets	get
	rtfctl-audit		secrets	create, get, patch, update
			namespaces	create
		apps	deployments	get, list, watch
`disk`	<app-namespace>		pods	get, list, watch
	<app-namespace>		pods/exec	create
	rtf		configmaps, secrets	get
	rtfctl-audit		secrets	create, get, patch, update
			namespaces	create
`memory`	<app-namespace>		pods	get, list, watch
	<app-namespace>		pods/exec	create
	rtf		configmaps, secrets	get
	rtfctl-audit		secrets	create, get, patch, update
			namespaces	create
`package`	<app-namespace>		pods	get, list, watch
	<app-namespace>		pods/exec	create
	rtf		configmaps, secrets	get
	rtfctl-audit		secrets	create, get, patch, update
			namespaces	create
`restart`	<app-namespace>		pods	delete, get, list, watch
	rtf		configmaps, secrets	get
	rtfctl-audit		secrets	create, get, patch, update
			namespaces	create
`heapdump`	<app-namespace>		pods	get, list, watch
	<app-namespace>		pods/exec	create
	rtf		configmaps, secrets	get
	rtfctl-audit		secrets	create, get, patch, update
			namespaces	create
`threaddump`	<app-namespace>		secrets	get, list, watch
	<app-namespace>		pods/exec	create
	rtf		configmaps, secrets	get
	rtfctl-audit		secrets	create, get, patch, update
			namespaces	create
`get`	<app-namespace>		secrets	get, list, watch
	rtf		configmaps, secrets	get
	rtfctl-audit		secrets	create, get, patch, update
			namespaces	create
		apps	deployments	get, list, watch
`report`	rtf		configmaps, limitranges, resourcequotas, secrets, serviceaccounts, services	get, list, watch
			endpoints, pods/log	get
		apps	daemonsets, deployments, replicasets	get, list, watch
		batch	cronjobs	get, list, watch
		batch	jobs	create, delete, get, list, watch
		networking.k8s.io	ingresses	get, list, watch
		rbac.authorization.k8s.io	rolebindings, roles	get, list, watch
		rtf.mulesoft.com	persistencegateways, kubernetestemplates	get, list, watch
	kube-node-lease	coordination.k8s.io	leases	get
	rtfctl-audit		secrets	create, get, patch, update
			namespaces	create, get, list, watch
			events, nodes, pods	get, list, watch
`status`	rtf		configmaps, pods/log, secrets	get
			pods	create, delete, get, list, watch
		batch	jobs	create, delete, get
	rtfctl-audit		secrets	create, get, patch, update
			namespaces	create
`test`	rtf		configmaps, pods/log, secrets	get
			pods	create, delete, get, list, watch
		batch	jobs	create, delete, get
	rtfctl-audit		secrets	create, get, patch, update
			nodes	get, list, watch
			namespaces	create

- Namespace Permissions can be role-based or cluster role-based: - Role-based: the namespace can be rtf, , rtf-validate, or kube-node-lease. - Cluster role-based: because it applies to the entire cluster, the namespace field doesn’t exist and is blank in the table. - apiGroups The API group for the K8s resources. When you create a role, each K8s resource declares its API group or uses the core API group if not specified. Refer to [API groups](https://kubernetes.io/docs/reference/using-api/#api-groups) for details. - Kubernetes Resource Type of Kubernetes resources, for example, `pods`, `services`, or `secrets` to which the permissions apply. - Verbs Actions that are allowed on the specified Kubernetes resources. ## See Also - [Runtime Fabric Core Software Kubernetes Permissions](https://docs.mulesoft.com/runtime-fabric/2.7/rtf-permissions) - [Mule App Deployments Kubernetes Permissions on Runtime Fabric](https://docs.mulesoft.com/runtime-fabric/2.7/rtf-mule-app-permissions)