RBAC & security model

The agent installs into its own namespace and binds to a ClusterRole scoped to read-only verbs. It requests no create, update, patch, or delete permissions on your workloads, and it does not register as an admission or mutating webhook. You can review the exact chart and RBAC manifest before you install.

# The agent requests read-only verbs only.
rules:
  - apiGroups: ["*"]
    resources: ["*"]
    verbs: ["get", "list", "watch"]

Illustrative

This is the shape of the ClusterRole, not a verbatim copy of the shipped manifest. The authoritative version is the one in the chart you install — read it with helm show templates runtimez/agent before applying.

What this rules out

• No mutation. No verb in the role can change cluster state.
• No webhook. The agent is not in the admission path, so it cannot block or alter a deployment even by accident.
• No Secret values. Secret objects fall under the read verbs, but the agent does not read or transmit their data; the same applies to ConfigMap values and container environment variables.
• No application data. Database contents, application logs, and in-memory data are out of scope entirely.

Opt-in permissions

Traefik runtime needs one permission beyond the read verbs above. The chart adds it only when you set discovery.traefik.runtime.enabled: true. The * in the block above is shorthand: the shipped ClusterRole lists its resources one by one, and pods/proxy is not among them until you turn this setting on.

Permission	Used for
get on pods/proxy	One GET /api/http/routers per Traefik pod per sync, through the API server.

pods/proxy is a read verb, but it reaches further than it looks. The grant is cluster-wide, and a GET through it can reach any HTTP path a pod serves. The agent calls only Traefik’s router API. If your security policy rules the grant out, leave the setting off: Runtimez still reads your IngressRoute objects and, with discovery.traefik.enabled, Traefik’s metrics.

Verify it yourself

kubectl get clusterrole runtimez-agent -o yaml
kubectl auth can-i --list --as=system:serviceaccount:runtimez:runtimez-agent

The second command enumerates the effective permissions of the agent’s ServiceAccount as the API server sees them — which is the answer that actually counts, independent of what the chart claims.