Permissions

Vespa on Kubernetes uses two ServiceAccounts, each with its own set of namespace-scoped RBAC permissions:

The Vespa Operator ServiceAccount, used by the operator Deployment. Its permissions are installed by the Helm chart.
The ConfigServer ServiceAccount, used by the ConfigServer pods. It is either generated by the operator (spec.configServer.generateRbac: true) or provided externally through spec.configServer.serviceAccount — see the VespaSet CRD reference.

The tables below list the permissions per resource, by Kubernetes API verbs.

Vespa Operator

The operator reconciles VespaSet resources and manages the ConfigServer pods and their supporting resources. It requires the following permissions at all times.

API Group	Resource	Verbs	Purpose
`k8s.ai.vespa`	`vespasets`	get, list, watch, update, patch	Watch and reconcile the primary `VespaSet` resource.
`k8s.ai.vespa`	`vespasets/status`	patch	Report reconciliation status on the `VespaSet`.
`k8s.ai.vespa`	`vespasets/finalizers`	update	Manage finalizers for cleanup on `VespaSet` deletion.
`""`	`pods`	get, list, watch, create, patch, delete	Manage the ConfigServer pods.
`""`	`services`	get, list, watch, create, patch	Manage the headless and internal HTTP Services for the ConfigServers.
`""`	`persistentvolumeclaims`	get, list, watch, create, patch	Manage the PersistentVolumeClaims for the ConfigServers.
`""`	`events`	create, patch	Optional — emit Kubernetes Events for observability during reconciliation.

Generate RBAC Resources

When spec.configServer.generateRbac is set to true in the VespaSet, the operator generates the RBAC resources for the ConfigServer pods itself: it creates the ConfigServer ServiceAccount, a Role holding the ConfigServer permissions, and a RoleBinding tying the two together. This removes the need to manage the ConfigServer ServiceAccount externally through spec.configServer.serviceAccount.

Generating these resources requires the following additional permissions. They can be omitted when the ConfigServer ServiceAccount is managed externally.

API Group	Resource	Verbs	Purpose
`""`	`serviceaccounts`	get, list, watch, create, update, patch, delete	Create the ConfigServer ServiceAccount.
`rbac.authorization.k8s.io`	`roles`	get, list, watch, create, update, patch, delete	Create the ConfigServer Role. Note that Kubernetes requires the operator to already hold the permissions contained in the Role it creates, or be granted the `escalate` verb.
`rbac.authorization.k8s.io`	`rolebindings`	get, list, watch, create, update, patch, delete	Bind the ConfigServer ServiceAccount to its Role.

ConfigServer

The ConfigServer pods provision and manage the pods, volumes, and endpoints of the Vespa application clusters. All ConfigServer pods share one ServiceAccount: either the operator-generated one (generateRbac: true), or the one referenced by spec.configServer.serviceAccount. When providing the ServiceAccount externally, it must be granted the following permissions.

API Group	Resource	Verbs	Purpose
`""`	`pods`	get, list, watch, create, update, patch, delete	Provision and manage the pods of the Vespa application clusters.
`""`	`pods/exec`	get, create	Execute commands in application pods, e.g. to drain traffic and flush data before shutdown.
`""`	`persistentvolumeclaims`	get, create, delete, watch	Provision and deprovision data volumes for application pods.
`""`	`services`	get, create, patch, delete	Manage the load balancer and cluster-IP endpoints for Vespa traffic — see Configure External Access Layer.
`k8s.ai.vespa`	`vespasets`	get	Read the `VespaSet` specification.
`k8s.ai.vespa`	`vespasets/status`	patch	Report pod phases on the `VespaSet` status.
`policy`	`poddisruptionbudgets`	list, create, patch, delete	Manage PodDisruptionBudgets for the Vespa application pods.