> For the complete documentation index, see [llms.txt](https://developer.harness.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://developer.harness.io/resilience-testing/chaos-engineering/faults/chaos-fault-categories/kubernetes/permissions/fault-wise-permission.md).

# Fault-wise permissions

This topic describes the [prerequisites](#fault-type-specific-prerequisites) and [fault-wise permissions](#permissions-required-for-pod-level-faults) required to execute Kubernetes-based faults.

The prerequisites can be categorized into two groups:

1. [Common prerequisites](#common-prerequisites)
2. [Fault-type specific prerequisites](#fault-type-specific-prerequisites)

#### Common prerequisites <a href="#common-prerequisites" id="common-prerequisites"></a>

* Ensure that the Kubernetes chaos infrastructure (or agent) is installed and all the components are healthy and in **running** state.
* There should be outbound connectivity from the cluster pods to the Harness control plane.
* Connectivity should be established between the cluster pods to any endpoint that needs to be queried as a part of the probe execution (or resilience validation).
* Appropriate RBAC should be set up on the Kubernetes cluster, so that the service accounts used by the agent components are sufficient for the discovery and chaos injection. This is based on:
  * The scope of execution (cluster-wide or namespaced).
  * The nature of faults planned to be executed.

#### Fault-type specific prerequisites <a href="#fault-type-specific-prerequisites" id="fault-type-specific-prerequisites"></a>

Certain fault categories have unique requirements, from a permissions and set up (or configuration) perspective.

**Pod network/Stress/API/IO**

These faults require [identifying the target container PID and remote execution](/resilience-testing/chaos-engineering/faults/chaos-fault-categories/kubernetes/classification.md#pod-faults-microservices-based-faults) of certain commands (or processes) within the target containers' network, PID, and mount namespace. These actions require the transient chaos pods to run with:

* Root user;
* Container runtime socket mounted;
* Privilege escalation;
* Linux capabilities like NET\_ADMIN, SYS\_ADMIN;
* Mapping to hostpid.

HCE recommends you create a dedicated pod security policy (PSP) or equivalent that you can map to the transient chaos pods or service account.

**Service load**

Internally, the load fault leverages Locust (support for other tools is a part of the roadmap). The internal load engine uses a Python script to define the API calls that should be part of the load profile. The script is embedded within a ConfigMap that is referenced by the chaos pods during execution. Go to [locust prerequisites](/resilience-testing/chaos-engineering/faults/chaos-fault-categories/load/locust-loadgen.md#prerequisites) for detailed steps

**Cloud-based targets**

Create an IAM role on the cloud account that is mapped to the appropriate policy. Your (cloud account user) credentials must be embedded with a Kubernetes secret before executing the fault. You can create a [superset AWS policy](/resilience-testing/chaos-engineering/faults/chaos-fault-categories/aws/security-configurations/policy-for-all-aws-faults.md) that allows executing all the fault types supported by HCE.

{% hint style="info" %}

* You can authenticate cloud API requests made by the chaos pods. If the Kubernetes chaos infrastructure (or agent) is set up on EKS or GKE clusters, you can set up [IRSA](/resilience-testing/chaos-engineering/faults/chaos-fault-categories/aws/security-configurations/aws-iam-integration.md) or [workload identity](/resilience-testing/chaos-engineering/faults/chaos-fault-categories/gcp/security-configurations/gcp-iam-integration.md) respectively, instead of using Kubernetes secrets.
* You can configure [ChaosGuard](/resilience-testing/chaos-engineering/use-chaos-engineering/governance/governance-in-execution/governance-in-execution.md) rules to limit the scope of the Harness chaos platform for faults executed, clusters chosen, application workload targeted and chaos service account leveraged.
* The Service Load chaos is target-platform agnostic, that is, it can generate load against service endpoints regardless of where they are hosted.
  {% endhint %}

#### Permissions required for pod-level faults <a href="#permissions-required-for-pod-level-faults" id="permissions-required-for-pod-level-faults"></a>

This table lists the permissions required to execute Kubernetes fault (node-level and pod-level).

{% hint style="info" %}

* NA refers to **Not Applicable**.
* NA\* indicates that the permissions are not required for pod-level experiments by default, but if you want to target the pods on specific node, then the permissions will be required.
* Starred pod-level experiments indicate that they don't require helper pods for execution.
  {% endhint %}

Read the permission as: "You can create **pod delete** fault in **Namespaced and cluster** mode, and on the **pod** entity, it requires permissions to **\[create, delete, get, list, patch, deletecollection, update]** the pod.

| Pod-level faults                                                                                                                                                  | Mode (Scopes of chaos agent) | Permissions required                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                         |
| ----------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| [Pod delete \*](/resilience-testing/chaos-engineering/faults/chaos-fault-categories/kubernetes/pod/pod-delete.md#permissions-required)                            | Namespaced, Cluster          | <ul><li>pod = \[create, delete, get, list, patch, deletecollection, update]</li><li>events = \[create, get, list, patch, update]</li><li>configMaps = NA</li><li>pods/log = \[get, list, watch]</li><li>pods/exec = NA</li><li>deployments, statefulsets = \[get, list]</li><li>replicasets, daemonsets = \[get, list]</li><li>networkpolicies = NA</li><li>jobs = \[create, delete, get, list, deletecollection]</li><li>chaosEngines, chaosExperiments, chaosResults = \[create, delete, get, list, patch, update]</li><li>secrets = NA</li><li>pod eviction = NA</li><li>nodes = NA\*</li></ul>                           |
| [Container kill](/resilience-testing/chaos-engineering/faults/chaos-fault-categories/kubernetes/pod/container-kill.md#permissions-required)                       | Namespaced, Cluster          | <ul><li>pod = \[create, delete, get, list, patch, deletecollection, update]</li><li>events = \[create, get, list, patch, update]</li><li>configMaps = NA</li><li>pods/log = \[get, list, watch]</li><li>pods/exec = NA</li><li>deployments, statefulsets = \[get, list]</li><li>replicasets, daemonsets = \[get, list]</li><li>networkpolicies = NA</li><li>jobs = \[create, delete, get, list, deletecollection]</li><li>chaosEngines, chaosExperiments, chaosResults = \[create, delete, get, list, patch, update]</li><li>secrets = NA</li><li>pod eviction = NA</li><li>nodes = NA\*</li></ul>                           |
| [Disk fill](/resilience-testing/chaos-engineering/faults/chaos-fault-categories/kubernetes/pod/disk-fill.md#permissions-required)                                 | Namespaced, Cluster          | <ul><li>pod = \[create, delete, get, list, patch, deletecollection, update]</li><li>events = \[create, get, list, patch, update]</li><li>configMaps = NA</li><li>pods/log = \[get, list, watch]</li><li>pods/exec = NA</li><li>deployments, statefulsets = \[get, list]</li><li>replicasets, daemonsets = \[get, list]</li><li>networkpolicies = NA</li><li>jobs = \[create, delete, get, list, deletecollection]</li><li>chaosEngines, chaosExperiments, chaosResults = \[create, delete, get, list, patch, update]</li><li>secrets = NA</li><li>pod eviction = NA</li><li>nodes = NA\*</li></ul>                           |
| [Pod API block](/resilience-testing/chaos-engineering/faults/chaos-fault-categories/kubernetes/pod/pod-api-block.md#permissions-required)                         | Namespaced, Cluster          | <ul><li>pod = \[create, delete, get, list, patch, deletecollection, update]</li><li>events = \[create, get, list, patch, update]</li><li>configMaps = NA</li><li>pods/log = \[get, list, watch]</li><li>pods/exec = NA</li><li>deployments, statefulsets = \[get, list]</li><li>replicasets, daemonsets = \[get, list]</li><li>networkpolicies = NA</li><li>jobs = \[create, delete, get, list, deletecollection]</li><li>chaosEngines, chaosExperiments, chaosResults = \[create, delete, get, list, patch, update]</li><li>secrets = NA</li><li>pod eviction = NA</li><li>nodes = NA\*</li></ul>                           |
| [Pod API latency](/resilience-testing/chaos-engineering/faults/chaos-fault-categories/kubernetes/pod/pod-api-latency.md#permissions-required)                     | Namespaced, Cluster          | <ul><li>pod = \[create, delete, get, list, patch, deletecollection, update]</li><li>events = \[create, get, list, patch, update]</li><li>configMaps = NA</li><li>pods/log = \[get, list, watch]</li><li>pods/exec = NA</li><li>deployments, statefulsets = \[get, list]</li><li>replicasets, daemonsets = \[get, list]</li><li>networkpolicies = NA</li><li>jobs = \[create, delete, get, list, deletecollection]</li><li>chaosEngines, chaosExperiments, chaosResults = \[create, delete, get, list, patch, update]</li><li>secrets = NA</li><li>pod eviction = NA</li><li>nodes = NA\*</li></ul>                           |
| [Pod API modify body](/resilience-testing/chaos-engineering/faults/chaos-fault-categories/kubernetes/pod/pod-api-modify-body.md#permissions-required)             | Namespaced, Cluster          | <ul><li>pod = \[create, delete, get, list, patch, deletecollection, update]</li><li>events = \[create, get, list, patch, update]</li><li>configMaps = NA</li><li>pods/log = \[get, list, watch]</li><li>pods/exec = NA</li><li>deployments, statefulsets = \[get, list]</li><li>replicasets, daemonsets = \[get, list]</li><li>networkpolicies = NA</li><li>jobs = \[create, delete, get, list, deletecollection]</li><li>chaosEngines, chaosExperiments, chaosResults = \[create, delete, get, list, patch, update]</li><li>secrets = NA</li><li>pod eviction = NA</li><li>nodes = NA\*</li></ul>                           |
| [Pod API modify header](/resilience-testing/chaos-engineering/faults/chaos-fault-categories/kubernetes/pod/pod-api-modify-header.md#permissions-required)         | Namespaced, Cluster          | <ul><li>pod = \[create, delete, get, list, patch, deletecollection, update]</li><li>events = \[create, get, list, patch, update]</li><li>configMaps = NA</li><li>pods/log = \[get, list, watch]</li><li>pods/exec = NA</li><li>deployments, statefulsets = \[get, list]</li><li>replicasets, daemonsets = \[get, list]</li><li>networkpolicies = NA</li><li>jobs = \[create, delete, get, list, deletecollection]</li><li>chaosEngines, chaosExperiments, chaosResults = \[create, delete, get, list, patch, update]</li><li>secrets = NA</li><li>pod eviction = NA</li><li>nodes = NA\*</li></ul>                           |
| [Pod API status code](/resilience-testing/chaos-engineering/faults/chaos-fault-categories/kubernetes/pod/pod-api-status-code.md#permissions-required)             | Namespaced, Cluster          | <ul><li>pod = \[create, delete, get, list, patch, deletecollection, update]</li><li>events = \[create, get, list, patch, update]</li><li>configMaps = NA</li><li>pods/log = \[get, list, watch]</li><li>pods/exec = NA</li><li>deployments, statefulsets = \[get, list]</li><li>replicasets, daemonsets = \[get, list]</li><li>networkpolicies = NA</li><li>jobs = \[create, delete, get, list, deletecollection]</li><li>chaosEngines, chaosExperiments, chaosResults = \[create, delete, get, list, patch, update]</li><li>secrets = NA</li><li>pod eviction = NA</li><li>nodes = NA\*</li></ul>                           |
| [Pod autoscaler \*](/resilience-testing/chaos-engineering/faults/chaos-fault-categories/kubernetes/pod/pod-autoscaler.md#permissions-required)                    | Namespaced, Cluster          | <ul><li>pod = \[create, delete, get, list, patch, deletecollection, update]</li><li>events = \[create, get, list, patch, update]</li><li>configMaps = NA</li><li>pods/log = \[get, list, watch]</li><li>pods/exec = NA</li><li>deployments, statefulsets = \[get, list, patch, update]</li><li>replicasets, daemonsets = NA</li><li>networkpolicies = NA</li><li>jobs = \[create, delete, get, list, deletecollection]</li><li>chaosEngines, chaosExperiments, chaosResults = \[create, delete, get, list, patch, update]</li><li>secrets = NA</li><li>pod eviction = NA</li><li>nodes = NA\*</li></ul>                      |
| [Pod CPU hog](/resilience-testing/chaos-engineering/faults/chaos-fault-categories/kubernetes/pod/pod-cpu-hog.md#permissions-required)                             | Namespaced, Cluster          | <ul><li>pod = \[create, delete, get, list, patch, deletecollection, update]</li><li>events = \[create, get, list, patch, update]</li><li>configMaps = NA</li><li>pods/log = \[get, list, watch]</li><li>pods/exec = NA</li><li>deployments, statefulsets = \[get, list]</li><li>replicasets, daemonsets = \[get, list]</li><li>networkpolicies = NA</li><li>jobs = \[create, delete, get, list, deletecollection]</li><li>chaosEngines, chaosExperiments, chaosResults = \[create, delete, get, list, patch, update]</li><li>secrets = NA</li><li>pod eviction = NA</li><li>nodes = NA\*</li></ul>                           |
| [Pod DNS error](/resilience-testing/chaos-engineering/faults/chaos-fault-categories/kubernetes/pod/pod-dns-error.md#permissions-required)                         | Namespaced, Cluster          | <ul><li>pod = \[create, delete, get, list, patch, deletecollection, update]</li><li>events = \[create, get, list, patch, update]</li><li>configMaps = NA</li><li>pods/log = \[get, list, watch]</li><li>pods/exec = NA</li><li>deployments, statefulsets = \[get, list]</li><li>replicasets, daemonsets = \[get, list]</li><li>networkpolicies = NA</li><li>jobs = \[create, delete, get, list, deletecollection]</li><li>chaosEngines, chaosExperiments, chaosResults = \[create, delete, get, list, patch, update]</li><li>secrets = NA</li><li>pod eviction = NA</li><li>nodes = NA\*</li></ul>                           |
| [Pod DNS spoof](/resilience-testing/chaos-engineering/faults/chaos-fault-categories/kubernetes/pod/pod-dns-spoof.md#permissions-required)                         | Namespaced, Cluster          | <ul><li>pod = \[create, delete, get, list, patch, deletecollection, update]</li><li>events = \[create, get, list, patch, update]</li><li>configMaps = NA</li><li>pods/log = \[get, list, watch]</li><li>pods/exec = NA</li><li>deployments, statefulsets = \[get, list]</li><li>replicasets, daemonsets = \[get, list]</li><li>networkpolicies = NA</li><li>jobs = \[create, delete, get, list, deletecollection]</li><li>chaosEngines, chaosExperiments, chaosResults = \[create, delete, get, list, patch, update]</li><li>secrets = NA</li><li>pod eviction = NA</li><li>nodes = NA\*</li></ul>                           |
| [Pod HTTP latency](/resilience-testing/chaos-engineering/faults/chaos-fault-categories/kubernetes/pod/pod-http-latency.md#permissions-required)                   | Namespaced, Cluster          | <ul><li>pod = \[create, delete, get, list, patch, deletecollection, update]</li><li>events = \[create, get, list, patch, update]</li><li>configMaps = NA</li><li>pods/log = \[get, list, watch]</li><li>pods/exec = NA</li><li>deployments, statefulsets = \[get, list]</li><li>replicasets, daemonsets = \[get, list]</li><li>networkpolicies = NA</li><li>jobs = \[create, delete, get, list, deletecollection]</li><li>chaosEngines, chaosExperiments, chaosResults = \[create, delete, get, list, patch, update]</li><li>secrets = NA</li><li>pod eviction = NA</li><li>nodes = NA\*</li></ul>                           |
| [Pod HTTP modify body](/resilience-testing/chaos-engineering/faults/chaos-fault-categories/kubernetes/pod/pod-http-modify-body.md#permissions-required)           | Namespaced, Cluster          | <ul><li>pod = \[create, delete, get, list, patch, deletecollection, update]</li><li>events = \[create, get, list, patch, update]</li><li>configMaps = NA</li><li>pods/log = \[get, list, watch]</li><li>pods/exec = NA</li><li>deployments, statefulsets = \[get, list]</li><li>replicasets, daemonsets = \[get, list]</li><li>networkpolicies = NA</li><li>jobs = \[create, delete, get, list, deletecollection]</li><li>chaosEngines, chaosExperiments, chaosResults = \[create, delete, get, list, patch, update]</li><li>secrets = NA</li><li>pod eviction = NA</li><li>nodes = NA\*</li></ul>                           |
| [Pod HTTP modify header](/resilience-testing/chaos-engineering/faults/chaos-fault-categories/kubernetes/pod/pod-http-modify-header.md#permissions-required)       | Namespaced, Cluster          | <ul><li>pod = \[create, delete, get, list, patch, deletecollection, update]</li><li>events = \[create, get, list, patch, update]</li><li>configMaps = NA</li><li>pods/log = \[get, list, watch]</li><li>pods/exec = NA</li><li>deployments, statefulsets = \[get, list]</li><li>replicasets, daemonsets = \[get, list]</li><li>networkpolicies = NA</li><li>jobs = \[create, delete, get, list, deletecollection]</li><li>chaosEngines, chaosExperiments, chaosResults = \[create, delete, get, list, patch, update]</li><li>secrets = NA</li><li>pod eviction = NA</li><li>nodes = NA\*</li></ul>                           |
| [Pod HTTP reset peer](/resilience-testing/chaos-engineering/faults/chaos-fault-categories/kubernetes/pod/pod-http-reset-peer.md#permissions-required)             | Namespaced, Cluster          | <ul><li>pod = \[create, delete, get, list, patch, deletecollection, update]</li><li>events = \[create, get, list, patch, update]</li><li>configMaps = NA</li><li>pods/log = \[get, list, watch]</li><li>pods/exec = NA</li><li>deployments, statefulsets = \[get, list]</li><li>replicasets, daemonsets = \[get, list]</li><li>networkpolicies = NA</li><li>jobs = \[create, delete, get, list, deletecollection]</li><li>chaosEngines, chaosExperiments, chaosResults = \[create, delete, get, list, patch, update]</li><li>secrets = NA</li><li>pod eviction = NA</li><li>nodes = NA\*</li></ul>                           |
| [Pod HTTP status code](/resilience-testing/chaos-engineering/faults/chaos-fault-categories/kubernetes/pod/pod-http-status-code.md#permissions-required)           | Namespaced, Cluster          | <ul><li>pod = \[create, delete, get, list, patch, deletecollection, update]</li><li>events = \[create, get, list, patch, update]</li><li>configMaps = NA</li><li>pods/log = \[get, list, watch]</li><li>pods/exec = NA</li><li>deployments, statefulsets = \[get, list]</li><li>replicasets, daemonsets = \[get, list]</li><li>networkpolicies = NA</li><li>jobs = \[create, delete, get, list, deletecollection]</li><li>chaosEngines, chaosExperiments, chaosResults = \[create, delete, get, list, patch, update]</li><li>secrets = NA</li><li>pod eviction = NA</li><li>nodes = NA\*</li></ul>                           |
| [Pod IO attribute override](/resilience-testing/chaos-engineering/faults/chaos-fault-categories/kubernetes/pod/pod-io-attribute-override.md#permissions-required) | Namespaced, Cluster          | <ul><li>pod = \[create, delete, get, list, patch, deletecollection, update]</li><li>events = \[create, get, list, patch, update]</li><li>configMaps = NA</li><li>pods/log = \[get, list, watch]</li><li>pods/exec = NA</li><li>deployments, statefulsets = \[get, list]</li><li>replicasets, daemonsets = \[get, list]</li><li>networkpolicies = NA</li><li>jobs = \[create, delete, get, list, deletecollection]</li><li>chaosEngines, chaosExperiments, chaosResults = \[create, delete, get, list, patch, update]</li><li>secrets = NA</li><li>pod eviction = NA</li><li>nodes = NA\*</li></ul>                           |
| [Pod IO error](/resilience-testing/chaos-engineering/faults/chaos-fault-categories/kubernetes/pod/pod-io-error.md#permissions-required)                           | Namespaced, Cluster          | <ul><li>pod = \[create, delete, get, list, patch, deletecollection, update]</li><li>events = \[create, get, list, patch, update]</li><li>configMaps = NA</li><li>pods/log = \[get, list, watch]</li><li>pods/exec = NA</li><li>deployments, statefulsets = \[get, list]</li><li>replicasets, daemonsets = \[get, list]</li><li>networkpolicies = NA</li><li>jobs = \[create, delete, get, list, deletecollection]</li><li>chaosEngines, chaosExperiments, chaosResults = \[create, delete, get, list, patch, update]</li><li>secrets = NA</li><li>pod eviction = NA</li><li>nodes = NA\*</li></ul>                           |
| [Pod IO latency](/resilience-testing/chaos-engineering/faults/chaos-fault-categories/kubernetes/pod/pod-io-latency.md#permissions-required)                       | Namespaced, Cluster          | <ul><li>pod = \[create, delete, get, list, patch, deletecollection, update]</li><li>events = \[create, get, list, patch, update]</li><li>configMaps = NA</li><li>pods/log = \[get, list, watch]</li><li>pods/exec = NA</li><li>deployments, statefulsets = \[get, list]</li><li>replicasets, daemonsets = \[get, list]</li><li>networkpolicies = NA</li><li>jobs = \[create, delete, get, list, deletecollection]</li><li>chaosEngines, chaosExperiments, chaosResults = \[create, delete, get, list, patch, update]</li><li>secrets = NA</li><li>pod eviction = NA</li><li>nodes = NA\*</li></ul>                           |
| [Pod IO stress](/resilience-testing/chaos-engineering/faults/chaos-fault-categories/kubernetes/pod/pod-io-stress.md#permissions-required)                         | Namespaced, Cluster          | <ul><li>pod = \[create, delete, get, list, patch, deletecollection, update]</li><li>events = \[create, get, list, patch, update]</li><li>configMaps = NA</li><li>pods/log = \[get, list, watch]</li><li>pods/exec = NA</li><li>deployments, statefulsets = \[get, list]</li><li>replicasets, daemonsets = \[get, list]</li><li>networkpolicies = NA</li><li>jobs = \[create, delete, get, list, deletecollection]</li><li>chaosEngines, chaosExperiments, chaosResults = \[create, delete, get, list, patch, update]</li><li>secrets = NA</li><li>pod eviction = NA</li><li>nodes = NA\*</li></ul>                           |
| [Pod memory hog](/resilience-testing/chaos-engineering/faults/chaos-fault-categories/kubernetes/pod/pod-memory-hog.md#permissions-required)                       | Namespaced, Cluster          | <ul><li>pod = \[create, delete, get, list, patch, deletecollection, update]</li><li>events = \[create, get, list, patch, update]</li><li>configMaps = NA</li><li>pods/log = \[get, list, watch]</li><li>pods/exec = NA</li><li>deployments, statefulsets = \[get, list]</li><li>replicasets, daemonsets = \[get, list]</li><li>networkpolicies = NA</li><li>jobs = \[create, delete, get, list, deletecollection]</li><li>chaosEngines, chaosExperiments, chaosResults = \[create, delete, get, list, patch, update]</li><li>secrets = NA</li><li>pod eviction = NA</li><li>nodes = NA\*</li></ul>                           |
| [Pod network corruption](/resilience-testing/chaos-engineering/faults/chaos-fault-categories/kubernetes/pod/pod-network-corruption.md#permissions-required)       | Namespaced, Cluster          | <ul><li>pod = \[create, delete, get, list, patch, deletecollection, update]</li><li>events = \[create, get, list, patch, update]</li><li>configMaps = NA</li><li>pods/log = \[get, list, watch]</li><li>pods/exec = NA</li><li>deployments, statefulsets = \[get, list]</li><li>replicasets, daemonsets = \[get, list]</li><li>networkpolicies = NA</li><li>jobs = \[create, delete, get, list, deletecollection]</li><li>chaosEngines, chaosExperiments, chaosResults = \[create, delete, get, list, patch, update]</li><li>secrets = NA</li><li>pod eviction = NA</li><li>nodes = NA\*</li></ul>                           |
| [Pod network duplication](/resilience-testing/chaos-engineering/faults/chaos-fault-categories/kubernetes/pod/pod-network-duplication.md#permissions-required)     | Namespaced, Cluster          | <ul><li>pod = \[create, delete, get, list, patch, deletecollection, update]</li><li>events = \[create, get, list, patch, update]</li><li>configMaps = NA</li><li>pods/log = \[get, list, watch]</li><li>pods/exec = NA</li><li>deployments, statefulsets = \[get, list]</li><li>replicasets, daemonsets = \[get, list]</li><li>networkpolicies = NA</li><li>jobs = \[create, delete, get, list, deletecollection]</li><li>chaosEngines, chaosExperiments, chaosResults = \[create, delete, get, list, patch, update]</li><li>secrets = NA</li><li>pod eviction = NA</li><li>nodes = NA\*</li></ul>                           |
| [Pod network latency](/resilience-testing/chaos-engineering/faults/chaos-fault-categories/kubernetes/pod/pod-network-latency.md#permissions-required)             | Namespaced, Cluster          | <ul><li>pod = \[create, delete, get, list, patch, deletecollection, update]</li><li>events = \[create, get, list, patch, update]</li><li>configMaps = NA</li><li>pods/log = \[get, list, watch]</li><li>pods/exec = NA</li><li>deployments, statefulsets = \[get, list]</li><li>replicasets, daemonsets = \[get, list]</li><li>networkpolicies = NA</li><li>jobs = \[create, delete, get, list, deletecollection]</li><li>chaosEngines, chaosExperiments, chaosResults = \[create, delete, get, list, patch, update]</li><li>secrets = NA</li><li>pod eviction = NA</li><li>nodes = NA\*</li></ul>                           |
| [Pod network loss](/resilience-testing/chaos-engineering/faults/chaos-fault-categories/kubernetes/pod/pod-network-loss.md#permissions-required)                   | Namespaced, Cluster          | <ul><li>pod = \[create, delete, get, list, patch, deletecollection, update]</li><li>events = \[create, get, list, patch, update]</li><li>configMaps = NA</li><li>pods/log = \[get, list, watch]</li><li>pods/exec = NA</li><li>deployments, statefulsets = \[get, list]</li><li>replicasets, daemonsets = \[get, list]</li><li>networkpolicies = NA</li><li>jobs = \[create, delete, get, list, deletecollection]</li><li>chaosEngines, chaosExperiments, chaosResults = \[create, delete, get, list, patch, update]</li><li>secrets = NA</li><li>pod eviction = NA</li><li>nodes = NA\*</li></ul>                           |
| [Pod network partition \*](/resilience-testing/chaos-engineering/faults/chaos-fault-categories/kubernetes/pod/pod-network-partition.md#permissions-required)      | Namespaced, Cluster          | <ul><li>pod = \[create, delete, get, list, patch, deletecollection, update]</li><li>events = \[create, get, list, patch, update]</li><li>configMaps = NA</li><li>pods/log = \[get, list, watch]</li><li>pods/exec = NA</li><li>deployments, statefulsets = \[get, list]</li><li>replicasets, daemonsets = \[get, list]</li><li>networkpolicies = \[create, delete, get, list]</li><li>jobs = \[create, delete, get, list, deletecollection]</li><li>chaosEngines, chaosExperiments, chaosResults = \[create, delete, get, list, patch, update]</li><li>secrets = NA</li><li>pod eviction = NA</li><li>nodes = NA\*</li></ul> |
| [Pod network rate limit](/resilience-testing/chaos-engineering/faults/chaos-fault-categories/kubernetes/pod/pod-network-rate-limit.md#permissions-required)       | Namespaced, Cluster          | <ul><li>pod = \[create, delete, get, list, patch, deletecollection, update]</li><li>events = \[create, get, list, patch, update]</li><li>configMaps = NA</li><li>pods/log = \[get, list, watch]</li><li>pods/exec = NA</li><li>deployments, statefulsets = \[get, list]</li><li>replicasets, daemonsets = \[get, list]</li><li>networkpolicies = NA</li><li>jobs = \[create, delete, get, list, deletecollection]</li><li>chaosEngines, chaosExperiments, chaosResults = \[create, delete, get, list, patch, update]</li><li>secrets = NA</li><li>pod eviction = NA</li><li>nodes = NA\*</li></ul>                           |
| [Time chaos](/resilience-testing/chaos-engineering/faults/chaos-fault-categories/kubernetes/pod/time-chaos.md#permissions-required)                               | Namespaced, Cluster          | <ul><li>pod = \[create, delete, get, list, patch, deletecollection, update]</li><li>events = \[create, get, list, patch, update]</li><li>configMaps = NA</li><li>pods/log = \[get, list, watch]</li><li>pods/exec = NA</li><li>deployments, statefulsets = \[get, list]</li><li>replicasets, daemonsets = \[get, list]</li><li>networkpolicies = NA</li><li>jobs = \[create, delete, get, list, deletecollection]</li><li>chaosEngines, chaosExperiments, chaosResults = \[create, delete, get, list, patch, update]</li><li>secrets = NA</li><li>pod eviction = NA</li><li>nodes = NA\*</li></ul>                           |

#### Permissions required for node-level faults <a href="#permissions-required-for-node-level-faults" id="permissions-required-for-node-level-faults"></a>

| Node-level faults                                                                                                                                        | Mode (Scopes of chaos agent) | Permissions required                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      |
| -------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| [Kubelet service kill](/resilience-testing/chaos-engineering/faults/chaos-fault-categories/kubernetes/node/kubelet-service-kill.md#permissions-required) | Namespaced, Cluster          | <ul><li>pod = \[create, delete, get, list, patch, deletecollection, update]</li><li>events = \[create, get, list, patch, update]</li><li>configMaps = NA</li><li>pods/log = \[get, list, watch]</li><li>pods/exec = \[get, list, create]</li><li>deployments, statefulsets = NA</li><li>replicasets, daemonsets = NA</li><li>networkpolicies = NA</li><li>jobs = \[create, delete, get, list, deletecollection]</li><li>chaosEngines, chaosExperiments, chaosResults = \[create, delete, get, list, patch, update]</li><li>secrets = NA</li><li>pod eviction = NA</li><li>nodes = \[get, list]</li></ul>                                  |
| [Node CPU hog](/resilience-testing/chaos-engineering/faults/chaos-fault-categories/kubernetes/node/node-cpu-hog.md#permissions-required)                 | Cluster                      | <ul><li>pod = \[create, delete, get, list, patch, deletecollection, update]</li><li>events = \[create, get, list, patch, update]</li><li>configMaps = NA</li><li>pods/log = \[get, list, watch]</li><li>pods/exec = \[get, list, create]</li><li>deployments, statefulsets = NA</li><li>replicasets, daemonsets = NA</li><li>networkpolicies = NA</li><li>jobs = \[create, delete, get, list, deletecollection]</li><li>chaosEngines, chaosExperiments, chaosResults = \[create, delete, get, list, patch, update]</li><li>secrets = NA</li><li>pod eviction = NA</li><li>nodes = \[get, list]</li></ul>                                  |
| [Node drain](/resilience-testing/chaos-engineering/faults/chaos-fault-categories/kubernetes/node/node-drain.md#permissions-required)                     | Cluster                      | <ul><li>pod = \[create, delete, get, list, patch, deletecollection, update]</li><li>events = \[create, get, list, patch, update]</li><li>configMaps = NA</li><li>pods/log = \[get, list, watch]</li><li>pods/exec = \[get, list, create]</li><li>deployments, statefulsets = NA</li><li>replicasets, daemonsets = NA</li><li>networkpolicies = NA</li><li>jobs = \[create, delete, get, list, deletecollection]</li><li>chaosEngines, chaosExperiments, chaosResults = \[create, delete, get, list, patch, update]</li><li>secrets = NA</li><li>pod eviction = \[get, list, create]</li><li>nodes = \[get, list, patch, update]</li></ul> |
| [Node IO stress](/resilience-testing/chaos-engineering/faults/chaos-fault-categories/kubernetes/node/node-io-stress.md#permissions-required)             | Cluster                      | <ul><li>pod = \[create, delete, get, list, patch, deletecollection, update]</li><li>events = \[create, get, list, patch, update]</li><li>configMaps = NA</li><li>pods/log = \[get, list, watch]</li><li>pods/exec = \[get, list, create]</li><li>deployments, statefulsets = NA</li><li>replicasets, daemonsets = NA</li><li>networkpolicies = NA</li><li>jobs = \[create, delete, get, list, deletecollection]</li><li>chaosEngines, chaosExperiments, chaosResults = \[create, delete, get, list, patch, update]</li><li>secrets = NA</li><li>pod eviction = NA</li><li>nodes = \[get, list]</li></ul>                                  |
| [Node memory hog](/resilience-testing/chaos-engineering/faults/chaos-fault-categories/kubernetes/node/node-memory-hog.md#permissions-required)           | Cluster                      | <ul><li>pod = \[create, delete, get, list, patch, deletecollection, update]</li><li>events = \[create, get, list, patch, update]</li><li>configMaps = NA</li><li>pods/log = \[get, list, watch]</li><li>pods/exec = \[get, list, create]</li><li>deployments, statefulsets = NA</li><li>replicasets, daemonsets = NA</li><li>networkpolicies = NA</li><li>jobs = \[create, delete, get, list, deletecollection]</li><li>chaosEngines, chaosExperiments, chaosResults = \[create, delete, get, list, patch, update]</li><li>secrets = NA</li><li>pod eviction = NA</li><li>nodes = \[get, list]</li></ul>                                  |
| [Node network latency](/resilience-testing/chaos-engineering/faults/chaos-fault-categories/kubernetes/node/node-network-latency.md#permissions-required) | Cluster                      | <ul><li>pod = \[create, delete, get, list, patch, deletecollection, update]</li><li>events = \[create, get, list, patch, update]</li><li>configMaps = NA</li><li>pods/log = \[get, list, watch]</li><li>pods/exec = \[get, list, create]</li><li>deployments, statefulsets = NA</li><li>replicasets, daemonsets = NA</li><li>networkpolicies = NA</li><li>jobs = create, delete, get, list, deletecollection</li><li>chaosEngines, chaosExperiments, chaosResults = create, delete, get, list, patch, update</li><li>secrets = NA</li><li>pod eviction = NA</li><li>nodes = \[get, list]</li></ul>                                        |
| [Node network loss](/resilience-testing/chaos-engineering/faults/chaos-fault-categories/kubernetes/node/node-network-loss.md#permissions-required)       | Cluster                      | <ul><li>pod = \[create, delete, get, list, patch, deletecollection, update]</li><li>events = \[create, get, list, patch, update]</li><li>configMaps = NA</li><li>pods/log = \[get, list, watch]</li><li>pods/exec = \[get, list, create]</li><li>deployments, statefulsets = NA</li><li>replicasets, daemonsets = NA</li><li>networkpolicies = NA</li><li>jobs = \[create, delete, get, list, deletecollection]</li><li>chaosEngines, chaosExperiments, chaosResults = \[create, delete, get, list, patch, update]</li><li>secrets = NA</li><li>pod eviction = NA</li><li>nodes = \[get, list]</li></ul>                                  |
| [Node restart](/resilience-testing/chaos-engineering/faults/chaos-fault-categories/kubernetes/node/node-restart.md#permissions-required)                 | Cluster                      | <ul><li>pod = \[create, delete, get, list, patch, deletecollection, update]</li><li>events = \[create, get, list, patch, update]</li><li>configMaps = NA</li><li>pods/log = \[get, list, watch]</li><li>pods/exec = \[get, list, create]</li><li>deployments, statefulsets = NA</li><li>replicasets, daemonsets = NA</li><li>networkpolicies = NA</li><li>jobs = \[create, delete, get, list, deletecollection]</li><li>chaosEngines, chaosExperiments, chaosResults = \[create, delete, get, list, patch, update]</li><li>secrets = \[get, list]</li><li>pod eviction = NA</li><li>nodes = \[get, list]</li></ul>                        |
| [Node taint](/resilience-testing/chaos-engineering/faults/chaos-fault-categories/kubernetes/node/node-taint.md#permissions-required)                     | Cluster                      | <ul><li>pod = \[create, delete, get, list, patch, deletecollection, update]</li><li>events = \[create, get, list, patch, update]</li><li>configMaps = NA</li><li>pods/log = \[get, list, watch]</li><li>pods/exec = \[get, list, create]</li><li>deployments, statefulsets = NA</li><li>replicasets, daemonsets = NA</li><li>networkpolicies = NA</li><li>jobs = \[create, delete, get, list, deletecollection]</li><li>chaosEngines, chaosExperiments, chaosResults = \[create, delete, get, list, patch, update]</li><li>secrets = NA</li><li>pod eviction = \[get, list, create]</li><li>nodes = \[get, list, patch, update]</li></ul> |
| [Kubelet density](/resilience-testing/chaos-engineering/faults/chaos-fault-categories/kube-resilience/kubelet-density.md#permissions-required)           | Cluster                      | <ul><li>pod = \[create, delete, get, list, patch, deletecollection, update]</li><li>events = \[create, get, list, patch, update]</li><li>configMaps = \[get, list]</li><li>pods/log = \[get, list, watch]</li><li>pods/exec = NA</li><li>deployments, statefulsets = NA</li><li>replicasets, daemonsets = NA</li><li>networkpolicies = NA</li><li>jobs = \[create, delete, get, list, deletecollection]</li><li>chaosEngines, chaosExperiments, chaosResults = \[create, delete, get, list, patch, update]</li><li>secrets = \[get, list]</li><li>pod eviction = NA</li><li>nodes = \[get, list]</li></ul>                                |

#### Permissions required for Spring boot faults <a href="#permissions-required-for-spring-boot-faults" id="permissions-required-for-spring-boot-faults"></a>

| Spring boot               | Mode (Scopes of chaos agent) | Permissions required                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                               |
| ------------------------- | ---------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Spring boot app kill      | Namespaced, Cluster          | <ul><li>pod = \[create, delete, get, list, patch, deletecollection, update]</li><li>events = \[create, get, list, patch, update]</li><li>configMaps = NA</li><li>pods/log = \[get, list, watch]</li><li>pods/exec = NA</li><li>deployments, statefulsets = \[get, list]</li><li>replicasets, daemonsets = \[get, list]</li><li>networkpolicies = NA</li><li>jobs = \[create, delete, get, list, deletecollection]</li><li>chaosEngines, chaosExperiments, chaosResults = \[create, delete, get, list, patch, update]</li><li>secrets = NA</li><li>pod eviction = NA</li><li>nodes = NA\*</li></ul> |
| Spring boot CPU stress    | Namespaced, Cluster          | <ul><li>pod = \[create, delete, get, list, patch, deletecollection, update]</li><li>events = \[create, get, list, patch, update]</li><li>configMaps = NA</li><li>pods/log = \[get, list, watch]</li><li>pods/exec = NA</li><li>deployments, statefulsets = \[get, list]</li><li>replicasets, daemonsets = \[get, list]</li><li>networkpolicies = NA</li><li>jobs = \[create, delete, get, list, deletecollection]</li><li>chaosEngines, chaosExperiments, chaosResults = \[create, delete, get, list, patch, update]</li><li>secrets = NA</li><li>pod eviction = NA</li><li>nodes = NA\*</li></ul> |
| Spring boot memory stress | Namespaced, Cluster          | <ul><li>pod = \[create, delete, get, list, patch, deletecollection, update]</li><li>events = \[create, get, list, patch, update]</li><li>configMaps = NA</li><li>pods/log = \[get, list, watch]</li><li>pods/exec = NA</li><li>deployments, statefulsets = \[get, list]</li><li>replicasets, daemonsets = \[get, list]</li><li>networkpolicies = NA</li><li>jobs = \[create, delete, get, list, deletecollection]</li><li>chaosEngines, chaosExperiments, chaosResults = \[create, delete, get, list, patch, update]</li><li>secrets = NA</li><li>pod eviction = NA</li><li>nodes = NA\*</li></ul> |
| Spring boot latency       | Namespaced, Cluster          | <ul><li>pod = \[create, delete, get, list, patch, deletecollection, update]</li><li>events = \[create, get, list, patch, update]</li><li>configMaps = NA</li><li>pods/log = \[get, list, watch]</li><li>pods/exec = NA</li><li>deployments, statefulsets = \[get, list]</li><li>replicasets, daemonsets = \[get, list]</li><li>networkpolicies = NA</li><li>jobs = \[create, delete, get, list, deletecollection]</li><li>chaosEngines, chaosExperiments, chaosResults = \[create, delete, get, list, patch, update]</li><li>secrets = NA</li><li>pod eviction = NA</li><li>nodes = NA\*</li></ul> |
| Spring boot exception     | Namespaced, Cluster          | <ul><li>pod = \[create, delete, get, list, patch, deletecollection, update]</li><li>events = \[create, get, list, patch, update]</li><li>configMaps = NA</li><li>pods/log = \[get, list, watch]</li><li>pods/exec = NA</li><li>deployments, statefulsets = \[get, list]</li><li>replicasets, daemonsets = \[get, list]</li><li>networkpolicies = NA</li><li>jobs = \[create, delete, get, list, deletecollection]</li><li>chaosEngines, chaosExperiments, chaosResults = \[create, delete, get, list, patch, update]</li><li>secrets = NA</li><li>pod eviction = NA</li><li>nodes = NA\*</li></ul> |
| Spring boot fault         | Namespaced, Cluster          | <ul><li>pod = \[create, delete, get, list, patch, deletecollection, update]</li><li>events = \[create, get, list, patch, update]</li><li>configMaps = NA</li><li>pods/log = \[get, list, watch]</li><li>pods/exec = NA</li><li>deployments, statefulsets = \[get, list]</li><li>replicasets, daemonsets = \[get, list]</li><li>networkpolicies = NA</li><li>jobs = \[create, delete, get, list, deletecollection]</li><li>chaosEngines, chaosExperiments, chaosResults = \[create, delete, get, list, patch, update]</li><li>secrets = NA</li><li>pod eviction = NA</li><li>nodes = NA\*</li></ul> |