Fault-wise permissions

This topic describes the prerequisites and fault-wise permissions required to execute Kubernetes-based faults.

The prerequisites can be categorized into two groups:

1. Common prerequisites

2. Fault-type specific prerequisites

Common prerequisites

• Ensure that the Kubernetes chaos infrastructure (or agent) is installed and all the components are healthy and in running state.

• There should be outbound connectivity from the cluster pods to the Harness control plane.

• Connectivity should be established between the cluster pods to any endpoint that needs to be queried as a part of the probe execution (or resilience validation).

• Appropriate RBAC should be set up on the Kubernetes cluster, so that the service accounts used by the agent components are sufficient for the discovery and chaos injection. This is based on:

  • The scope of execution (cluster-wide or namespaced).

  • The nature of faults planned to be executed.

Fault-type specific prerequisites

Certain fault categories have unique requirements, from a permissions and set up (or configuration) perspective.

Pod network/Stress/API/IO

These faults require identifying the target container PID and remote execution of certain commands (or processes) within the target containers' network, PID, and mount namespace. These actions require the transient chaos pods to run with:

• Root user;

• Container runtime socket mounted;

• Privilege escalation;

• Linux capabilities like NET_ADMIN, SYS_ADMIN;

• Mapping to hostpid.

HCE recommends you create a dedicated pod security policy (PSP) or equivalent that you can map to the transient chaos pods or service account.

Service load

Internally, the load fault leverages Locust (support for other tools is a part of the roadmap). The internal load engine uses a Python script to define the API calls that should be part of the load profile. The script is embedded within a ConfigMap that is referenced by the chaos pods during execution. Go to locust prerequisites for detailed steps

Cloud-based targets

Create an IAM role on the cloud account that is mapped to the appropriate policy. Your (cloud account user) credentials must be embedded with a Kubernetes secret before executing the fault. You can create a superset AWS policy that allows executing all the fault types supported by HCE.

• You can authenticate cloud API requests made by the chaos pods. If the Kubernetes chaos infrastructure (or agent) is set up on EKS or GKE clusters, you can set up IRSA or workload identity respectively, instead of using Kubernetes secrets.

• You can configure ChaosGuard rules to limit the scope of the Harness chaos platform for faults executed, clusters chosen, application workload targeted and chaos service account leveraged.

• The Service Load chaos is target-platform agnostic, that is, it can generate load against service endpoints regardless of where they are hosted.

Permissions required for pod-level faults

This table lists the permissions required to execute Kubernetes fault (node-level and pod-level).

• NA refers to Not Applicable.

• NA* indicates that the permissions are not required for pod-level experiments by default, but if you want to target the pods on specific node, then the permissions will be required.

• Starred pod-level experiments indicate that they don't require helper pods for execution.

Read the permission as: "You can create pod delete fault in Namespaced and cluster mode, and on the pod entity, it requires permissions to [create, delete, get, list, patch, deletecollection, update] the pod.

Pod-level faults	Mode (Scopes of chaos agent)	Permissions required
Pod delete *	Namespaced, Cluster	pod = [create, delete, get, list, patch, deletecollection, update] events = [create, get, list, patch, update] configMaps = NA pods/log = [get, list, watch] pods/exec = NA deployments, statefulsets = [get, list] replicasets, daemonsets = [get, list] networkpolicies = NA jobs = [create, delete, get, list, deletecollection] chaosEngines, chaosExperiments, chaosResults = [create, delete, get, list, patch, update] secrets = NA pod eviction = NA nodes = NA*
Container kill	Namespaced, Cluster	pod = [create, delete, get, list, patch, deletecollection, update] events = [create, get, list, patch, update] configMaps = NA pods/log = [get, list, watch] pods/exec = NA deployments, statefulsets = [get, list] replicasets, daemonsets = [get, list] networkpolicies = NA jobs = [create, delete, get, list, deletecollection] chaosEngines, chaosExperiments, chaosResults = [create, delete, get, list, patch, update] secrets = NA pod eviction = NA nodes = NA*
Disk fill	Namespaced, Cluster	pod = [create, delete, get, list, patch, deletecollection, update] events = [create, get, list, patch, update] configMaps = NA pods/log = [get, list, watch] pods/exec = NA deployments, statefulsets = [get, list] replicasets, daemonsets = [get, list] networkpolicies = NA jobs = [create, delete, get, list, deletecollection] chaosEngines, chaosExperiments, chaosResults = [create, delete, get, list, patch, update] secrets = NA pod eviction = NA nodes = NA*
Pod API block	Namespaced, Cluster	pod = [create, delete, get, list, patch, deletecollection, update] events = [create, get, list, patch, update] configMaps = NA pods/log = [get, list, watch] pods/exec = NA deployments, statefulsets = [get, list] replicasets, daemonsets = [get, list] networkpolicies = NA jobs = [create, delete, get, list, deletecollection] chaosEngines, chaosExperiments, chaosResults = [create, delete, get, list, patch, update] secrets = NA pod eviction = NA nodes = NA*
Pod API latency	Namespaced, Cluster	pod = [create, delete, get, list, patch, deletecollection, update] events = [create, get, list, patch, update] configMaps = NA pods/log = [get, list, watch] pods/exec = NA deployments, statefulsets = [get, list] replicasets, daemonsets = [get, list] networkpolicies = NA jobs = [create, delete, get, list, deletecollection] chaosEngines, chaosExperiments, chaosResults = [create, delete, get, list, patch, update] secrets = NA pod eviction = NA nodes = NA*
Pod API modify body	Namespaced, Cluster	pod = [create, delete, get, list, patch, deletecollection, update] events = [create, get, list, patch, update] configMaps = NA pods/log = [get, list, watch] pods/exec = NA deployments, statefulsets = [get, list] replicasets, daemonsets = [get, list] networkpolicies = NA jobs = [create, delete, get, list, deletecollection] chaosEngines, chaosExperiments, chaosResults = [create, delete, get, list, patch, update] secrets = NA pod eviction = NA nodes = NA*
Pod API modify header	Namespaced, Cluster	pod = [create, delete, get, list, patch, deletecollection, update] events = [create, get, list, patch, update] configMaps = NA pods/log = [get, list, watch] pods/exec = NA deployments, statefulsets = [get, list] replicasets, daemonsets = [get, list] networkpolicies = NA jobs = [create, delete, get, list, deletecollection] chaosEngines, chaosExperiments, chaosResults = [create, delete, get, list, patch, update] secrets = NA pod eviction = NA nodes = NA*
Pod API status code	Namespaced, Cluster	pod = [create, delete, get, list, patch, deletecollection, update] events = [create, get, list, patch, update] configMaps = NA pods/log = [get, list, watch] pods/exec = NA deployments, statefulsets = [get, list] replicasets, daemonsets = [get, list] networkpolicies = NA jobs = [create, delete, get, list, deletecollection] chaosEngines, chaosExperiments, chaosResults = [create, delete, get, list, patch, update] secrets = NA pod eviction = NA nodes = NA*
Pod autoscaler *	Namespaced, Cluster	pod = [create, delete, get, list, patch, deletecollection, update] events = [create, get, list, patch, update] configMaps = NA pods/log = [get, list, watch] pods/exec = NA deployments, statefulsets = [get, list, patch, update] replicasets, daemonsets = NA networkpolicies = NA jobs = [create, delete, get, list, deletecollection] chaosEngines, chaosExperiments, chaosResults = [create, delete, get, list, patch, update] secrets = NA pod eviction = NA nodes = NA*
Pod CPU hog	Namespaced, Cluster	pod = [create, delete, get, list, patch, deletecollection, update] events = [create, get, list, patch, update] configMaps = NA pods/log = [get, list, watch] pods/exec = NA deployments, statefulsets = [get, list] replicasets, daemonsets = [get, list] networkpolicies = NA jobs = [create, delete, get, list, deletecollection] chaosEngines, chaosExperiments, chaosResults = [create, delete, get, list, patch, update] secrets = NA pod eviction = NA nodes = NA*
Pod DNS error	Namespaced, Cluster	pod = [create, delete, get, list, patch, deletecollection, update] events = [create, get, list, patch, update] configMaps = NA pods/log = [get, list, watch] pods/exec = NA deployments, statefulsets = [get, list] replicasets, daemonsets = [get, list] networkpolicies = NA jobs = [create, delete, get, list, deletecollection] chaosEngines, chaosExperiments, chaosResults = [create, delete, get, list, patch, update] secrets = NA pod eviction = NA nodes = NA*
Pod DNS spoof	Namespaced, Cluster	pod = [create, delete, get, list, patch, deletecollection, update] events = [create, get, list, patch, update] configMaps = NA pods/log = [get, list, watch] pods/exec = NA deployments, statefulsets = [get, list] replicasets, daemonsets = [get, list] networkpolicies = NA jobs = [create, delete, get, list, deletecollection] chaosEngines, chaosExperiments, chaosResults = [create, delete, get, list, patch, update] secrets = NA pod eviction = NA nodes = NA*
Pod HTTP latency	Namespaced, Cluster	pod = [create, delete, get, list, patch, deletecollection, update] events = [create, get, list, patch, update] configMaps = NA pods/log = [get, list, watch] pods/exec = NA deployments, statefulsets = [get, list] replicasets, daemonsets = [get, list] networkpolicies = NA jobs = [create, delete, get, list, deletecollection] chaosEngines, chaosExperiments, chaosResults = [create, delete, get, list, patch, update] secrets = NA pod eviction = NA nodes = NA*
Pod HTTP modify body	Namespaced, Cluster	pod = [create, delete, get, list, patch, deletecollection, update] events = [create, get, list, patch, update] configMaps = NA pods/log = [get, list, watch] pods/exec = NA deployments, statefulsets = [get, list] replicasets, daemonsets = [get, list] networkpolicies = NA jobs = [create, delete, get, list, deletecollection] chaosEngines, chaosExperiments, chaosResults = [create, delete, get, list, patch, update] secrets = NA pod eviction = NA nodes = NA*
Pod HTTP modify header	Namespaced, Cluster	pod = [create, delete, get, list, patch, deletecollection, update] events = [create, get, list, patch, update] configMaps = NA pods/log = [get, list, watch] pods/exec = NA deployments, statefulsets = [get, list] replicasets, daemonsets = [get, list] networkpolicies = NA jobs = [create, delete, get, list, deletecollection] chaosEngines, chaosExperiments, chaosResults = [create, delete, get, list, patch, update] secrets = NA pod eviction = NA nodes = NA*
Pod HTTP reset peer	Namespaced, Cluster	pod = [create, delete, get, list, patch, deletecollection, update] events = [create, get, list, patch, update] configMaps = NA pods/log = [get, list, watch] pods/exec = NA deployments, statefulsets = [get, list] replicasets, daemonsets = [get, list] networkpolicies = NA jobs = [create, delete, get, list, deletecollection] chaosEngines, chaosExperiments, chaosResults = [create, delete, get, list, patch, update] secrets = NA pod eviction = NA nodes = NA*
Pod HTTP status code	Namespaced, Cluster	pod = [create, delete, get, list, patch, deletecollection, update] events = [create, get, list, patch, update] configMaps = NA pods/log = [get, list, watch] pods/exec = NA deployments, statefulsets = [get, list] replicasets, daemonsets = [get, list] networkpolicies = NA jobs = [create, delete, get, list, deletecollection] chaosEngines, chaosExperiments, chaosResults = [create, delete, get, list, patch, update] secrets = NA pod eviction = NA nodes = NA*
Pod IO attribute override	Namespaced, Cluster	pod = [create, delete, get, list, patch, deletecollection, update] events = [create, get, list, patch, update] configMaps = NA pods/log = [get, list, watch] pods/exec = NA deployments, statefulsets = [get, list] replicasets, daemonsets = [get, list] networkpolicies = NA jobs = [create, delete, get, list, deletecollection] chaosEngines, chaosExperiments, chaosResults = [create, delete, get, list, patch, update] secrets = NA pod eviction = NA nodes = NA*
Pod IO error	Namespaced, Cluster	pod = [create, delete, get, list, patch, deletecollection, update] events = [create, get, list, patch, update] configMaps = NA pods/log = [get, list, watch] pods/exec = NA deployments, statefulsets = [get, list] replicasets, daemonsets = [get, list] networkpolicies = NA jobs = [create, delete, get, list, deletecollection] chaosEngines, chaosExperiments, chaosResults = [create, delete, get, list, patch, update] secrets = NA pod eviction = NA nodes = NA*
Pod IO latency	Namespaced, Cluster	pod = [create, delete, get, list, patch, deletecollection, update] events = [create, get, list, patch, update] configMaps = NA pods/log = [get, list, watch] pods/exec = NA deployments, statefulsets = [get, list] replicasets, daemonsets = [get, list] networkpolicies = NA jobs = [create, delete, get, list, deletecollection] chaosEngines, chaosExperiments, chaosResults = [create, delete, get, list, patch, update] secrets = NA pod eviction = NA nodes = NA*
Pod IO stress	Namespaced, Cluster	pod = [create, delete, get, list, patch, deletecollection, update] events = [create, get, list, patch, update] configMaps = NA pods/log = [get, list, watch] pods/exec = NA deployments, statefulsets = [get, list] replicasets, daemonsets = [get, list] networkpolicies = NA jobs = [create, delete, get, list, deletecollection] chaosEngines, chaosExperiments, chaosResults = [create, delete, get, list, patch, update] secrets = NA pod eviction = NA nodes = NA*
Pod memory hog	Namespaced, Cluster	pod = [create, delete, get, list, patch, deletecollection, update] events = [create, get, list, patch, update] configMaps = NA pods/log = [get, list, watch] pods/exec = NA deployments, statefulsets = [get, list] replicasets, daemonsets = [get, list] networkpolicies = NA jobs = [create, delete, get, list, deletecollection] chaosEngines, chaosExperiments, chaosResults = [create, delete, get, list, patch, update] secrets = NA pod eviction = NA nodes = NA*
Pod network corruption	Namespaced, Cluster	pod = [create, delete, get, list, patch, deletecollection, update] events = [create, get, list, patch, update] configMaps = NA pods/log = [get, list, watch] pods/exec = NA deployments, statefulsets = [get, list] replicasets, daemonsets = [get, list] networkpolicies = NA jobs = [create, delete, get, list, deletecollection] chaosEngines, chaosExperiments, chaosResults = [create, delete, get, list, patch, update] secrets = NA pod eviction = NA nodes = NA*
Pod network duplication	Namespaced, Cluster	pod = [create, delete, get, list, patch, deletecollection, update] events = [create, get, list, patch, update] configMaps = NA pods/log = [get, list, watch] pods/exec = NA deployments, statefulsets = [get, list] replicasets, daemonsets = [get, list] networkpolicies = NA jobs = [create, delete, get, list, deletecollection] chaosEngines, chaosExperiments, chaosResults = [create, delete, get, list, patch, update] secrets = NA pod eviction = NA nodes = NA*
Pod network latency	Namespaced, Cluster	pod = [create, delete, get, list, patch, deletecollection, update] events = [create, get, list, patch, update] configMaps = NA pods/log = [get, list, watch] pods/exec = NA deployments, statefulsets = [get, list] replicasets, daemonsets = [get, list] networkpolicies = NA jobs = [create, delete, get, list, deletecollection] chaosEngines, chaosExperiments, chaosResults = [create, delete, get, list, patch, update] secrets = NA pod eviction = NA nodes = NA*
Pod network loss	Namespaced, Cluster	pod = [create, delete, get, list, patch, deletecollection, update] events = [create, get, list, patch, update] configMaps = NA pods/log = [get, list, watch] pods/exec = NA deployments, statefulsets = [get, list] replicasets, daemonsets = [get, list] networkpolicies = NA jobs = [create, delete, get, list, deletecollection] chaosEngines, chaosExperiments, chaosResults = [create, delete, get, list, patch, update] secrets = NA pod eviction = NA nodes = NA*
Pod network partition *	Namespaced, Cluster	pod = [create, delete, get, list, patch, deletecollection, update] events = [create, get, list, patch, update] configMaps = NA pods/log = [get, list, watch] pods/exec = NA deployments, statefulsets = [get, list] replicasets, daemonsets = [get, list] networkpolicies = [create, delete, get, list] jobs = [create, delete, get, list, deletecollection] chaosEngines, chaosExperiments, chaosResults = [create, delete, get, list, patch, update] secrets = NA pod eviction = NA nodes = NA*
Pod network rate limit	Namespaced, Cluster	pod = [create, delete, get, list, patch, deletecollection, update] events = [create, get, list, patch, update] configMaps = NA pods/log = [get, list, watch] pods/exec = NA deployments, statefulsets = [get, list] replicasets, daemonsets = [get, list] networkpolicies = NA jobs = [create, delete, get, list, deletecollection] chaosEngines, chaosExperiments, chaosResults = [create, delete, get, list, patch, update] secrets = NA pod eviction = NA nodes = NA*
Time chaos	Namespaced, Cluster	pod = [create, delete, get, list, patch, deletecollection, update] events = [create, get, list, patch, update] configMaps = NA pods/log = [get, list, watch] pods/exec = NA deployments, statefulsets = [get, list] replicasets, daemonsets = [get, list] networkpolicies = NA jobs = [create, delete, get, list, deletecollection] chaosEngines, chaosExperiments, chaosResults = [create, delete, get, list, patch, update] secrets = NA pod eviction = NA nodes = NA*

Permissions required for node-level faults

Node-level faults	Mode (Scopes of chaos agent)	Permissions required
Kubelet service kill	Namespaced, Cluster	pod = [create, delete, get, list, patch, deletecollection, update] events = [create, get, list, patch, update] configMaps = NA pods/log = [get, list, watch] pods/exec = [get, list, create] deployments, statefulsets = NA replicasets, daemonsets = NA networkpolicies = NA jobs = [create, delete, get, list, deletecollection] chaosEngines, chaosExperiments, chaosResults = [create, delete, get, list, patch, update] secrets = NA pod eviction = NA nodes = [get, list]
Node CPU hog	Cluster	pod = [create, delete, get, list, patch, deletecollection, update] events = [create, get, list, patch, update] configMaps = NA pods/log = [get, list, watch] pods/exec = [get, list, create] deployments, statefulsets = NA replicasets, daemonsets = NA networkpolicies = NA jobs = [create, delete, get, list, deletecollection] chaosEngines, chaosExperiments, chaosResults = [create, delete, get, list, patch, update] secrets = NA pod eviction = NA nodes = [get, list]
Node drain	Cluster	pod = [create, delete, get, list, patch, deletecollection, update] events = [create, get, list, patch, update] configMaps = NA pods/log = [get, list, watch] pods/exec = [get, list, create] deployments, statefulsets = NA replicasets, daemonsets = NA networkpolicies = NA jobs = [create, delete, get, list, deletecollection] chaosEngines, chaosExperiments, chaosResults = [create, delete, get, list, patch, update] secrets = NA pod eviction = [get, list, create] nodes = [get, list, patch, update]
Node IO stress	Cluster	pod = [create, delete, get, list, patch, deletecollection, update] events = [create, get, list, patch, update] configMaps = NA pods/log = [get, list, watch] pods/exec = [get, list, create] deployments, statefulsets = NA replicasets, daemonsets = NA networkpolicies = NA jobs = [create, delete, get, list, deletecollection] chaosEngines, chaosExperiments, chaosResults = [create, delete, get, list, patch, update] secrets = NA pod eviction = NA nodes = [get, list]
Node memory hog	Cluster	pod = [create, delete, get, list, patch, deletecollection, update] events = [create, get, list, patch, update] configMaps = NA pods/log = [get, list, watch] pods/exec = [get, list, create] deployments, statefulsets = NA replicasets, daemonsets = NA networkpolicies = NA jobs = [create, delete, get, list, deletecollection] chaosEngines, chaosExperiments, chaosResults = [create, delete, get, list, patch, update] secrets = NA pod eviction = NA nodes = [get, list]
Node network latency	Cluster	pod = [create, delete, get, list, patch, deletecollection, update] events = [create, get, list, patch, update] configMaps = NA pods/log = [get, list, watch] pods/exec = [get, list, create] deployments, statefulsets = NA replicasets, daemonsets = NA networkpolicies = NA jobs = create, delete, get, list, deletecollection chaosEngines, chaosExperiments, chaosResults = create, delete, get, list, patch, update secrets = NA pod eviction = NA nodes = [get, list]
Node network loss	Cluster	pod = [create, delete, get, list, patch, deletecollection, update] events = [create, get, list, patch, update] configMaps = NA pods/log = [get, list, watch] pods/exec = [get, list, create] deployments, statefulsets = NA replicasets, daemonsets = NA networkpolicies = NA jobs = [create, delete, get, list, deletecollection] chaosEngines, chaosExperiments, chaosResults = [create, delete, get, list, patch, update] secrets = NA pod eviction = NA nodes = [get, list]
Node restart	Cluster	pod = [create, delete, get, list, patch, deletecollection, update] events = [create, get, list, patch, update] configMaps = NA pods/log = [get, list, watch] pods/exec = [get, list, create] deployments, statefulsets = NA replicasets, daemonsets = NA networkpolicies = NA jobs = [create, delete, get, list, deletecollection] chaosEngines, chaosExperiments, chaosResults = [create, delete, get, list, patch, update] secrets = [get, list] pod eviction = NA nodes = [get, list]
Node taint	Cluster	pod = [create, delete, get, list, patch, deletecollection, update] events = [create, get, list, patch, update] configMaps = NA pods/log = [get, list, watch] pods/exec = [get, list, create] deployments, statefulsets = NA replicasets, daemonsets = NA networkpolicies = NA jobs = [create, delete, get, list, deletecollection] chaosEngines, chaosExperiments, chaosResults = [create, delete, get, list, patch, update] secrets = NA pod eviction = [get, list, create] nodes = [get, list, patch, update]
Kubelet density	Cluster	pod = [create, delete, get, list, patch, deletecollection, update] events = [create, get, list, patch, update] configMaps = [get, list] pods/log = [get, list, watch] pods/exec = NA deployments, statefulsets = NA replicasets, daemonsets = NA networkpolicies = NA jobs = [create, delete, get, list, deletecollection] chaosEngines, chaosExperiments, chaosResults = [create, delete, get, list, patch, update] secrets = [get, list] pod eviction = NA nodes = [get, list]

Permissions required for Spring boot faults

Spring boot	Mode (Scopes of chaos agent)	Permissions required
Spring boot app kill	Namespaced, Cluster	pod = [create, delete, get, list, patch, deletecollection, update] events = [create, get, list, patch, update] configMaps = NA pods/log = [get, list, watch] pods/exec = NA deployments, statefulsets = [get, list] replicasets, daemonsets = [get, list] networkpolicies = NA jobs = [create, delete, get, list, deletecollection] chaosEngines, chaosExperiments, chaosResults = [create, delete, get, list, patch, update] secrets = NA pod eviction = NA nodes = NA*
Spring boot CPU stress	Namespaced, Cluster	pod = [create, delete, get, list, patch, deletecollection, update] events = [create, get, list, patch, update] configMaps = NA pods/log = [get, list, watch] pods/exec = NA deployments, statefulsets = [get, list] replicasets, daemonsets = [get, list] networkpolicies = NA jobs = [create, delete, get, list, deletecollection] chaosEngines, chaosExperiments, chaosResults = [create, delete, get, list, patch, update] secrets = NA pod eviction = NA nodes = NA*
Spring boot memory stress	Namespaced, Cluster	pod = [create, delete, get, list, patch, deletecollection, update] events = [create, get, list, patch, update] configMaps = NA pods/log = [get, list, watch] pods/exec = NA deployments, statefulsets = [get, list] replicasets, daemonsets = [get, list] networkpolicies = NA jobs = [create, delete, get, list, deletecollection] chaosEngines, chaosExperiments, chaosResults = [create, delete, get, list, patch, update] secrets = NA pod eviction = NA nodes = NA*
Spring boot latency	Namespaced, Cluster	pod = [create, delete, get, list, patch, deletecollection, update] events = [create, get, list, patch, update] configMaps = NA pods/log = [get, list, watch] pods/exec = NA deployments, statefulsets = [get, list] replicasets, daemonsets = [get, list] networkpolicies = NA jobs = [create, delete, get, list, deletecollection] chaosEngines, chaosExperiments, chaosResults = [create, delete, get, list, patch, update] secrets = NA pod eviction = NA nodes = NA*
Spring boot exception	Namespaced, Cluster	pod = [create, delete, get, list, patch, deletecollection, update] events = [create, get, list, patch, update] configMaps = NA pods/log = [get, list, watch] pods/exec = NA deployments, statefulsets = [get, list] replicasets, daemonsets = [get, list] networkpolicies = NA jobs = [create, delete, get, list, deletecollection] chaosEngines, chaosExperiments, chaosResults = [create, delete, get, list, patch, update] secrets = NA pod eviction = NA nodes = NA*
Spring boot fault	Namespaced, Cluster	pod = [create, delete, get, list, patch, deletecollection, update] events = [create, get, list, patch, update] configMaps = NA pods/log = [get, list, watch] pods/exec = NA deployments, statefulsets = [get, list] replicasets, daemonsets = [get, list] networkpolicies = NA jobs = [create, delete, get, list, deletecollection] chaosEngines, chaosExperiments, chaosResults = [create, delete, get, list, patch, update] secrets = NA pod eviction = NA nodes = NA*