> For the complete documentation index, see [llms.txt](https://developer.harness.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://developer.harness.io/resilience-testing/chaos-engineering/use-chaos-engineering/infrastructure/types/ddcr/permissions.md).

# Permissions

This topic lists the RBAC permissions required to execute [DDCR-based](/resilience-testing/chaos-engineering/use-chaos-engineering/infrastructure/types/ddcr/ddcr.md#what-is-ddcr) Kubernetes faults.

| Resource                                           | Modes (Scope of chaos agent) | Permissions required                                                 | Uses                                                                                                              |
| -------------------------------------------------- | ---------------------------- | -------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------- |
| pods                                               | Namespaced, Cluster          | \[create, delete, get, list, patch, update, watch, deletecollection] | <ul><li>Injecting chaos.</li><li>Creating and monitoring helper pods.</li><li>Tracking and getting logs</li></ul> |
| secrets, configmaps, services                      | Namespaced, Cluster          | \[create, delete, get, list, patch, update, watch, deletecollection] | Creating and monitoring helper pods.                                                                              |
| deployments, replicasets, daemonsets, statefulsets | Namespaced, Cluster          | \[get, list]                                                         | Checking app parent resources as eligible chaos candidate.                                                        |
| replicationcontrollers                             | Namespaced, Cluster          | \[get, list]                                                         | Checking app parent resources as eligible chaos candidate.                                                        |
| services                                           | Namespaced, Cluster          | \[get, list]                                                         | Checking app parent resources as eligible chaos candidate.                                                        |
| deploymentconfigs                                  | Namespaced, Cluster          | \[get, list]                                                         | Checking app parent resources as eligible chaos candidate in OpenShift environments.                              |
| rollouts                                           | Namespaced, Cluster          | \[get, list]                                                         | Checking app parent resources as eligible chaos candidate.                                                        |
| jobs                                               | Namespaced, Cluster          | \[create, delete, get, list, patch, update, watch, deletecollection] | Creating and monitoring helper pods.                                                                              |
| pods/logs                                          | Namespaced, Cluster          | \[get, list, watch]                                                  | Tracking and getting logs of helper pods.                                                                         |
| deployments                                        | Namespaced, Cluster          | \[create, delete, get, list, patch, update, deletecollection]        | To manage the self pod lifecycle.                                                                                 |