Kubernetes RBAC roles and permissions required by PGO

PGO ships with two distinct RBAC layers: the permissions that the operator itself needs to reconcile PostgresCluster resources, and the per-cluster permissions that each PostgreSQL instance pod needs at runtime. Understanding both layers helps you audit security posture and adapt the RBAC configuration to your organization’s policies.

Operator RBAC

PGO runs under a dedicated ServiceAccount named pgo. A ClusterRoleBinding connects that account to a ClusterRole named postgres-operator, granting it the permissions it needs to manage resources across any namespace.

ServiceAccount

apiVersion: v1
kind: ServiceAccount
metadata:
  name: pgo

ClusterRole summary

The postgres-operator ClusterRole grants PGO the ability to manage the following Kubernetes resources:

API group	Resources	Key verbs
core (`""`)	`configmaps`, `persistentvolumeclaims`, `secrets`, `serviceaccounts`, `services`	create, delete, get, list, patch, watch
core (`""`)	`endpoints`	create, delete, deletecollection, get, list, patch, watch
core (`""`)	`endpoints/restricted`	create
core (`""`)	`pods`	delete, get, list, patch, watch
core (`""`)	`pods/exec`	create
core (`""`)	`events`	create, patch
`apps`	`deployments`, `statefulsets`	create, delete, get, list, patch, watch
`authentication.k8s.io`	`tokenreviews`	create
`authorization.k8s.io`	`subjectaccessreviews`	create
`batch`	`cronjobs`, `jobs`	create, delete, get, list, patch, watch
`coordination.k8s.io`	`leases`	create, get, update, watch
`policy`	`poddisruptionbudgets`	create, delete, get, list, patch, watch
`postgres-operator.crunchydata.com`	`pgadmins`, `pgupgrades`, `postgresclusters`	get, list, patch, watch
`postgres-operator.crunchydata.com`	`/finalizers`, `/status`	update / patch
`rbac.authorization.k8s.io`	`rolebindings`, `roles`	create, delete, get, list, patch, watch
`snapshot.storage.k8s.io`	`volumesnapshots`	create, delete, get, list, patch, watch

The endpoints/restricted permission is required for OpenShift environments where the RestrictedEndpointsAdmission plugin blocks creating Endpoints that contain Pod IPs without explicit authorization.

ClusterRoleBinding

apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: postgres-operator
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: postgres-operator
subjects:
  - kind: ServiceAccount
    name: pgo
    namespace: postgres-operator  # namespace where PGO is deployed

Per-cluster instance RBAC

For each PostgresCluster, PGO creates a namespaced Role, RoleBinding, and ServiceAccount that are used by the PostgreSQL instance pods (primarily by Patroni, the high-availability manager).

What gets created

PGO calls these resources instance RBAC. They are all created in the same namespace as the PostgresCluster with a name derived from the cluster name. The ServiceAccount is configured with automountServiceAccountToken: true so that Patroni can authenticate to the Kubernetes API.

Instance pod permissions

The Role grants Patroni the permissions it needs to coordinate leader election and observe peer pods:

Resource	Verbs
`endpoints`	create, deletecollection, get, list, patch, watch
`pods`	get, list, patch, watch
`services`	create

On OpenShift, an additional rule for endpoints/restricted with the create verb is added automatically when spec.openshift: true is set (or auto-detected).

Viewing instance RBAC resources

# List the ServiceAccount, Role, and RoleBinding created for a cluster named "hippo"
kubectl get serviceaccount,role,rolebinding \
  -l postgres-operator.crunchydata.com/cluster=hippo \
  --namespace postgres-operator

# Inspect the Role's rules
kubectl get role \
  -l postgres-operator.crunchydata.com/cluster=hippo \
  --namespace postgres-operator \
  -o yaml

Viewing operator RBAC resources

List the operator ClusterRole

kubectl get clusterrole postgres-operator -o yaml

Verify the ClusterRoleBinding

kubectl get clusterrolebinding postgres-operator -o yaml

Confirm the operator ServiceAccount

kubectl get serviceaccount pgo --namespace postgres-operator

Namespaced vs. cluster-scoped permissions

PGO uses cluster-scoped RBAC by default so it can manage PostgresCluster resources across multiple namespaces from a single operator deployment. The Kustomize configuration ships with a cluster/ overlay that applies the ClusterRole and ClusterRoleBinding shown above. If your environment requires namespace-scoped operator permissions, you will need to adapt the provided Kustomize overlays. A namespace/ directory exists in the config/rbac/ tree as a starting point, but namespaced deployments require additional configuration and may limit cross-namespace features.

When running multiple PostgresCluster resources in different namespaces, PGO creates one root CA Secret per namespace (postgres-operator-ca-secret) and one instance RBAC set per cluster. Audit these resources namespace-by-namespace to get a complete picture.

OpenShift security context constraints

On OpenShift, PGO detects the environment automatically (or you can set spec.openshift: true explicitly on the PostgresCluster). When OpenShift mode is active, PGO:

Adds the endpoints/restricted create verb to the instance pod Role so Patroni can register Pod IPs in Endpoints.
Expects that the Security Context Constraint (SCC) assigned to the instance ServiceAccount allows the containers to run with the UID and GID that the PostgreSQL image requires.

Consult your OpenShift administrator to assign the appropriate SCC to the instance ServiceAccount for each cluster.

Installation with Kustomize — deploying PGO and applying the RBAC manifests
Installation with Helm — Helm chart values that control RBAC resource creation
Create a cluster — creating your first PostgresCluster after RBAC is in place
PostgresCluster reference — spec.openshift and other spec fields

Get Started

Installation

Core Operations

Day-Two Operations

Security

Kubernetes RBAC roles and permissions required by PGO

Operator RBAC

ServiceAccount

ClusterRole summary

ClusterRoleBinding

Per-cluster instance RBAC

What gets created

Instance pod permissions

Viewing instance RBAC resources

Viewing operator RBAC resources

Namespaced vs. cluster-scoped permissions

OpenShift security context constraints

​Operator RBAC

​ServiceAccount

​ClusterRole summary

​ClusterRoleBinding

​Per-cluster instance RBAC

​What gets created

​Instance pod permissions

​Viewing instance RBAC resources

​Viewing operator RBAC resources

​Namespaced vs. cluster-scoped permissions

​OpenShift security context constraints

​Related pages

Operator RBAC

ServiceAccount

ClusterRole summary

ClusterRoleBinding

Per-cluster instance RBAC

What gets created

Instance pod permissions

Viewing instance RBAC resources

Viewing operator RBAC resources

Namespaced vs. cluster-scoped permissions

OpenShift security context constraints

Related pages