pod-memory-hog.yaml

---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: pod-memory-hog-sa
  namespace: default
  labels:
    name: pod-memory-hog-sa
    app.kubernetes.io/part-of: litmus
---
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: pod-memory-hog-sa
  namespace: default
  labels:
    name: pod-memory-hog-sa
    app.kubernetes.io/part-of: litmus
rules:
# For creating and monitoring the experiment pods which contains the fault injection logic
  - apiGroups: [""]
    resources: ["pods"]
    verbs: ["create","delete","get","list","patch","update", "deletecollection"]
# For updating the events of the chaos progress in the chaosengine and chaosresult CR (litmus custom resources)
  - apiGroups: [""]
    resources: ["events"]
    verbs: ["create","get","list","patch","update"]
# This is used to track the logs of the different expriment component pods
  - apiGroups: [""]
    resources: ["pods/log"]
    verbs: ["get","list","watch"]  
# It is used for steady state validation (probes) for running a command inside a container and managing it
  - apiGroups: [""]
    resources: ["pods/exec"]
    verbs: ["get","list","create"]
  # deriving the parent/owner details of the target application (if parent is anyof {deployment, statefulset, daemonsets})
  - apiGroups: ["apps"]
    resources: ["deployments","statefulsets","replicasets", "daemonsets"]
    verbs: ["list","get"]
# It is used for configuring and monitor the experiment job to manages its chaos life cycle
  - apiGroups: ["batch"]
    resources: ["jobs"]
    verbs: ["create","list","get","delete","deletecollection"]
# It is used for creation, status polling and deletion of litmus chaos resources used within a chaos workflow
  - apiGroups: ["litmuschaos.io"]
    resources: ["chaosengines","chaosexperiments","chaosresults"]
    verbs: ["create","list","get","patch","update","delete"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: pod-memory-hog-sa
  namespace: default
  labels:
    name: pod-memory-hog-sa
    app.kubernetes.io/part-of: litmus
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: pod-memory-hog-sa
subjects:
- kind: ServiceAccount
  name: pod-memory-hog-sa
  namespace: default