RBAC reference

Default grants of the Helm chart (release tailnet-operator, namespace tailnet-system), derived from the rendered manifests, not from a cluster.

Scope

tailnet-operator-crds (ClusterRole): read Tailnet and TailnetIngress, write their status and finalizers. No CR spec writes, no CRD-object access.
tailnet-operator-workloads (ClusterRole): the children of tenant ingresses in every namespace — Secrets, ConfigMaps, Deployments, NetworkPolicies, Events; Pods read-only; cert-manager Certificates get/create/patch/delete (no Issuer or CertificateRequest access).
tailnet-operator (Role, operator namespace): TailnetEgress read/status/finalizers, Services, leader-election Leases, and the same workload verbs for egress children.
The ClusterRole/Role split documents which resources each controller touches; it does not narrow effective privilege, because Kubernetes RBAC is additive and cannot restrict create by resourceNames.
No wildcards, no non-resource URLs. Disabling leader election removes the Lease rule.

Reproduce

bash hack/rbac-diff.sh --check fails on drift; --write regenerates this file after a reviewed change. Both render chart defaults with Helm and need no cluster. The effective-namespace column follows the bindings: a RoleBinding limits its role to that namespace, a ClusterRoleBinding means all namespaces.

Effective rules

Role	Role namespace	Effective namespace(s)	API groups	Resources	Verbs	Resource names	Non-resource URLs
`ClusterRole/tailnet-operator-crds`	—	`cluster-wide`	`tsunaro.io`	`tailnetgateways/status`	`get`, `patch`, `update`	all names	—
`ClusterRole/tailnet-operator-crds`	—	`cluster-wide`	`tsunaro.io`	`tailnetgateways`	`get`, `list`, `patch`, `watch`	all names	—
`ClusterRole/tailnet-operator-crds`	—	`cluster-wide`	`tsunaro.io`	`tailnetingresses/finalizers`, `tailnets/finalizers`	`update`	all names	—
`ClusterRole/tailnet-operator-crds`	—	`cluster-wide`	`tsunaro.io`	`tailnetingresses/status`	`get`, `patch`, `update`	all names	—
`ClusterRole/tailnet-operator-crds`	—	`cluster-wide`	`tsunaro.io`	`tailnetingresses`	`get`, `list`, `watch`	all names	—
`ClusterRole/tailnet-operator-crds`	—	`cluster-wide`	`tsunaro.io`	`tailnets/status`	`get`, `patch`, `update`	all names	—
`ClusterRole/tailnet-operator-crds`	—	`cluster-wide`	`tsunaro.io`	`tailnets`	`get`, `list`, `watch`	all names	—
`ClusterRole/tailnet-operator-crds`	—	`cluster-wide`	`tsunaro.io`	`tailnetsites/status`	`get`, `patch`, `update`	all names	—
`ClusterRole/tailnet-operator-crds`	—	`cluster-wide`	`tsunaro.io`	`tailnetsites`	`get`, `list`, `watch`	all names	—
`ClusterRole/tailnet-operator-workloads`	—	`cluster-wide`	`(core)`	`configmaps`, `secrets`	`create`, `delete`, `get`, `list`, `patch`, `update`, `watch`	all names	—
`ClusterRole/tailnet-operator-workloads`	—	`cluster-wide`	`(core)`	`events`	`create`, `patch`	all names	—
`ClusterRole/tailnet-operator-workloads`	—	`cluster-wide`	`(core)`	`pods`	`get`, `list`, `watch`	all names	—
`ClusterRole/tailnet-operator-workloads`	—	`cluster-wide`	`apps`	`deployments`	`create`, `delete`, `get`, `list`, `patch`, `update`, `watch`	all names	—
`ClusterRole/tailnet-operator-workloads`	—	`cluster-wide`	`cert-manager.io`	`certificates`	`create`, `delete`, `get`, `patch`	all names	—
`ClusterRole/tailnet-operator-workloads`	—	`cluster-wide`	`networking.k8s.io`	`networkpolicies`	`create`, `delete`, `get`, `list`, `patch`, `update`, `watch`	all names	—
`Role/tailnet-operator`	`tailnet-system`	`tailnet-system`	`(core)`	`configmaps`, `secrets`, `services`	`create`, `delete`, `get`, `list`, `patch`, `update`, `watch`	all names	—
`Role/tailnet-operator`	`tailnet-system`	`tailnet-system`	`(core)`	`events`	`create`, `patch`	all names	—
`Role/tailnet-operator`	`tailnet-system`	`tailnet-system`	`(core)`	`pods`	`get`, `list`, `watch`	all names	—
`Role/tailnet-operator`	`tailnet-system`	`tailnet-system`	`(core)`	`serviceaccounts`	`create`, `delete`, `get`	all names	—
`Role/tailnet-operator`	`tailnet-system`	`tailnet-system`	`apps`	`deployments`	`create`, `delete`, `get`, `list`, `patch`, `update`, `watch`	all names	—
`Role/tailnet-operator`	`tailnet-system`	`tailnet-system`	`apps`	`statefulsets`	`create`, `delete`, `get`, `update`	all names	—
`Role/tailnet-operator`	`tailnet-system`	`tailnet-system`	`coordination.k8s.io`	`leases`	`create`, `get`, `list`, `patch`, `update`, `watch`	all names	—
`Role/tailnet-operator`	`tailnet-system`	`tailnet-system`	`networking.k8s.io`	`networkpolicies`	`create`, `delete`, `get`, `list`, `patch`, `update`, `watch`	all names	—
`Role/tailnet-operator`	`tailnet-system`	`tailnet-system`	`policy`	`poddisruptionbudgets`	`create`, `delete`, `get`	all names	—
`Role/tailnet-operator`	`tailnet-system`	`tailnet-system`	`rbac.authorization.k8s.io`	`rolebindings`, `roles`	`create`, `delete`, `get`	all names	—
`Role/tailnet-operator`	`tailnet-system`	`tailnet-system`	`tsunaro.io`	`tailnetegresses/finalizers`	`update`	all names	—
`Role/tailnet-operator`	`tailnet-system`	`tailnet-system`	`tsunaro.io`	`tailnetegresses/status`	`get`, `patch`, `update`	all names	—
`Role/tailnet-operator`	`tailnet-system`	`tailnet-system`	`tsunaro.io`	`tailnetegresses`	`get`, `list`, `watch`	all names	—

Bindings

Binding	Namespace	Role reference (kind/namespace/name)	Subjects (kind/namespace/name, API group)
`ClusterRoleBinding/tailnet-operator-crds`	—	`ClusterRole//tailnet-operator-crds`	`ServiceAccount/tailnet-system/tailnet-operator (apiGroup=)`
`ClusterRoleBinding/tailnet-operator-workloads`	—	`ClusterRole//tailnet-operator-workloads`	`ServiceAccount/tailnet-system/tailnet-operator (apiGroup=)`
`RoleBinding/tailnet-operator`	`tailnet-system`	`Role/tailnet-system/tailnet-operator`	`ServiceAccount/tailnet-system/tailnet-operator (apiGroup=)`

Source: docs/reference/rbac.md at v0.18.0 — found a mistake? Tell us.

Chart values Compatibility