Kubernetes RBAC

API-plane collectors need read-only access. The verbs are get, list, and watch. The only write is create on SelfSubjectAccessReview, which the collector uses to probe its own permissions. Secret values are stripped in code; the secrets rule is metadata only.

• Events, RBAC, cluster state, and audit posture: core, apps, batch, networking, rbac, events, apiextensions, and admissionregistration resources.
• Discovery: get on /version, /api, and /apis.
• Preflight: create on selfsubjectaccessreviews.
• Node plane (API-server audit, container logs, kubelet, container runtime, etcd, and CNI): these read files on the node. RBAC does not grant that access. Run the kit on a node that can read those paths.

A missing verb becomes an access-denied gap and the rest of the run continues. Do not grant cluster-admin.