--- kind: ClusterRole apiVersion: rbac.authorization.k8s.io/v1 metadata: name: descheduler-cluster-role rules: - apiGroups: ["events.k8s.io"] resources: ["events"] verbs: ["create", "update"] - apiGroups: [""] resources: ["nodes"] verbs: ["get", "watch", "list"] - apiGroups: [""] resources: ["namespaces"] verbs: ["get", "watch", "list"] - apiGroups: [""] resources: ["pods"] verbs: ["get", "watch", "list", "delete"] - apiGroups: [""] resources: ["pods/eviction"] verbs: ["create"] - apiGroups: ["scheduling.k8s.io"] resources: ["priorityclasses"] verbs: ["get", "watch", "list"] - apiGroups: ["coordination.k8s.io"] resources: ["leases"] verbs: ["create"] - apiGroups: ["coordination.k8s.io"] resources: ["leases"] resourceNames: ["descheduler"] verbs: ["get", "patch", "delete"] --- apiVersion: v1 kind: ServiceAccount metadata: name: descheduler-sa namespace: kube-system --- apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRoleBinding metadata: name: descheduler-cluster-role-binding roleRef: apiGroup: rbac.authorization.k8s.io kind: ClusterRole name: descheduler-cluster-role subjects: - name: descheduler-sa kind: ServiceAccount namespace: kube-system