Skip to content

RBAC & deploy

ray-mcp ships a read-only RBAC floor — a ServiceAccount, ClusterRole, and ClusterRoleBinding — under deploy/rbac/. This is the real security boundary: the tool tiers gate what the server offers, but the ServiceAccount's RBAC gates what it can actually do against the cluster.

→ deploy/rbac/README.md on GitHub

It documents:

  • Why RBAC is the security boundary, not a convenience — the floor is proven by a test (deploy/rbac/rbac_test.go), not merely asserted.
  • Exactly what is granted, and why — the specific verbs on the Ray CRDs, plus the two judgment calls and what is deliberately not granted.
  • ClusterRole vs. Role — cluster-wide vs. single-namespace scoping, which ties into --allow-all-namespaces reconciliation (see Configuration).
  • Attaching the ServiceAccount to a caller.

Apply it

kubectl apply -k deploy/rbac/

Enabling writes

The shipped floor is read-only. Enabling the write or destructive tiers (--allow-mutations / --allow-destructive, see Safety tiers) requires granting the corresponding create / update / patch / delete verbs — extend the ClusterRole accordingly.

An in-cluster Deployment and Helm chart are on the roadmap (not yet shipped).