<p>Recently I was searching for ways to reduce cloud bill and came up to a company named <code>CAST.AI</code>.</p>
<p>So to run a savings report you need to install their agent to your cluster and they claim it is <code>read-only</code>.</p>
<p>How do I check if this is true?</p>
<p>This comes from the <a href="https://pastebin.com/pLbYAEGP" rel="nofollow noreferrer">yaml file they provide</a> (too long to paste whole manifest here)</p>

<h2 id="short-answer">Short answer</h2>
<p>Based on <code>cast.io</code> manifest <strong>it's indeed <code>read-only</code> and safe to say it won't mess up anything in the cluster</strong></p>
<h2 id="detailed-answer">Detailed answer</h2>
<p>In short words manifest will create: namespace, serviceaccount, clusterole with read-only permissions, clusterrolebinding (where mapping between service account and cluster role happens), secret and deployment with pod which will collect cluster's data.</p>
<p><code>ClusterRole</code> means that service account linked to this <code>ClusterRole</code> will have access with given verbs within <strong>all namespaces</strong> (which is fine for resource audit).</p>
<p>Below is <code>ClusterRole</code> from manifest (added several comments at the beginning, structure is the same):</p>
<pre><code>apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: castai-agent
  labels:
    &quot;app.kubernetes.io/name&quot;: castai-agent
rules:
  # ---
  # Required for cost savings estimation features.
  # ---
  - apiGroups: # api group to look in
    - &quot;&quot;
    resources: # resources where this ClusterRole will have access to
      - pods
      - nodes
      - replicationcontrollers
      - persistentvolumeclaims
      - persistentvolumes
      - services
    verbs: # what this cluster role is allowed to do
      - get
      - list
      - watch
  - apiGroups:
      - &quot;&quot;
    resources:
      - namespaces
    verbs:
      - get
  - apiGroups:
    - &quot;apps&quot;
    resources:
      - deployments
      - replicasets
      - daemonsets
      - statefulsets
    verbs: # what this cluster role is allowed to do with resources above
      - get
      - list
      - watch
  - apiGroups:
    - &quot;storage.k8s.io&quot;
    resources:
      - storageclasses
      - csinodes
    verbs: # what this cluster role is allowed to do
      - get
      - list
      - watch
  - apiGroups:
    - &quot;batch&quot;
    resources:
      - jobs
    verbs: # what this cluster role is allowed to do
      - get
      - list
      - watch
</code></pre>
<p>All actions that <code>ClusterRole</code> is allowed to perform are: <code>get</code>, <code>list</code> and <code>watch</code> which are harmless.</p>
<p>Here is a list of all available verbs:</p>
<ul>
<li>get</li>
<li>list</li>
<li>create</li>
<li>update</li>
<li>patch</li>
<li>watch</li>
<li>delete</li>
<li>deletecollection</li>
</ul>
<p><a href="https://kubernetes.io/docs/reference/access-authn-authz/authorization/#review-your-request-attributes" rel="nofollow noreferrer">list of all available attributes, including verbs</a></p>
<h2 id="resources-and-limits">Resources and limits</h2>
<p>Worst case scenario <code>cast.io</code> pod will consume resources by its limit (this part in deployment), however with today's clusters it shouldn't be an issue:</p>
<pre><code>      resources:
        requests:
          cpu: 100m
          memory: 64Mi
        limits:
          cpu: 1000m
          memory: 256Mi
</code></pre>
<p><strong>Requests</strong> means that this amount of resources are required for <code>kubelet</code> to run this pod on the node.</p>
<p><strong>Limits</strong> as it's named limits maximum possible resources allocation for pod. If it tries to consume more, it will be evicted and rescheduled again to be created.</p>
<p><strong>Useful links:</strong></p>
<ul>
<li><a href="https://kubernetes.io/docs/reference/access-authn-authz/rbac/" rel="nofollow noreferrer">Kubernetes RBAC - Role Base Access Control</a></li>
<li><a href="https://kubernetes.io/docs/reference/access-authn-authz/authorization/" rel="nofollow noreferrer">Kubernetes autorization overview</a></li>
<li><a href="https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/#requests-and-limits" rel="nofollow noreferrer">Resources and limits</a></li>
</ul>
