# Kubernetes Resources & Permissions

D3E (Diagrid Dapr Distribution for Enterprise) **significantly reduces cluster-level permissions** compared to open source Dapr through its namespace isolation capabilities. This page outlines the Kubernetes resources and permissions D3E requires and how they differ from standard Dapr.

## Key features

- **Reduced cluster permissions**: Namespace-scoped operations minimize security risk
- **Namespaced CRDs**: Custom resources limited to application namespaces or completely free of CRDs
- **Multi-tenancy ready**: Enhanced isolation for enterprise environments
- **Optional ClusterRoles**: Flexible deployment options including a method only using Kubernetes Roles

---

## Custom Resource Definitions (CRDs)

D3E includes five **namespaced** Custom Resource Definitions, making them accessible only to Dapr applications within the same namespace. These CRDs are identical to open source Dapr:

| CRD                      | Purpose                   | Documentation                                                                                |
| ------------------------ | ------------------------- | -------------------------------------------------------------------------------------------- |
| `components.dapr.io`     | Component specifications  | [Component Schema](https://docs.dapr.io/reference/resource-specs/component-schema/)          |
| `configurations.dapr.io` | Dapr configuration        | [Configuration Schema](https://docs.dapr.io/reference/resource-specs/configuration-schema/)  |
| `httpendpoints.dapr.io`  | HTTP endpoint definitions | [HTTP Endpoints Schema](https://docs.dapr.io/reference/resource-specs/httpendpoints-schema/) |
| `resiliencies.dapr.io`   | Resiliency policies       | [Resiliency Schema](https://docs.dapr.io/reference/resource-specs/resiliency-schema/)        |
| `subscriptions.dapr.io`  | Pub/sub subscriptions     | [Subscription Schema](https://docs.dapr.io/reference/resource-specs/subscription-schema/)    |

:::warning Unsupported Subscription API Version
D3E does not support subscription resources with API version `v1alpha1`. Ensure your Subscription objects conform to the [`v2alpha1` specification](https://docs.dapr.io/reference/resource-specs/subscription-schema/#v2alpha1-format).
:::

### Component scoping

As a best practice, always scope Dapr resources to only the specific applications that require access. This follows the principle of least privilege and enhances security in multi-tenant environments.

<details>
  <summary>Example: Scoped Redis State Store</summary>

  The following example restricts access to a Redis state store to only `app1` and `app2` in the production namespace:

  ```yaml
  apiVersion: dapr.io/v1alpha1
  kind: Component
  metadata:
    name: statestore
    namespace: production
  spec:
    type: state.redis
    version: v1
    metadata:
      - name: redisHost
        value: redis-master:6379
    scopes:
      - app1
      - app2
  ```

  [Learn more about component scopes](https://docs.dapr.io/operations/components/component-scopes/)
</details>

---

## ClusterRoles

While D3E significantly reduces cluster-level permissions, certain ClusterRoles are required for standard operation. The specific ClusterRoles needed depend on your installation configuration option you choose.

:::tip ClusterRole-Free Option
To remove all required ClusterRoles, see [Option 4: D3E without ClusterRoles using the Diagrid Dapr Injector Helm chart](https://docs.diagrid.io/dapr-open-source/d3e/installation-guide#option-4-crd-free).
:::

### Required ClusterRoles

<details>
  <summary><strong>1. Injector Mutating Patcher</strong> — <code>{'{.Release.Namespace}'}-dapr-injector-mutating-patcher</code></summary>

  #### Purpose

  - Handles trust anchor certificate updates
  - Manages sidecar injection configuration
  - When deployed with namespace isolation, this role is patched with the namespace where sidecars can be injected

  #### YAML Specification

  ```yaml
  apiVersion: rbac.authorization.k8s.io/v1
  kind: ClusterRole
  metadata:
    annotations:
      meta.helm.sh/release-name: dapr
      meta.helm.sh/release-namespace: dapr-system
    creationTimestamp: "2024-09-11T14:26:42Z"
    labels:
      app.kubernetes.io/component: rbac
      app.kubernetes.io/managed-by: Helm
      app.kubernetes.io/name: dapr
      app.kubernetes.io/part-of: dapr
      app.kubernetes.io/version: v1.14.4-diagrid-2
    name: {'{.Release.Namespace}'}-dapr-injector-mutating-patcher
    resourceVersion: "3428506"
    uid: f93c334a-9c9a-461b-a4b8-7fd1f04c90a5
  rules:
  - apiGroups:
    - admissionregistration.k8s.io
    resourceNames:
    - {'{.Release.Namespace}'}-dapr-sidecar-injector
    resources:
    - mutatingwebhookconfigurations
    verbs:
    - patch
  ```
</details>

<details>
  <summary><strong>2. Sentry Token Reviewer</strong> — <code>{'{.Release.Namespace}'}-dapr-sentry-token-reviewer</code></summary>

  #### Purpose

  - Grants permission to authenticate Kubernetes service account tokens via the TokenReview API
  - Required for Dapr's mTLS security model

  #### Configuration

  Enabled when `.Values.global.rbac.createTokenReviewerRole` is set to `true`. Otherwise, the standard Kubernetes ClusterRole `system:auth-delegator` is used with its associated ClusterRoleBinding.

  #### Requirements

  - Requires a dedicated `ClusterRoleBinding` to bind this role to the Dapr Sentry service account

  #### YAML Specification

  ```yaml
  apiVersion: rbac.authorization.k8s.io/v1
  kind: ClusterRole
  metadata:
    annotations:
      meta.helm.sh/release-name: dapr
      meta.helm.sh/release-namespace: dapr-system
    creationTimestamp: "2025-06-26T18:14:22Z"
    labels:
      app.kubernetes.io/component: rbac
      app.kubernetes.io/managed-by: Helm
      app.kubernetes.io/name: dapr
      app.kubernetes.io/part-of: dapr
      app.kubernetes.io/version: 1.15.5
    name: dapr-sentry-token-reviewer
    resourceVersion: "8728304"
    uid: 59fce98e-339a-48f4-b429-677dad4bc8f6
  rules:
    - apiGroups:
        - authentication.k8s.io
      resources:
        - tokenreviews
      verbs:
        - create
  ```
</details>

<details>
  <summary><strong>3. Scheduler ClusterRole</strong> — <code>{'{.Release.Namespace}'}-dapr-scheduler</code> (Dapr 1.15+)</summary>

  #### Purpose

  - Runs a cleanup job that watches Dapr application namespaces
  - Ensures scheduler service data is cleaned up when namespaces are deleted
  - Maintains scheduler state consistency

  #### Configuration

  Only created when the control plane scheduler service is deployed (`.global.scheduler.enabled` is set to `true`).

  #### YAML Specification

  ```yaml
  kind: ClusterRole
  apiVersion: rbac.authorization.k8s.io/v1
  metadata:
    name: dapr-scheduler
    labels:
      app.kubernetes.io/component: rbac
      app.kubernetes.io/managed-by: Helm
      app.kubernetes.io/name: dapr
      app.kubernetes.io/part-of: dapr
      app.kubernetes.io/version: v1.15.5
  rules:
    - apiGroups: [""]
      resources: ["namespaces"]
      verbs: ["get", "list", "watch"]
  ```
</details>

---

## Next steps

- [Install D3E](https://docs.diagrid.io/dapr-open-source/d3e/installation-guide) — Install D3E with your preferred deployment option
- [Dapr on Kubernetes](https://docs.dapr.io/operations/hosting/kubernetes/kubernetes-overview/) — Learn more about Dapr on Kubernetes