Decision Explorer

Walk the compiled graph to answer operational questions. This page is server-rendered: the kubectl apply flow and the RBAC summary are in the HTML with JS disabled. The interactive explorer below (progressive enhancement) lets you traverse the graph live.

Seed questions

• Expose a Deployment with an Ingress
• What permissions does this manifest require?
• kubectl apply internal flow
• RBAC relationships

Internal flow: kubectl apply

1. kube-apiserver — Runs authentication, authorization (RBAC) and admission control
2. kube-controller-manager/scheduler — Reconcile controllers act on the new object
3. kubectl — Reads manifest (YAML/JSON) from file/stdin
4. kubelet — Node kubelet schedules and starts containers via container runtime

RBAC: what each resource requires

• pods group=core
• services group=core
• deployments group=apps
• replicasets group=apps
• statefulsets group=apps
• daemonsets group=apps
• configmaps group=core
• secrets group=core
• namespaces group=core
• nodes group=core
• roles group=rbac.authorization.k8s.io
• rolebindings group=rbac.authorization.k8s.io
• clusterroles group=rbac.authorization.k8s.io
• clusterrolebindings group=rbac.authorization.k8s.io
• ingresses group=networking.k8s.io
• customresourcedefinitions group=apiextensions.k8s.io

Interactive explorer

Pick a node to traverse its relationships live (requires JS).

Interactive explorer requires JavaScript (the kubectl apply flow and RBAC summary above are fully readable without it).