Required permissions to use Kong Ingress Controller

To install Kong Ingress Controller, you need to have the permissions to WRITE (create, update, get, list, watch in Kubernetes’s RBAC model) these resources.

For creating RBAC rules to enable Kong Ingress Controller to access required resources, you need to have the permissions to create or update ClusterRole, ClusterRoleBinding in the cluster scope, and create or update Role,RoleBinding in the namespace in which you want to install Kong Ingress Controller.
To install CRDs required to configure Kong specific entities (for example, KongPlugin to configure plugins), you need to have the permissions to create and update CustomResourceDefinition.
For creating resources required for Kong Ingress Controller, you need to have the permissions to create or update Deployment, Service, ServiceAccount, Secret, or ConfigMap to create deployments, services, and to specify their configurations.
If you run Kong Ingress Controller with database-backed Kong Gateway, you also need to have the permissions to create or update PersistentVolumeClaim to set volumes used for the database, and Job to run migration jobs.
If you want to enable auto scaling, you also need permissions to create or update HorizontalPodAutoscaler.
You also need the permissions to create or update IngressClass to install a ingress class managed by Kong Ingress Controller, and ValidatingWebhookConfiguration to create a webhook to validate managed resources.

You need write access to the following resources to install Kong Ingress Controller:

Resource Kind	Resource APIVersion	Resource Scope	Usage
`CustomResourceDefinition`	`apiextensions.k8s.io/v1`	cluster	install CRDs
`ClusterRole`	`rbac.authorization.k8s.io/v1`	cluster	install RBAC rules
`ClusterRoleBinding`	`rbac.authorization.k8s.io/v1`	cluster	install RBAC rules
`Role`	`rbac.authorization.k8s.io/v1`	namespaced	install RBAC rules
`RoleBinding`	`rbac.authorization.k8s.io/v1`	namespaced	install RBAC rules
`Deployment`	`apps/v1`	namespaced	install components
`Service`	`v1`	namespaced	install components
`ServiceAccount`	`v1`	namespaced	install components
`Secret`	`v1`	namespaced	set configurations and credentials
`ConfigMap`	`v1`	namespaced	set configurations
`PersistentVolumeClaim`	`v1`	namespaced	claim volume for DB
`Job`	`v1`	namespaced	create DB migration jobs
`HorizontalPodAutoscaler`	`autoscaling/v2`	namespaced	configure auto scaling
`IngressClass`	`networking.k8s.io/v1`	cluster	install ingress class
`ValidatingWebhookConfiguration`	`admissionregistration.k8s.io/v1`	cluster	configure validating webhooks