Horizon 8 on OpenShift - Service Account Permissions

Horizon OpenShift service account permissions

Minimum required permissions for the OpenShift cluster capacity provider

This topic describes the minimum required permissions a service account must have in an OpenShift cluster to allow Horizon Connection Server to perform the operations it needs on cluster resources when OpenShift is deployed as a capacity provider.

The permissions are grouped by capability and indicate whether they are namespace-scoped or cluster-scoped.

1. Virtual machine lifecycle and power operations

Scope: Namespace (project) where the VMs live.

These permissions allow a user to control VM state and existence.

API group: kubevirt.io

Resources:

• virtualmachines
• virtualmachineinstances

Permissions required:

• get - view VM details
• list - list VMs
• create - create or import VMs
• delete - delete VMs
• watch - required by the UI and controllers

VM power operations (subresources)

API group: subresources.kubevirt.io

Resources:

• virtualmachines/start
• virtualmachines/stop
• virtualmachines/restart
• virtualmachines/reset

Permissions required:

• update - required to perform power actions

2. Virtual machine clone operations

Scope: Namespace.

These permissions allow creating a new VM from an existing VM.

API group: clone.kubevirt.io

Resources:

• virtualmachineclones

Permissions required:

• get
• list
• create
• delete

Note: VM cloning also relies on DataVolumes (see section 4).

3. Snapshot and restore operations

Scope: Namespace.

These permissions allow users to create, view, and delete snapshots, and to restore VMs from snapshots.

API group: snapshot.kubevirt.io

Resources:

• virtualmachinesnapshots
• virtualmachinerestores

Permissions required:

• get
• list
• create
• delete

4. DataVolume access (required for clone and snapshot)

Scope: Namespace.

DataVolumes are used internally by OpenShift Virtualization for disk cloning and snapshot operations.

API group: cdi.kubevirt.io

Resources:

• datavolumes

Permissions required:

• get
• list
• create
• delete

5. Listing virtual machines and snapshots

Scope: Namespace.

If all permissions above are granted, no additional permissions are required. Listing VMs, clones, and snapshots is covered by the get and list permissions on their respective objects.

6. List namespaces (projects)

Scope: Cluster-wide (read-only).

This is required so users can see which projects exist and switch between them in the CLI or UI.

API group: core

Resource:

• namespaces

Permissions required:

• get
• list

7. List NetworkAttachmentDefinitions

Scope: Cluster-wide (read-only).

Required for attaching additional networks to virtual machines.

API group: k8s.cni.cncf.io

Resource:

• network-attachment-definitions

Permissions required:

• get
• list

8. List StorageClasses

Scope: Cluster-wide (read-only).

Required so users can see available storage options when creating or cloning VMs.

API group: storage.k8s.io

Resource:

• storageclasses

Permissions required:

• get
• list

9. List VM instance types and preferences

Scope: Cluster-wide (read-only).

These are predefined CPU and memory sizing templates and preferences for virtual machines.

API group: instancetype.kubevirt.io

Resources:

• virtualmachineclusterinstancetypes
• virtualmachineclusterpreferences

Permissions required:

• get
• list

Summary by scope

Namespace-scoped (per project)

• VirtualMachines and VirtualMachineInstances
• VM power subresources (start/stop/restart/reset)
• VirtualMachineClones
• VirtualMachineSnapshots and Restores
• DataVolumes

Cluster-scoped (read-only)

• Namespaces
• StorageClasses
• NetworkAttachmentDefinitions
• VM cluster instance types and preferences