rbac | A Chef provider for Solaris Role-Based Access Control | Authorization library

If you want to restrict users to only list resources, you should create a role with get verb.
Role example in official documentations shows it quite well

Following up from the Solr Operator slack channel.

This is a problem with the private Solr helm repo being used. If the open source charts are used as dependencies, then the deployment works as expected.

For the ELK stack to work you need all three PersistentVolumeClaim's to be bound as I recall. Instead of creating 1 30 GB of PV create 3 of the same size with the claims and then re-install. Other nodes have unmet dependincies.

Also please do not handle the volumes by hand. There are guidelines to deploy dynamic volums. Use OpenEBS for example. That way you wont need to worry about the pvc's. After giving the pv's if anything happens write again with your cluster installation process.

I was wrong obviously, in this particular problem, filesystems and cgroups take role and the main problem of this is an old problem. From 5.2.1 to 8.0.0. Reinstall the chart by pulling the chart. Edit values file and definitely change the container version. It should be fine or create another error log stack.

I don't know about the Exchange Graph API, but EWS simply does not provide this information. Your best bet is the GetSearchableMailboxes service that you tried in exchangelib. EWS requires users to have the Discovery Management RBAC role for this to succeed.

Since you already have PowerShell commands that work for you, I would probably just call these commands from your Python script using a subprocess. Here's a blog post with some examples: https://www.phillipsj.net/posts/executing-powershell-from-python/

Restricting the create permission to a specific resource name is not supported.

This is from the Kubernetes documentation:

Note: You cannot restrict create or deletecollection requests by resourceName. For create, this limitation is because the object name is not known at authorization time.

This means the ClusterRole you created doesn't allow you to create any Pod. You need to have another ClusterRole assigned where you don't specify the resource name.

Where possible do use managed identities as they allow you to access azure resource withouth having to expose secrets. An early blog post by microsoft states:

Your code needs credentials to authenticate to cloud services, but you want to limit the visibility of those credentials as much as possible. Ideally, they never appear on a developer’s workstation or get checked-in to source control. Azure Key Vault can store credentials securely so they aren’t in your code, but to retrieve them you need to authenticate to Azure Key Vault. To authenticate to Key Vault, you need a credential! A classic bootstrap problem. Through the magic of Azure and Azure AD, MSI provides a “bootstrap identity” that makes it much simpler to get things started.

Here is an overview of the supported services. As you can see most services do support managed identities.

Here is a step-by-step tutorial that shows you how to connect to azure storage using managed identities.

As we can find in the Kubernetes Certificate Signing Requests documentation:

A few steps are required in order to get a normal user to be able to authenticate and invoke an API.

I will create an example to illustrate how you can get a normal user who is able to authenticate and invoke an API (I will use the user john as an example).

First, create PKI private key and CSR:

When you view activity log in Azure portal, it calls 3 API endpoints.

The first one is Activity Logs - List:

Make sure that the /var/run/secrets/kubernetes.io/serviceaccount/token file contains the correct token. To do so, you can enter into Prometheus pod with:

kubectl exec -it -n -- bash

and cat the token file. Then exit the pod and execute:

echo $(kubectl get secret -n -o jsonpath='{.data.token}') | base64 --decode

If the tokens match, you can try querying the Kubernetes API server with Postman or Insomnia to see if the rules you put in your ClusterRole are correct. I suggest you to query both /proxy/metrics/cadvisor and /proxy/metrics URLs