| Group | kubeadm:cluster-admins | - | CRB: kubeadm:cluster-admins |
| Group | system:authenticated | - | CRB: system:basic-userCRB: system:discoveryCRB: system:public-info-viewer |
| Group | system:bootstrappers:kubeadm:default-node-token | - | CRB: kubeadm:get-nodesCRB: kubeadm:kubelet-bootstrapCRB: kubeadm:node-autoapprove-bootstrap |
| Group | system:masters | - | CRB: cluster-admin |
| Group | system:monitoring | - | CRB: system:monitoring |
| Group | system:nodes | - | CRB: kubeadm:node-autoapprove-certificate-rotation |
| Group | system:serviceaccounts | - | CRB: system:service-account-issuer-discovery |
| Group | system:unauthenticated | - | CRB: system:public-info-viewer |
| ServiceAccount | kra-viewer-kra-viewer | kra-viewer | CRB: kra-viewer-kra-viewer |
| ServiceAccount | attachdetach-controller | kube-system | CRB: system:controller:attachdetach-controller |
| ServiceAccount | bootstrap-signer | kube-system | RB: system:controller:bootstrap-signer |
| ServiceAccount | calico-cni-plugin | kube-system | CRB: calico-cni-plugin |
| ServiceAccount | calico-kube-controllers | kube-system | CRB: calico-kube-controllers |
| ServiceAccount | calico-node | kube-system | CRB: calico-node |
| ServiceAccount | certificate-controller | kube-system | CRB: system:controller:certificate-controller |
| ServiceAccount | clusterrole-aggregation-controller | kube-system | CRB: system:controller:clusterrole-aggregation-controller |
| ServiceAccount | coredns | kube-system | CRB: system:coredns |
| ServiceAccount | cronjob-controller | kube-system | CRB: system:controller:cronjob-controller |
| ServiceAccount | daemon-set-controller | kube-system | CRB: system:controller:daemon-set-controller |
| ServiceAccount | deployment-controller | kube-system | CRB: system:controller:deployment-controller |
| ServiceAccount | disruption-controller | kube-system | CRB: system:controller:disruption-controller |
| ServiceAccount | endpoint-controller | kube-system | CRB: system:controller:endpoint-controller |
| ServiceAccount | endpointslice-controller | kube-system | CRB: system:controller:endpointslice-controller |
| ServiceAccount | endpointslicemirroring-controller | kube-system | CRB: system:controller:endpointslicemirroring-controller |
| ServiceAccount | ephemeral-volume-controller | kube-system | CRB: system:controller:ephemeral-volume-controller |
| ServiceAccount | expand-controller | kube-system | CRB: system:controller:expand-controller |
| ServiceAccount | generic-garbage-collector | kube-system | CRB: system:controller:generic-garbage-collector |
| ServiceAccount | horizontal-pod-autoscaler | kube-system | CRB: system:controller:horizontal-pod-autoscaler |
| ServiceAccount | job-controller | kube-system | CRB: system:controller:job-controller |
| ServiceAccount | kube-dns | kube-system | CRB: system:kube-dns |
| ServiceAccount | kube-proxy | kube-system | CRB: kubeadm:node-proxier |
| ServiceAccount | legacy-service-account-token-cleaner | kube-system | CRB: system:controller:legacy-service-account-token-cleaner |
| ServiceAccount | n-able-cm-cert-manager | kube-system | CRB: n-able-cm-cert-manager-controller-approve:cert-manager-ioCRB: n-able-cm-cert-manager-controller-certificatesCRB: n-able-cm-cert-manager-controller-certificatesigningrequestsCRB: n-able-cm-cert-manager-controller-challengesCRB: n-able-cm-cert-manager-controller-clusterissuersCRB: n-able-cm-cert-manager-controller-ingress-shimCRB: n-able-cm-cert-manager-controller-issuersCRB: n-able-cm-cert-manager-controller-orders |
| ServiceAccount | n-able-cm-cert-manager-cainjector | kube-system | CRB: n-able-cm-cert-manager-cainjector |
| ServiceAccount | n-able-cm-cert-manager-webhook | kube-system | CRB: n-able-cm-cert-manager-webhook:subjectaccessreviews |
| ServiceAccount | n-able-edge-ingress-nginx | kube-system | CRB: n-able-edge-ingress-nginx |
| ServiceAccount | n-able-metrics-server | kube-system | CRB: n-able-metrics-server:system:auth-delegatorCRB: system:n-able-metrics-server |
| ServiceAccount | namespace-controller | kube-system | CRB: system:controller:namespace-controller |
| ServiceAccount | node-controller | kube-system | CRB: system:controller:node-controller |
| ServiceAccount | persistent-volume-binder | kube-system | CRB: system:controller:persistent-volume-binder |
| ServiceAccount | pod-garbage-collector | kube-system | CRB: system:controller:pod-garbage-collector |
| ServiceAccount | pv-protection-controller | kube-system | CRB: system:controller:pv-protection-controller |
| ServiceAccount | pvc-protection-controller | kube-system | CRB: system:controller:pvc-protection-controller |
| ServiceAccount | replicaset-controller | kube-system | CRB: system:controller:replicaset-controller |
| ServiceAccount | replication-controller | kube-system | CRB: system:controller:replication-controller |
| ServiceAccount | resource-claim-controller | kube-system | CRB: system:controller:resource-claim-controller |
| ServiceAccount | resourcequota-controller | kube-system | CRB: system:controller:resourcequota-controller |
| ServiceAccount | root-ca-cert-publisher | kube-system | CRB: system:controller:root-ca-cert-publisher |
| ServiceAccount | route-controller | kube-system | CRB: system:controller:route-controller |
| ServiceAccount | selinux-warning-controller | kube-system | CRB: system:controller:selinux-warning-controller |
| ServiceAccount | service-account-controller | kube-system | CRB: system:controller:service-account-controller |
| ServiceAccount | service-cidrs-controller | kube-system | CRB: system:controller:service-cidrs-controller |
| ServiceAccount | service-controller | kube-system | CRB: system:controller:service-controller |
| ServiceAccount | statefulset-controller | kube-system | CRB: system:controller:statefulset-controller |
| ServiceAccount | ttl-after-finished-controller | kube-system | CRB: system:controller:ttl-after-finished-controller |
| ServiceAccount | ttl-controller | kube-system | CRB: system:controller:ttl-controller |
| ServiceAccount | validatingadmissionpolicy-status-controller | kube-system | CRB: system:controller:validatingadmissionpolicy-status-controller |
| ServiceAccount | volumeattributesclass-protection-controller | kube-system | CRB: system:controller:volumeattributesclass-protection-controller |
| ServiceAccount | longhorn-service-account | longhorn-system | CRB: longhorn-bind |
| ServiceAccount | longhorn-support-bundle | longhorn-system | CRB: longhorn-support-bundle |
| User | system:anonymous | - | RB: kubeadm:bootstrap-signer-clusterinfo |
| User | system:kube-controller-manager | - | CRB: calico-tier-getterCRB: system:kube-controller-manager |
| User | system:kube-proxy | - | CRB: system:node-proxier |
| User | system:kube-scheduler | - | CRB: system:kube-schedulerCRB: system:volume-scheduler |