document ns-authz

README.md

@@ -39,15 +39,15 @@ You can also completely remove `ethereum_package` from your configuration in whi
 
 Kurtosis packages are parameterizable, meaning you can customize your network and its behavior to suit your needs by storing parameters in a file that you can pass in at runtime like so:
 
-```bash
+```shell
 kurtosis run github.com/ethpandaops/optimism-package --args-file https://raw.githubusercontent.com/ethpandaops/optimism-package/main/network_params.yaml
 ```
 
 For `--args-file` parameters file, you can pass a local file path or a URL to a file.
 
 To clean up running enclaves and data, you can run:
 
-```bash
+```shell
 kurtosis clean -a
 ```
 
@@ -57,7 +57,7 @@ This will stop and remove all running enclaves and **delete all data**.
 
 If you are attempting to test any changes to the package code, you can point to the directory as the `run` argument
 
-```bash
+```shell
 cd ~/go/src/github.com/ethpandaops/optimism-package
 kurtosis run . --args-file ./network_params.yaml
 ```
@@ -643,7 +643,7 @@ optimism_package:
 
 Compile [tx-fuzz](https://github.com/MariusVanDerWijden/tx-fuzz) locally per instructions in the repo. Run tx-fuzz against the l2 EL client's RPC URL and using the pre-funded wallet:
 
-```bash
+```shell
 ./livefuzzer spam  --sk "0xac0974bec39a17e36ba4a6b4d238ff944bacb478cbed5efcae784d7bf4f2ff80" --rpc http://127.0.0.1:<port> --slot-time 2
 ```
 
@@ -657,35 +657,35 @@ Please find examples of additional configurations in the [test folder](.github/t
 
 - List information about running containers and open ports
 
-```bash
+```shell
 kurtosis enclave ls
 kurtosis enclave inspect <enclave-name>
 ```
 
 - Inspect chain state.
 
-```bash
+```shell
 kurtosis files inspect <enclave-name> op-deployer-configs
 ```
 
 - Dump all files generated by kurtosis to disk (for inspecting chain state/deploy configs/contract addresses etc.). A file that contains an exhaustive
   set of information about the current deployment is `files/op-deployer-configs/state.json`. Deployed contract address, roles etc can all be found here.
 
-```bash
+```shell
 # dumps all files to a enclave-name prefixed directory under the current directory
 kurtosis enclave dump <enclave-name>
 kurtosis files download <enclave-name> op-deployer-configs <where-to-download>
 ```
 
 - Get logs for running services
 
-```bash
+```shell
 kurtosis service logs <enclave-name> <service-name> -f . # -f tails the log
 ```
 
 - Stop/Start running service (restart sequencer/batcher/op-geth etc.)
 
-```bash
+```shell
 kurtosis service stop <enclave-name> <service-name>
 kurtosis service start <enclave-name> <service-name>
 ```
@@ -714,7 +714,7 @@ optimism_package:
 
 To access the Grafana UI, you can use the following command after starting the enclave:
 
-```bash
+```shell
 just open-grafana <enclave name>
 ```
 
@@ -728,6 +728,12 @@ optimism_package:
     enable_k8s_features: true
 ```
 
+Note that since `kurtosis` runs pods using the namespace's default `ServiceAccount`, which is not typically able to modify cluster-level resources, such as `ClusterRoles`, as the `promtail` Helm chart requires, you must also install the `ns-authz` Helm chart to the Kubernetes cluster serving as the `kurtosis` backend using the following command:
+
+```shell
+just install-ns-authz
+```
+
 ## Development
 
 ### Development environment
@@ -752,7 +758,7 @@ mise install
 
 If you have made changes and would like to submit a PR, test locally and make sure to run `lint` on your changes
 
-```bash
+```shell
 kurtosis lint --format .
 ```
 
@@ -762,7 +768,7 @@ kurtosis lint --format .
 
 We are using [`kurtosis-test`](https://github.com/ethereum-optimism/kurtosis-test) to run a set of unit tests against the starlark code:
 
-```bash
+```shell
 # To run all unit tests
 kurtosis-test .
 ```