Docs

Volcengine Kubernetes Engine

RBAC permissions

Granting RBAC permissions

VKE allows you to grant role-based access control (RBAC) permissions to Identity and Access Management (IAM) users and IAM roles. This topic mainly describes the procedure for granting RBAC permissions.

tip

For an introduction to IAM identities (IAM users and IAM roles), see User management and Role management.

Limit

Only the following accounts or IAM identities (IAM users or IAM roles) can grant cluster RBAC permissions:

Volcano Engine root user (owner): has full permissions on clusters and can directly configure RBAC.

Cluster creator: Regardless of whether a cluster creator is the root user or an IAM identity, the creator is granted RBAC administrator permissions on the cluster by default.

Regular IAM users or IAM roles can grant RBAC permissions only when they meet both of the following conditions.

The root user or the cluster creator has granted the management permissions for the target cluster in the console or by calling the GrantPermission API. Alternatively, they already have the RBAC permissions at the account cluster level.

A global permission policy, such as IAMFullAccess or IAMReadOnlyAccess, is attached to them.

Prerequisites

Permissions related to VKE have been granted to IAM users. For detailed operations, see Configuring IAM user permissions.

IAM roles have been created. For detailed operations, see Managing roles.

Granting RBAC permissions to IAM users

In the left navigation bar, click Authorizations > User authorization.

On the User authorization management page, click Batch user authorization.

On the Create user authorization page, select the target IAM users and grant RBAC permissions to them based on the system prompts.

Parameter	Description
User	In the All users section, select the check boxes before the names of the IAM users to which you want to grant the same RBAC permissions.
Permissions	Grant access permissions to the selected IAM users based on the content in the Access permission description section in the console. You can grant access permissions to the users from the following three dimensions: Account cluster level: Select Account All Resources > Account Cluster Level. It indicates that the selected IAM user has corresponding permissions on all existing clusters and newly created clusters within the current root user. warning Only the root user or the IAM user that has account cluster-level permissions can view the Account Cluster Level parameter under the Account All Resources parameter. Cluster level: Select a cluster and all namespaces. It indicates that the selected IAM user has corresponding permissions on all existing and newly added namespaces within the selected cluster. Namespace level: Select a cluster and a namespace. It indicates that the selected IAM user has corresponding permissions on the selected namespace within the selected cluster. For more information about access permissions, see Description of RBAC permissions and roles.

(Optional) Click Add permissions to grant multiple RBAC permissions to the selected IAM users.

Click Confirm. The RBAC permissions are granted to IAM users.

Granting RBAC permissions to the IAM roles

In the left navigation bar of the VKE console, click Authorizations > Role authorization.

On the Role authorization management page, enter the name of the IAM role to be granted RBAC permissions in the Role name field, and then click Administrative role permissions.

You can obtain the role name on the User management > Role Management page of the IAM console.

On the role authorization details page, click Add role authorization. Grant RBAC permissions to the IAM role based on the system prompts.

Parameter	Description
Role	The name of the IAM role being configured. You cannot modify the name.
Permissions	Grant cluster-level and namespace-level access permissions to the IAM role based on the content in the Access permission description section in the console. You can grant access permissions to the role from the following three dimensions: Account cluster level: Select Account All Resources > Account Cluster Level. It indicates that the selected IAM role has corresponding permissions on all existing clusters and newly created clusters within the current root user. Warning Only the root user or the IAM role that has account cluster-level permissions can view the Account Cluster Level parameter under the Account All Resources parameter. Cluster level: Select a cluster and all namespaces. It indicates that the selected IAM role has corresponding permissions on all existing and newly added namespaces within the selected cluster. Namespace level: Select a cluster and a namespace. It indicates that the selected IAM role has corresponding permissions on the selected namespace within the selected cluster. For more information about access permissions, see Description of RBAC permissions and roles.

(Optional) Click Add permissions to grant multiple RBAC permissions to the selected IAM role.

Click Confirm. The RBAC permissions are granted to the IAM role.