Volcengine Kubernetes Engine
Volcengine Kubernetes Engine
Volcengine Kubernetes Engine
Document
Volcengine Kubernetes Engine
What's New
History feature release notes
Kubernetes version release notes
Containerd runtime release notes
Add-on release notes
Monitoring add-ons
Scheduling add-ons
DNS add-ons
Security add-ons
GPU add-ons
Sandbox add-on
Security announcements
Product Announcement
Historical announcements
Overview
Getting started
User guide
Clusters
Creating clusters
Connecting to clusters
Upgrading clusters
Node pool
Creating node pools
Scaling out/in node pools
Nodes
Authorization management
Image
Namespaces
Networking
Cluster network
Container Network
Service
LoadBalancer
CLB
Ingress
APIG Ingress
ALB Ingress
Customize ALB Ingress forwarding rules
Certificate and security
CLB Ingress
Nginx Ingress
Gateway API
Workloads
Creating workloads
Configure workloads
Pods
Configuration management
Image acceleration
Storage
FSX client
EBS Volumes
TOS Volumes
NAS volumes
FSX access methods
NFS access methods
EFS volumes
vePFS volumes
FSX access methods
vePFS Client access methods
NFS access methods
CloudFS volumes
Local volumes
Autoscale
Node autoscaler
Workload autoscaler
Horizontal Pod Autoscaler (HPA)
Cron Horizontal Pod Autoscaler (CronHPA)
Intelligent Horizontal Pod Autoscaler (IHPA)
Horizontal Pod Autoscaler based on event-driven (KEDA)
Add-on management
Network add-ons
Storage add-ons
Monitoring add-ons
Scheduling add-ons
DNS add-ons
GPU add-ons
Core add-ons
Sandbox add-on
Upgrading add-ons
Heterogeneous computing
NVIDIA GPU
mGPU scheduling
RDMA high-performance computing
Scheduling management
Topology-aware scheduling
QoS-aware scheduling
Observability
Log management
Basic observation
Setup & Configuration
Cluster observation
Storage observation
Other observation
Using metrics
Full stack observation
Alert management
Diagnosis and inspection
Node check and self-healing
Application center
Backup center
Stability
Large-scale cluster management
Best practices
Authorization
Clusters
Nodes and node pools
Networking
Storage
Scheduling
Observability
Solution
Security and compliance
API reference
Cluster management
NodePool management
Node management
Virtual nodes management
Add-on management
Tag management
Access policy management
Instance images management
Cloud native observability
Inspection and diagnosis
Task management
Volcengine Container Instance
Appendix
SDK reference
Development guide
Terraform
FAQs
General FAQs
Cluster FAQ
cluster management
cluster network
cluster upgrade
Node and Node pool FAQs
Authorization FAQs
Workload FAQs
Service and Ingress FAQs
Storage FAQs
Heterogeneous computing FAQs
Observability FAQs
Quota FAQs
Add-on FAQs
Cloud-native AI
ServingKit
LLM applications
ComfyUI application
Deploying the Al inference application through Helm
Deepseek practices
Qwen practices
Kimi practice
Seed practices
Best practices
DeepSeek model deployment
GLM model deployment
MiniMax model deployment
Qwen model deployment
Kimi model deployment
Volcengine Container Instance
What's new
Historical feature release notes
Product Announcement
Overview
Billing
User guide
Integrating with VCI
Virtual node
VKE cluster uses virtual nodes
Self-managed/third-party cluster uses virtual node
Creating an instance
General purpose instance
GPU-accelerated computing instance
VCI Agent Sandbox
Startup acceleration
E2B-based management
Upgrade guide
Networking
Monitoring
Scheduling
Container configuration
VCI Image Cache
Best practices
Security and compliance
FAQs
- Documentation
Volcengine Kubernetes EngineVolcengine Kubernetes EngineUser guideAuthorization managementAuthorization overview
Copy page
Download PDFAuthorization management
Authorization overview
Copy pageDownload PDFAuthorization overview
Authorization management of VKE includes Identity and Access Management (IAM) authorization, Role-Based Access Control (RBAC) authorization, and IAM Role for Service Account (IRSA) permission isolation.
Terms
Category | IAM permissions | RBAC permissions | IRSA mechanism |
Category | IAM permissions | RBAC permissions | IRSA mechanism |
Introduction | IAM controls whether IAM users can access VKE and related cloud services, which is a form of external access control. | RBAC manages the operation permissions of IAM users or roles on internal resources of the Kubernetes cluster. | IRSA maps IAM role permissions to Kubernetes service accounts, which enables Pods to securely access cloud resources. This is a Pod-level permission isolation mechanism. |
Implementation methods | Implemented through system preset or custom IAM policies. | Implemented through RoleBinding/ClusterRoleBinding. | Implemented by binding Kubernetes service accounts with IAM roles through the OIDC protocol. |
Application scenarios | Used for managing user access permissions on cloud resources. In most cases, IAM needs to be used with RBAC permissions to manage resources in clusters. | Used for managing user operation permissions within Kubernetes clusters. | Applicable to fine-grained permission isolation in multi-tenant scenarios, which enables container applications to securely access cloud resources. |
Action |
IAM permissions
IAM is a permission management system provided by Volcano Engine for users. It is used to manage the access permissions on cloud resources to different IAM identities, including IAM users, user groups, and roles. Identities created through IAM are not granted access permissions on cloud resources by default. IAM provides predefined permissions for each cloud service. You can grant these permissions to identities based on your business requirements. You can also configure custom permission policies for fine-grained permission management.
IAM supports the following two types of permission policies:
- System-preset policies: The policies are created by the Volcano Engine in a centralized manner. You can only use but cannot modify them, and the version updates of these policies are maintained by the Volcano Engine.
- User-defined policies: You can create, update, and delete the policies. The version updates of these policies are maintained by yourself.
System-preset policies
VKE provides the following preset system policies, which can be directly attached to IAM users. For detailed configuration instructions, see Attaching system-preset policies.
Policy | Policy description |
Policy | Policy description |
VKEFullAccess | This policy allows full read and write access to VKE, including Elastic Compute Service (ECS), LoadBalancer, VPC, and NAT Gateway. |
VKEInnerFullAccess | This policy allows internal read and write access to VKE. |
VKEReadOnlyAccess | This policy allows read-only access to VKE. |
VKEInnerReadOnlyAccess | This policy grants read-only permissions in VKE. |
BillingCenterPayOrderAccess | This policy grants payment permissions for the Billing Center and PayOrder permissions for OpenAPI access. |
warning
Starting from August 31, 2025, all IAM users (even those with FullAccess permission) must have BillingCenterPayOrderAccess permission to apply for prepaid resources. Otherwise, order payment cannot be completed. For more information about permission policies, see Permissions.
User-defined policies
VKE allows you to create custom policies and grant permissions. For detailed configuration instructions, see Attach user-defined policies.
The following table describes authorization actions (Action) and resources (Resource) supported in VKE. For more information, see Policy syntax.
tip
Resources are configured in the form of TRN, which is a unique identifier for Volcano Engine cloud resources. The format is trn:{service}:{region}:{account}:{resourceType}/{id}.
Category | Action | Resource | Description |
Category | Action | Resource | Description |
cluster | CreateCluster | No | Create a cluster. |
| ListClusters | No | Obtain the list and details of clusters. |
| UpdateClusterConfig | trn:vke:{region}:{account}:cluster/ | Update cluster configurations. |
| DeleteCluster | trn:vke:{region}:{account}:cluster/ | Delete a cluster. |
| ListSupportedResourceTypes | No | Obtain the resource types supported by a cluster. |
| CreateKubeconfig | trn:vke:{region}:{account}:cluster/ | Generate the Kubeconfig credentials for a cluster. |
| ListKubeconfigs | No | Query the list of Kubeconfig details for clusters that meet the specified criteria. |
| DeleteKubeconfigs | trn:vke:{region}:{account}:cluster/ | Revoke the Kubeconfig credentials of a cluster. |
Node pool management | CreateNodePool | trn:vke:{region}:{account}:cluster/ | Create a node pool. |
| CreateDefaultNodePool | trn:vke:{region}:{account}:cluster/ | Create a default node pool. |
| UpdateNodePoolConfig | trn:vke:{region}:{account}:cluster/ | Update node pool configurations. |
| ListNodePools | No | Query the list and details of node pools. |
| DeleteNodePool | trn:vke:{region}:{account}:cluster/ | Delete a node pool. |
Nodes | CreateNodes | trn:vke:{region}:{account}:cluster/ | Add a node. |
| ListNodes | No | Obtain the list and details of nodes. |
| DeleteNodes | trn:vke:{region}:{account}:cluster/ | Remove a node. |
Tag | TagResources | No | Add a label to a specified resource. |
| UntagResources | No | Remove a label from a resource. |
| ListTagsForResources | No | Query all label information for resources that meet the criteria. |
Add-ons | ListSupportedAddons | trn:vke:{region}:{account}:cluster/ | View the details of add-ons that are supported by VKE. |
| CreateAddon | trn:vke:{region}:{account}:cluster/ | Install add-ons for a specified cluster. |
| UpdateAddonConfig | trn:vke:{region}:{account}:cluster/ | Update the configurations of a specified add-on in a specified cluster. |
| UpdateAddonVersion | trn:vke:{region}:{account}:cluster/ | Update the version of a specified add-on in a specified cluster. |
| DeleteAddon | trn:vke:{region}:{account}:cluster/ | Remove a specified add-on from a specified cluster. |
| ListAddons | No | Query the details of installed add-ons that meet the criteria. |
Access policy | GrantPermission | No | Granting RBAC access permission to an IAM user or role. |
| ListPermissions | No | Making queries to find RBAC access policy resources that meet the conditions. |
| RevokePermission | No | Revoke the RBAC permission granted to an IAM user or role by specifying the resource ID of the permission policy. |
RBAC permissions
RBAC is a permission control system based on roles. VKE provides the cluster RBAC authorization feature to meet the requirement for fine-grained resource access control of enterprises.
- Preset RBAC roles
- VKE provides the following preset RBAC roles, which can be directly assigned to IAM users or roles.
- RoleRole descriptionRoleRole descriptionCluster administratorHas read and write permissions on all resources in clusters and all namespaces, such as cluster nodes, StorageClasses, PVs, namespaces, ResourceQuotas, and LimitRanges.Operation and maintenance administratorHas read and write permissions on visible Kubernetes resources in all namespaces in the console, such as cluster nodes, StorageClasses, PVs, namespaces, ResourceQuotas, and LimitRanges.Privileged developerHas read-only permissions on Kubernetes cluster-level resources such as nodes, StorageClasses, PVs, namespaces, ResourceQuotas, and LimitRanges.DevelopersHas read and write permissions on visible Kubernetes resources in all namespaces or in specified namespaces in the console, and has read-only permissions on cluster nodes, StorageClasses, PersistentVolumes (PVs), namespaces, ResourceQuotas, and LimitRanges.Read-only userHas read-only permissions on visible Kubernetes resources in all namespaces or in specified namespaces in the console, such as cluster nodes, StorageClasses, PVs, namespaces, ResourceQuotas, and LimitRanges, and cannot view configuration items and Secrets.
- Custom RBAC roles
- VKE provides various custom finer-grained RBAC permissions, which allow you to manage and control access permissions on various resources at the cluster level.
IRSA mechanism
The IRSA mechanism is a security isolation mechanism jointly provided by VKE and IAM. It is mainly used to allow Pods in Kubernetes clusters to be associated with IAM roles and use IAM role permissions by using Kubernetes ServiceAccount. This enables the Pods to securely access various cloud product resources. For more information, see IRSA overview.
Last updated: 2026.06.12 11:25:11
All rights reserved © Beijing Volcano Engine Technology Co., Ltd2024
