Granting RBAC access permission to an IAM user or role.

API description

By default, users who did not create the VKE cluster have no RBAC (Role-Based Access Control) permission within it. You can call the GrantPermission API to grant RBAC access permissions to IAM users or roles, including accessible resources, scope of permission, and built-in role type, to better manage the security and access control of the cluster.

Request description

VKE has deployed services in multiple regions globally to provide a stable and low-latency access experience. You can refer to the Service addresses topic and select the most suitable access point for your business region.

Request method: POST

Request URL: https://vke.cn-beijing.volcengineapi.com?Action=GrantPermission&Version=2022-05-12

Debugging

API Explorer

You can initiate calls online through API Explorer without paying attention to the signature generation process and quickly obtain the call results.

Go to debug

Request parameters

The following table describes the API request parameters. You also need to provide public parameters when calling this API. See Public parameters for details.

Parameters	Type	Required	Sample value	Description
Action	String	Yes	GrantPermission	The API name. The API name is GrantPermission .
Version	String	Yes	2022-05-12	The API version. The current version of the API is 2022-05-12.
RoleDomain	String	no	cluster	The permission type granted to an IAM user or role: Namespace : Grants permission at the namespace level. Cluster : Grants permission at the cluster level. all_clusters : Grants all the permissions available at the cluster level under the current account.
ClusterId	String	no	ccog93v*******	The cluster ID that an IAM user or role can access. Cluster IDs can be obtained by calling the ListClusters API. Warning This parameter is required if the roleDomain is set to namespace or cluster .
Namespace	String	no	default	The namespace that an IAM user or role can access. You can log in to the VKE console to view namespace names. Warning This parameter is required if the RoleDomain is set to namespace . This parameter does not take effect if roleDomain is not set to namespace.
RoleName	String	no	vke:admin	The name of RBAC role that can be granted. The available RBAC permissions include: Customization of role name: You can customize a role name without any restrictions on the format and string composition on VKE side, as long as it meets Kubernetes specifications. System built-in role name: For the built-in RBAC role names, see Description of RBAC permission role . Warning This parameter is required. A custom role name is not allowed if roleDomain is set to all_clusters.
IsCustomRole	Boolean	no	false	Whether it is a custom RBAC role: True: Custom role. False: (Default) A built-in role of the system.
GranteeId	Long	no	153******	The ID of the authorized target. It can be an IAM user ID or an IAM role ID. IDs can be fetched by calling ListUsers or ListRoles API. Warning This parameter is required.
GranteeType	String	no	User	The types of targets to be authorized: User: IAM user. Role: IAM role.

Sample requests

Response parameters

The following table contains the response parameters of this API. See Response results for details about public response parameters.

Parameters	Type	Sample value	Description
Id	String	ap********	The ID of the RBAC policy. It will be wise to keep a copy of the ID for later use, e.g., making queries or changes to RBAC access policies.

Sample responses

Error code

There are no error codes proprietary to this API. See Public error codes for details.

Volcengine Kubernetes Engine