VKE supports controlling cluster resource access by customizing Role and ClusterRole objects in Kubernetes authorization policies. For more information about Role and ClusterRole, see Role and ClusterRole.

Procedure

Create a ClusterRole to define a cluster-level role.

apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
name: demo-role # ClusterRole object name.
rules:
- apiGroups:
- ""
resources:
- nodes # get/list permission for node resources.
- persistentvolumes # get/list permission for PersistentVolume resources.
- limitranges # get/list permission for LimitRange resources.
- resourcequotas # get/list permission for ResourceQuota resources.
verbs:
- get
- list
- apiGroups:
- storage.k8s.io
resources:
- storageclasses # get/list permission for StorageClass resources.
verbs:
- get
- list

Create a ClusterRoleBinding to grant the permissions defined in the ClusterRole to one or more IAM users.

apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
labels:
rbac.vke.volcengine.com/user: "100****" # Account ID of the authorized IAM user.
name: demo-rolebending # ClusterRoleBinding object name.
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: ClusterRole
name: demo-role # ClusterRole object name.
subjects:
- apiGroup: rbac.authorization.k8s.io
kind: User
name: "xxxx" # Account ID of the authorized IAM user.

Use the authorized IAM user to connect to the cluster. If you can successfully query cluster-level resources (such as PV), the permission configuration is valid. For details on connecting to clusters, see Connecting to clusters.

Last updated: 2026.07.23 14:31:46

Public security network record in Beijing: No. 11010802032137