Volcengine Kubernetes Engine
Volcengine Kubernetes Engine
Volcengine Kubernetes Engine
Document
Volcengine Kubernetes Engine
What's New
History feature release notes
Kubernetes version release notes
Containerd runtime release notes
Add-on release notes
Monitoring add-ons
Scheduling add-ons
DNS add-ons
Security add-ons
GPU add-ons
Sandbox add-on
Security announcements
Product Announcement
Historical announcements
Overview
Getting started
User guide
Clusters
Creating clusters
Connecting to clusters
Upgrading clusters
Node pool
Creating node pools
Scaling out/in node pools
Nodes
Authorization management
Image
Namespaces
Networking
Cluster network
Container Network
Service
LoadBalancer
CLB
Ingress
APIG Ingress
ALB Ingress
Customize ALB Ingress forwarding rules
Certificate and security
CLB Ingress
Nginx Ingress
Gateway API
Workloads
Creating workloads
Configure workloads
Pods
Configuration management
Image acceleration
Storage
FSX client
EBS Volumes
TOS Volumes
NAS volumes
FSX access methods
NFS access methods
EFS volumes
vePFS volumes
FSX access methods
vePFS Client access methods
NFS access methods
CloudFS volumes
Local volumes
Autoscale
Node autoscaler
Workload autoscaler
Horizontal Pod Autoscaler (HPA)
Cron Horizontal Pod Autoscaler (CronHPA)
Intelligent Horizontal Pod Autoscaler (IHPA)
Horizontal Pod Autoscaler based on event-driven (KEDA)
Add-on management
Network add-ons
Storage add-ons
Monitoring add-ons
Scheduling add-ons
DNS add-ons
GPU add-ons
Core add-ons
Sandbox add-on
Upgrading add-ons
Heterogeneous computing
NVIDIA GPU
mGPU scheduling
RDMA high-performance computing
Scheduling management
Topology-aware scheduling
QoS-aware scheduling
Observability
Log management
Basic observation
Setup & Configuration
Cluster observation
Storage observation
Other observation
Using metrics
Full stack observation
Alert management
Diagnosis and inspection
Node check and self-healing
Application center
Backup center
Stability
Large-scale cluster management
Best practices
Authorization
Clusters
Nodes and node pools
Networking
Storage
Scheduling
Observability
Solution
Security and compliance
API reference
Cluster management
NodePool management
Node management
Virtual nodes management
Add-on management
Tag management
Access policy management
Instance images management
Cloud native observability
Inspection and diagnosis
Task management
Volcengine Container Instance
Appendix
SDK reference
Development guide
Terraform
FAQs
General FAQs
Cluster FAQ
cluster management
cluster network
cluster upgrade
Node and Node pool FAQs
Authorization FAQs
Workload FAQs
Service and Ingress FAQs
Storage FAQs
Heterogeneous computing FAQs
Observability FAQs
Quota FAQs
Add-on FAQs
Cloud-native AI
ServingKit
LLM applications
ComfyUI application
Deploying the Al inference application through Helm
Deepseek practices
Qwen practices
Kimi practice
Seed practices
Best practices
DeepSeek model deployment
GLM model deployment
MiniMax model deployment
Qwen model deployment
Kimi model deployment
Volcengine Container Instance
What's new
Historical feature release notes
Product Announcement
Overview
Billing
User guide
Integrating with VCI
Virtual node
VKE cluster uses virtual nodes
Self-managed/third-party cluster uses virtual node
Creating an instance
General purpose instance
GPU-accelerated computing instance
VCI Agent Sandbox
Startup acceleration
E2B-based management
Upgrade guide
Networking
Monitoring
Scheduling
Container configuration
VCI Image Cache
Best practices
Security and compliance
FAQs
- Documentation
Volcengine Kubernetes EngineVolcengine Kubernetes EngineUser guideAuthorization managementRBAC permissionsDescription of RBAC permission roles
Copy page
Download PDFRBAC permissions
Description of RBAC permission roles
Copy pageDownload PDFDescription of RBAC permission roles
This topic mainly describes the names of role-based access control (RBAC) roles, their corresponding ClusterRole names, and the corresponding permission names in Kubernetes.
Description of ClusterRole names
RBAC access permission role | ClusterRole name | Kubernetes permission name |
RBAC access permission role | ClusterRole name | Kubernetes permission name |
Cluster administrator | vke:admin | |
Operation and maintenance administrator | vke:ops | |
Privileged developer | vke:dev-promoted | |
Developers | vke:dev | |
Read-only user | vke:visitor |
Description of Kubernetes permission names
vke:admin
Run the following command to view the details of Kubernetes permissions that correspond to vke:admin.
kubectl get ClusterRole vke:admin --output=yaml
Expected output result:
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
creationTimestamp: "2023-05-17T04:03:24Z"
labels:
app.kubernetes.io/managed-by: Helm
rbac.vke.volcengine.com/preset-role: "true"
rbac.vke.volcengine.com/version: 1.0.0
name: vke:admin
resourceVersion: "308"
uid: f79ed7ee-2c92-4074-9b00-359d********
rules:
- apiGroups:
- '*'
resources:
- '*'
verbs:
- '*'
- nonResourceURLs:
- '*'
verbs:
- '*'
vke:ops
Run the following command to view the details of Kubernetes permissions that correspond to vke:ops.
kubectl get clusterrole vke:ops --output=yaml
Expected output result:
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
creationTimestamp: "2023-05-17T04:03:24Z"
labels:
app.kubernetes.io/managed-by: Helm
argocd.argoproj.io/instance: vke-resource-controller
rbac.vke.volcengine.com/preset-role: "true"
rbac.vke.volcengine.com/version: 1.0.6
name: vke:ops
resourceVersion: "37760530"
uid: 85d4a166-1acf-4cd0-8ef1-2bf5********
rules:
- apiGroups:
- ""
resources:
- pods
- pods/attach
- pods/exec
- pods/portforward
- pods/proxy
- pods/eviction
verbs:
- create
- delete
- deletecollection
- get
- list
- patch
- update
- watch
- apiGroups:
- ""
resources:
- namespaces
- nodes
- persistentvolumes
- configmaps
- endpoints
- persistentvolumeclaims
- replicationcontrollers
- replicationcontrollers/scale
- secrets
- serviceaccounts
- services
- services/proxy
- limitranges
- resourcequotas
- resourcequotas/status
verbs:
- create
- delete
- deletecollection
- get
- list
- patch
- update
- watch
- apiGroups:
- ""
resources:
- bindings
- events
- namespaces/status
- replicationcontrollers/status
- pods/log
- pods/status
- componentstatuses
verbs:
- get
- list
- watch
- apiGroups:
- coordination.k8s.io
resources:
- leases
verbs:
- get
- apiGroups:
- apps
resources:
- daemonsets
- daemonsets/status
- deployments
- deployments/status
- deployments/rollback
- deployments/scale
- replicasets
- replicasets/scale
- statefulsets
- controllerrevisions
verbs:
- create
- delete
- deletecollection
- get
- list
- patch
- update
- watch
- apiGroups:
- autoscaling
resources:
- horizontalpodautoscalers
verbs:
- create
- delete
- deletecollection
- get
- list
- patch
- update
- watch
- apiGroups:
- batch
resources:
- cronjobs
- jobs
verbs:
- create
- delete
- deletecollection
- get
- list
- patch
- update
- watch
- apiGroups:
- extensions
resources:
- daemonsets
- daemonsets/status
- deployments
- deployments/status
- deployments/rollback
- deployments/scale
- ingresses
- replicasets
- replicasets/scale
- replicationcontrollers/scale
verbs:
- create
- delete
- deletecollection
- get
- list
- patch
- update
- watch
- apiGroups:
- networking.k8s.io
resources:
- '*'
verbs:
- create
- delete
- deletecollection
- get
- list
- patch
- update
- watch
- apiGroups:
- servicecatalog.k8s.io
resources:
- clusterserviceclasses
- clusterserviceplans
- clusterservicebrokers
- serviceinstances
- servicebindings
verbs:
- create
- delete
- get
- list
- patch
- update
- watch
- apiGroups:
- servicecatalog.k8s.io
resources:
- clusterservicebrokers/status
- clusterserviceclasses/status
- clusterserviceplans/status
- serviceinstances/status
- serviceinstances/reference
- servicebindings/status
verbs:
- update
- apiGroups:
- storage.k8s.io
resources:
- storageclasses
verbs:
- create
- delete
- get
- list
- patch
- update
- watch
- apiGroups:
- apiextensions.k8s.io
resources:
- customresourcedefinitions
verbs:
- get
- list
- create
- watch
- patch
- update
- delete
- deletecollection
- apiGroups:
- vke.volcengine.com
resources:
- cronhpas
verbs:
- get
- list
- create
- watch
- patch
- update
- delete
- deletecollection
- apiGroups:
- appinspect.elkeid.bytedance.com
resources:
- secinspectpolicies
- secinspectreports
- secinspectrunconfigs
- secinspectclusterreports
verbs:
- get
- list
- watch
- apiGroups:
- loadbalancer.vke.volcengine.com
resources:
- albinstances
verbs:
- create
- delete
- get
- list
- patch
- update
- watch
vke:dev-promoted
Run the following command to view the details of Kubernetes permissions that correspond to vke:dev-promoted.
kubectl get clusterrole vke:dev-promoted --output=yaml
Expected output result:
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
creationTimestamp: "2023-05-17T04:03:24Z"
labels:
app.kubernetes.io/managed-by: Helm
rbac.vke.volcengine.com/preset-role: "true"
rbac.vke.volcengine.com/version: 1.0.4
name: vke:dev-promoted
resourceVersion: "37760524"
uid: 7baff690-a3eb-4ab4-b5b2-4ff3********
rules:
- apiGroups:
- ""
resources:
- nodes
- persistentvolumes
- limitranges
- resourcequotas
verbs:
- get
- list
- apiGroups:
- storage.k8s.io
resources:
- storageclasses
verbs:
- get
- list
- apiGroups:
- loadbalancer.vke.volcengine.com
resources:
- albinstances
verbs:
- get
- list
- apiGroups:
- networking.k8s.io
resources:
- ingressclasses
verbs:
- get
- list
vke:dev
Run the following command to view the details of Kubernetes permissions that correspond to vke:dev.
kubectl get clusterrole vke:dev --output=yaml
Expected output result:
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
creationTimestamp: "2023-05-17T04:03:24Z"
labels:
app.kubernetes.io/managed-by: Helm
argocd.argoproj.io/instance: vke-resource-controller
rbac.vke.volcengine.com/preset-role: "true"
rbac.vke.volcengine.com/version: 1.0.5
name: vke:dev
resourceVersion: "37760513"
uid: a6917647-e8c8-429d-abe5-b381********
rules:
- apiGroups:
- ""
resources:
- pods
- pods/attach
- pods/exec
- pods/portforward
- pods/proxy
verbs:
- create
- delete
- deletecollection
- get
- list
- patch
- update
- watch
- apiGroups:
- ""
resources:
- configmaps
- endpoints
- replicationcontrollers
- replicationcontrollers/scale
- secrets
- serviceaccounts
- services
- services/proxy
- persistentvolumeclaims
verbs:
- create
- delete
- deletecollection
- get
- list
- patch
- update
- watch
- apiGroups:
- ""
resources:
- events
- namespaces/status
- replicationcontrollers/status
- pods/log
- pods/status
- componentstatuses
verbs:
- get
- list
- watch
- apiGroups:
- ""
resources:
- namespaces
- nodes
- persistentvolumes
- limitranges
- resourcequotas
- resourcequotas/status
verbs:
- get
- list
- watch
- apiGroups:
- apps
resources:
- daemonsets
- daemonsets/status
- deployments
- deployments/status
- deployments/rollback
- deployments/scale
- replicasets
- replicasets/scale
- statefulsets
- controllerrevisions
verbs:
- create
- delete
- deletecollection
- get
- list
- patch
- update
- watch
- apiGroups:
- autoscaling
resources:
- horizontalpodautoscalers
verbs:
- create
- delete
- deletecollection
- get
- list
- patch
- update
- watch
- apiGroups:
- batch
resources:
- cronjobs
- jobs
verbs:
- create
- delete
- deletecollection
- get
- list
- patch
- update
- watch
- apiGroups:
- extensions
resources:
- daemonsets
- daemonsets/status
- deployments
- deployments/status
- deployments/rollback
- deployments/scale
- ingresses
- replicasets
- replicasets/scale
- replicationcontrollers/scale
verbs:
- create
- delete
- deletecollection
- get
- list
- patch
- update
- watch
- apiGroups:
- networking.k8s.io
resources:
- '*'
verbs:
- create
- delete
- deletecollection
- get
- list
- patch
- update
- watch
- apiGroups:
- servicecatalog.k8s.io
resources:
- clusterserviceclasses
- clusterserviceplans
- clusterservicebrokers
- serviceinstances
- servicebindings
verbs:
- create
- delete
- get
- list
- patch
- update
- watch
- apiGroups:
- servicecatalog.k8s.io
resources:
- clusterservicebrokers/status
- clusterserviceclasses/status
- clusterserviceplans/status
- serviceinstances/status
- serviceinstances/reference
- servicebindings/status
verbs:
- update
- apiGroups:
- policy
resources:
- poddisruptionbudgets
verbs:
- create
- delete
- deletecollection
- get
- list
- patch
- update
- watch
- apiGroups:
- apiextensions.k8s.io
resources:
- customresourcedefinitions
verbs:
- get
- list
- create
- watch
- patch
- update
- delete
- deletecollection
- apiGroups:
- storage.k8s.io
resources:
- storageclasses
verbs:
- get
- list
- watch
- apiGroups:
- vke.volcengine.com
resources:
- cronhpas
verbs:
- get
- list
- create
- watch
- patch
- update
- delete
- deletecollection
- apiGroups:
- appinspect.elkeid.bytedance.com
resources:
- secinspectpolicies
- secinspectreports
- secinspectrunconfigs
- secinspectclusterreports
verbs:
- get
- list
- watch
- apiGroups:
- loadbalancer.vke.volcengine.com
resources:
- albinstances
verbs:
- create
- delete
- deletecollection
- get
- list
- patch
- update
- watch
vke:visitor
Run the following command to view the details of Kubernetes permissions that correspond to vke:visitor.
kubectl get clusterrole vke:visitor --output=yaml
Expected output result:
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
creationTimestamp: "2023-05-17T04:03:24Z"
labels:
app.kubernetes.io/managed-by: Helm
rbac.vke.volcengine.com/preset-role: "true"
rbac.vke.volcengine.com/version: 1.0.4
name: vke:visitor
resourceVersion: "307"
uid: 0174b6f8-cde5-411d-bb01-b34f********
rules:
- apiGroups:
- ""
resources:
- pods
- pods/attach
- pods/exec
- pods/portforward
- pods/proxy
verbs:
- get
- list
- watch
- apiGroups:
- ""
resources:
- endpoints
- persistentvolumeclaims
- replicationcontrollers
- replicationcontrollers/scale
- serviceaccounts
- services
- services/proxy
- namespaces
- nodes
- persistentvolumes
- limitranges
- resourcequotas
- resourcequotas/status
verbs:
- get
- list
- watch
- apiGroups:
- ""
resources:
- events
- replicationcontrollers/status
- pods/log
- pods/status
verbs:
- get
- list
- watch
- apiGroups:
- apps
resources:
- daemonsets
- deployments
- deployments/rollback
- deployments/scale
- replicasets
- replicasets/scale
- statefulsets
- controllerrevisions
verbs:
- get
- list
- watch
- apiGroups:
- autoscaling
resources:
- horizontalpodautoscalers
verbs:
- get
- list
- watch
- apiGroups:
- batch
resources:
- cronjobs
- jobs
verbs:
- get
- list
- watch
- apiGroups:
- extensions
resources:
- daemonsets
- deployments
- deployments/rollback
- deployments/scale
- ingresses
- replicasets
- replicasets/scale
- replicationcontrollers/scale
verbs:
- get
- list
- watch
- apiGroups:
- networking.k8s.io
resources:
- '*'
verbs:
- get
- list
- watch
- apiGroups:
- servicecatalog.k8s.io
resources:
- clusterserviceclasses
- clusterserviceplans
- clusterservicebrokers
- serviceinstances
- servicebindings
verbs:
- get
- list
- watch
- apiGroups:
- policy
resources:
- poddisruptionbudgets
verbs:
- get
- list
- apiGroups:
- apiextensions.k8s.io
resources:
- customresourcedefinitions
verbs:
- get
- list
- watch
- apiGroups:
- storage.k8s.io
resources:
- storageclasses
verbs:
- get
- list
- watch
- apiGroups:
- vke.volcengine.com
resources:
- cronhpas
verbs:
- get
- list
- watch
- apiGroups:
- appinspect.elkeid.bytedance.com
resources:
- secinspectpolicies
- secinspectreports
- secinspectrunconfigs
- secinspectclusterreports
verbs:
- get
- list
- watch
- apiGroups:
- loadbalancer.vke.volcengine.com
resources:
- albinstances
verbs:
- get
- list
- watch
Last updated: 2026.06.12 11:25:11
All rights reserved © Beijing Volcano Engine Technology Co., Ltd2024
