Call UpdateUserPermissions to manage RBAC permissions for RAM users and roles - Container Service for Kubernetes - Alibaba Cloud - Container Service for Kubernetes

In a Container Service for Kubernetes (ACK) cluster, non-cluster creators, Resource Access Management (RAM) users, and RAM roles do not have any Role-Based Access Control (RBAC) permissions in the cluster by default. You can call this operation to specify the resources that can be accessed, permission scope, and predefined roles. This helps you better manage the access control on resources in ACK clusters.

Operation description

Precautions:

You can update the permissions of a RAM user or RAM role on a cluster by using full update or incremental update. If you use full update, the existing permissions of the RAM user or RAM role on the cluster are overwritten. You must specify all the permissions that you want to grant to the RAM user or RAM role in the request parameters when you call the operation. If you use incremental update, you can grant permissions to or revoke permissions from the RAM user or RAM role on the cluster. In this case, only the permissions that you specify in the request parameters when you call the operation are granted or revoked, other permissions of the RAM user or RAM role on the cluster are not affected.

Try it now

Try this API in OpenAPI Explorer, no manual signing needed. Successful calls auto-generate SDK code matching your parameters. Download it with built-in credential security for local usage.

Test

RAM authorization

The table below describes the authorization required to call this API. You can define it in a Resource Access Management (RAM) policy. The table's columns are detailed below:

Action: The actions can be used in the Action element of RAM permission policy statements to grant permissions to perform the operation.
API: The API that you can call to perform the action.
Access level: The predefined level of access granted for each API. Valid values: create, list, get, update, and delete.
Resource type: The type of the resource that supports authorization to perform the action. It indicates if the action supports resource-level permission. The specified resource must be compatible with the action. Otherwise, the policy will be ineffective.
- For APIs with resource-level permissions, required resource types are marked with an asterisk (*). Specify the corresponding Alibaba Cloud Resource Name (ARN) in the Resource element of the policy.
- For APIs without resource-level permissions, it is shown as All Resources. Use an asterisk (*) in the Resource element of the policy.
Condition key: The condition keys defined by the service. The key allows for granular control, applying to either actions alone or actions associated with specific resources. In addition to service-specific condition keys, Alibaba Cloud provides a set of common condition keys applicable across all RAM-supported services.
Dependent action: The dependent actions required to run the action. To complete the action, the RAM user or the RAM role must have the permissions to perform all dependent actions.

Action

Access level

Resource type

Condition key

Dependent action

cs:UpdateUserPermissions

none

*All Resource

*

None

Request syntax

POST /permissions/users/{uid}/update HTTP/1.1

Path Parameters

Parameter	Type	Required	Description	Example
uid	string	No	The ID of the RAM user or RAM role whose permissions you want to update.	2367****

Request parameters

Parameter	Type	Required	Description	Example
body	array<object>	No	The request body.
	object	No	The request parameters.
cluster	string	No	The ID of the cluster on which you want to grant permissions to the RAM role or RAM role. Set this parameter to an empty string if `role_type` is set to `all-clusters`.	c796c60***
is_custom	boolean	No	Specifies whether to assign a custom role to the RAM user or RAM role. If you want to assign a custom role to the RAM user or RAM role, set `role_name` to the name of the custom role.	false
role_name	string	No	The predefined role name. Valid values: `admin`: administrator `admin-view`: read-only administrator `ops`: O&M engineer `dev`: developer `restricted`: restricted user Custom role Note: You cannot grant namespace-level permissions to the `admin`, `admin-view`, and `ops` roles. You cannot grant all cluster-level permissions to the `admin-view` role.	ops
role_type	string	No	The authorization type. Valid values: `cluster`: authorizes the RAM user or RAM role to manage the specified clusters. `namespace`: authorizes the RAM user or RAM role to manage the specified namespaces. `all-clusters`: authorizes the RAM user or RAM role to manage all clusters.	cluster
namespace	string	No	The namespace that you want to authorize the RAM user or RAM role to manage. This parameter is required only if you set role_type to namespace.	test
is_ram_role	boolean	No	Specifies whether to use a RAM role to grant permissions.	false
mode	string	No	The authorization method. Valid values: `apply`: The global update mode. Overwrites all existing permissions of the RAM user or RAM role on the cluster. You must specify all the permissions you want to grant to the RAM user or RAM role in the request parameters when you call this operation. `delete`: The deletion mode. Revokes only the cluster permissions specified in the request, preserving other existing permissions of the RAM user or RAM role. `patch`: The incremental mode. Adds only the cluster permissions specified in the request, preserving other existing permissions of the RAM user or RAM role. Default value: `apply`.	apply

Response elements

Element

Type

Description

Example

None defined.

Examples

Success response

JSON format

{}

Error codes

See Error Codes for a complete list.

Release notes

See Release Notes for a complete list.