Container Service for Kubernetes:Use custom RBAC to restrict resource operations in a cluster

Step 1: Create a ClusterRole

The following steps create a ClusterRole named my-clusterrole that grants read-only access to pods and Services across the cluster.

1. Log on to the ACK console. In the left-side navigation pane, click Clusters.

2. On the Clusters page, click the name of the target cluster. In the left-side pane, choose Security > Role.

3. On the Role page, select the Cluster Role tab, then click OK.

4. In the Create YAML panel, enter the ClusterRole manifest and click OK. The following manifest grants read-only access (get, list, watch) to pods and Services:

   apiVersion: rbac.authorization.k8s.io/v1
   kind: ClusterRole
   metadata:
     name: my-clusterrole
   rules:
     - apiGroups: [""]
       resources: ["pods"]
       verbs: ["get", "list", "watch"]
     - apiGroups: [""]
       resources: ["services"]
       verbs: ["get", "list", "watch"]

   After creation, my-clusterrole appears under the Cluster Role tab.

Step 2: Bind the ClusterRole to a RAM user or RAM role

1. In the left-side navigation pane, click Authorizations.

2. On the Authorizations page, select the authorization target:

   • RAM user: click the RAM Users tab, find the target RAM user, and click Modify Permissions.

   • RAM role: click the RAM Roles tab, enter or select the RAM role name in the RAM Role Name field, and click Modify Permissions.

3. In the Permission Management panel, click + Add Permissions. In the Add Permissions section:

   1. Select the Clusters associated with my-clusterrole.

   2. Select the target Namespace.

   3. Under Permission Management, select Custom, then select my-clusterrole from the drop-down list.

   4. Click Submit.

Step 1: Create a custom role

ClusterRole — grants permissions across the entire cluster.

The following manifest creates a ClusterRole named my-clusterrole with read-only access to pods and Services:

# my-clusterrole.yaml
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: my-clusterrole
rules:
  - apiGroups: [""]
    resources: ["pods"]
    verbs: ["get", "list", "watch"]
  - apiGroups: [""]
    resources: ["services"]
    verbs: ["get", "list", "watch"]

Role — grants permissions within a specific namespace.

The following manifest creates a Role named my-role with read access to pods in the default namespace:

# my-role.yaml
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  namespace: default
  name: my-role
rules:
  - apiGroups: [""]
    resources: ["pods"]
    verbs: ["get", "list"]

Apply the manifest:

kubectl apply -f my-clusterrole.yaml

Step 2: Get the authorization object ID

To bind the role to a RAM user or RAM role, you need the corresponding ID:

• RAM user: get the UserId by calling the GetUser API with the RAM username.

• RAM role: get the RoleId by calling the GetRole API with the RAM role name.

Step 3: Create the binding

The following manifest binds my-clusterrole to a RAM user or RAM role. Replace 20811XXXXXXXXX2288 with the UserId or RoleId from the previous step.

# my-clusterrole-binding.yaml
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: my-clusterrole-binding
subjects:
  - kind: User
    name: "20811XXXXXXXXX2288"    # UserId or RoleId from Step 2
roleRef:
  kind: ClusterRole
  name: my-clusterrole
  apiGroup: rbac.authorization.k8s.io

Apply the binding:

kubectl apply -f my-clusterrole-binding.yaml

Verify the permissions

After binding, verify that the RAM user has the expected access. Retrieve the kubeconfig of the cluster and connect using kubectl, then run a command that the role permits:

kubectl get pods

To confirm that access outside the granted permissions is correctly denied, run a command not covered by the role — for example, listing Deployments when only pod access was granted:

kubectl get deployments

The expected output is:

Error from server (Forbidden): deployments.apps is forbidden: User "20811XXXXXXXXX2288" cannot list resource "deployments" in API group "apps" at the cluster scope

This error confirms the permission boundary is working correctly.