Container Service for Kubernetes:Use RBAC to manage the operation permissions on resources in a cluster

Grant RBAC permissions by using an Alibaba Cloud account

1. Log on to the ACK console. In the left-side navigation pane, click Authorizations.

2. On the Authorizations page, grant permissions.

   • Grant permissions to a RAM user

     Click the RAM Users tab, find the RAM user that you want to manage in the list, and then click Modify Permissions to open the Permission Management panel. You can also select multiple RAM users to grant permissions.

   • Grant permissions to a RAM role

     Click the RAM Roles tab, specify RAM Role Name, and then click Modify Permissions to open the Permission Management panel.

     Note

     You can manually enter a RAM role or select a RAM role from the drop-down list. You can click the blank box next to the RAM Role Name field. The list of existing RAM roles is displayed. Then, select an existing RAM role from the list to grant permissions.

3. Click Add Permissions, configure the Clusters, Namespace, and Permission Management parameters for the RAM user or RAM role, and then click Submit.

   Note

   • You can assign one predefined role and multiple custom roles of a cluster or namespace to a RAM user or RAM role. In this case, the granted permissions are the union of the permissions provided by multiple roles.

   • If you need to authorize a RAM user or RAM role to manage all clusters (including newly created clusters), select All Clusters in the Clusters column when you assign a predefined role to the RAM user or RAM role.

   • Read-only administrator permissions can only be granted to a single cluster and do not support selection of all clusters.

   Predefined role	RBAC permission on cluster resources
   Administrator	RBAC read and write permissions on resources in all namespaces, as well as read and write permissions on nodes, volumes, namespaces, and quotas.
   Read-only administrator	RBAC read-only permissions on Kubernetes resources in all namespaces.
   O&M Engineer	Read and write permissions on visible Kubernetes resources in the console in all namespaces and read-only permissions on nodes, persistent volumes (PVs), namespaces, and quotas.
   Developer	RBAC read and write permissions on visible Kubernetes resources in the console in all namespaces or the specified namespaces.
   Restricted User	RBAC read-only permissions on visible Kubernetes resources in the console in all namespaces or the specified namespaces.
   Custom	The permissions of a custom role are determined by the cluster role that you select. Before you select a cluster role, check the permissions of the cluster role and make sure that you grant only the required permissions to the RAM user or RAM role. For more information about how to configure custom RAM users or RAM roles, see Use custom RBAC to restrict resource operations within the cluster. Important After a RAM user or RAM role is assigned the cluster-admin role, the RAM user or RAM role has the same permissions as the Alibaba Cloud account to which the RAM user or RAM role belongs. The RAM user or RAM role has full control over all resources within the cluster. Exercise caution if you want to assign the cluster-admin role to a RAM user or RAM role.

Grant RBAC permissions by using a RAM user or RAM role

An Alibaba Cloud account has full management permissions on the resources within the account. You can also grant the following RAM and RBAC permissions to a new or existing RAM user or RAM role. Then, the RAM user or RAM role is set as a permission administrator, and you can use the RAM user or RAM role to grant RBAC permissions to other RAM users or RAM roles.

Step 1: Specify a RAM user or RAM role as a permission administrator

1. Grant RAM authorization permissions

{
    "Statement": [{
            "Action": [
                "ram:Get*",
                "ram:List*",
                "cs:Get*",
                "cs:Describe*",
                "cs:List*",
                "cs:GrantPermission"
            ],
            "Resource": "*",
            "Effect": "Allow"
        },
        {
            "Action": [
                "ram:AttachPolicyToUser",
                "ram:AttachPolicy"
            ],
            "Effect": "Allow",
            "Resource":  [
                "acs:ram:*:*:policy/xxxxxx",
                "acs:*:*:*:user/*"
            ]
        }
    ],
    "Version": "1"
}

2. Grant RBAC administrator permissions

Log on to the ACK console with your Alibaba Cloud account. Then, assign the Administrator role of all clusters to the RAM user or RAM role. For more information, see Grant RBAC permissions by using an Alibaba Cloud account.

After the preceding RAM and RBAC permissions are granted, the authorized RAM user or RAM role is set as a permission administrator. You can use them to grant RAM and RBAC permissions to other RAM users or RAM roles.

Step 2: Grant RBAC permissions to other RAM users or RAM roles

If a RAM user or RAM role is granted administrator permissions, you can log on to the RAM console to grant RBAC permissions to other RAM users or RAM roles. The operations are the same as those for granting RBAC permissions by using an Alibaba Cloud account. For more information, see Grant RBAC permissions by using an Alibaba Cloud account.