Container Service for Kubernetes:Grant RBAC permissions to a RAM user or RAM role

Kubernetes RBAC mechanism

RBAC permissions are managed through two pairs of objects:

• ClusterRole and ClusterRoleBinding: A ClusterRole defines a set of permissions that apply cluster-wide. A ClusterRoleBinding binds it to a user or role.

• Role and RoleBinding: A Role defines permissions scoped to a single namespace. A RoleBinding binds it to a user or role within that namespace.

Step 1: Grant the necessary RAM permissions

A permissions administrator needs RAM permissions to view RAM identity information, cluster lists, and existing RBAC configurations, and to grant RBAC permissions in a cluster. Choose one of the following methods:

{
    "Statement": [{
            "Action": [
                "ram:Get*",
                "ram:List*",
                "cs:Get*",
                "cs:Describe*",
                "cs:List*",
                "cs:GrantPermission"
            ],
            "Resource": "*",
            "Effect": "Allow"
        }
    ],
    "Version": "1"
}

Step 2: Grant the Administrator RBAC role

Log on to the ACK console using an Alibaba Cloud account and grant the predefined Administrator role to the designated RAM user or role at the cluster scope.

1. Log on to the Container Service Management Console. In the left navigation pane, click Authorizations.

2. Grant permissions to a RAM user or RAM role:

   • For a RAM user: On the RAM Users tab, find the user to authorize and click Modify Permissions in the Actions column.

   • For a RAM role: On the RAM Roles tab, select the role to authorize and click Modify Permissions.

3. In the Permission Management panel, click + Add Permissions, select the scope (either a specific cluster or namespace), and select Administrator from the predefined roles.

   Granting this permission across all clusters automatically applies it to any new clusters created in the future.

Step 3: Grant RBAC permissions to other users

After setup is complete, the permissions administrator can log on to the ACK console and grant RBAC permissions to other RAM users or RAM roles on the Authorization page.

What is the relationship between RAM and RBAC?

ACK uses a layered authorization model where both RAM and RBAC are required (logical AND):

• RAM: Determines whether a user can see the cluster in the console or access it through OpenAPI.

• RBAC: Determines which Kubernetes resources (such as Pods, ConfigMaps, and Secrets) a user can operate on within the cluster.

Who can grant RBAC permissions?

• Alibaba Cloud account: Has full authority to grant permissions to any RAM user or role.

• Cluster creator: By default, the RAM identity that creates the cluster is granted cluster-admin privileges for that specific cluster.

• Permissions administrator: Any RAM user or role that has been granted the Administrator role can manage permissions for others.

Can I grant permissions to multiple clusters at once?

Yes. In the ACK console, select multiple clusters or choose All Clusters when configuring permissions. If you select All Clusters, the permissions are also automatically applied to any new clusters created in the future.

What should I do if I encounter a permission error?

If an operation through the console or OpenAPI fails due to missing RBAC permissions, the system returns a permission-denied error. Refer to the following table for common errors and their solutions:

How do I create custom permissions if the predefined roles don't meet my needs?

Create a custom Role or ClusterRole through a YAML manifest — for example, a ClusterRole that only allows viewing Pods. Then, when assigning permissions, select the custom permission type and bind it to your newly created ClusterRole. See Use custom RBAC to restrict resource operations in a cluster.

Kubernetes RBAC policies are additive and only support allow rules. There is no explicit deny rule.