Create Custom RBAC Roles for Fine-Grained Access Control - Container Compute Service - Alibaba Cloud - Container Compute Service

In Kubernetes Role-Based Access Control (RBAC), a Role and a ClusterRole each contain a set of rules that represent permissions. Write your own Roles and ClusterRoles to grant only the permissions that each user needs.

Access policies

Write an access policy yourself, or create a custom policy in the Alibaba Cloud Container Compute Service (ACS) console. Both paths take the same YAML as input. The following examples show which object to write for the permission scope that you need.

Role: namespace-scoped permissions

A Role sets access permissions within a namespace. Define a Role when the permissions that you grant must apply only to the resources in that namespace.

The following YAML example defines a Role in the default namespace. The Role grants all permissions on pods.

apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: test-role
  namespace: default
rules:
- apiGroups:
  - ""
  resources:
  - pods
  verbs:
  - create
  - delete
  - deletecollection
  - get
  - list
  - patch
  - update
  - watch

ClusterRole: cluster-scoped permissions

A ClusterRole sets access permissions for cluster-scoped resources. Define a ClusterRole when the permissions that you grant must apply across the cluster.

The following YAML example defines a ClusterRole that grants all permissions on pods in any given namespace.

apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: test-clusterrole
rules:
- apiGroups:
  - ""
  resources:
  - pods
  verbs:
  - create
  - delete
  - deletecollection
  - get
  - list
  - patch
  - update
  - watch

For more information about Roles and ClusterRoles, see Role and ClusterRole.

Create a custom RBAC authorization policy in the ACS console

Note

This procedure creates a custom ClusterRole for a Resource Access Management (RAM) user or a RAM role. Creating a Role follows largely the same steps, with the Role YAML as the input.

Log on to the ACS console. In the left-side navigation pane, choose Clusters.
On the Clusters page, click the name of your cluster. In the left-side navigation pane, choose Security > Role.
On the Role page, click the Cluster Role tab.
On the Cluster Role tab, click Create.
In the Create YAML panel, enter the YAML content of your custom policy and click OK to create the ClusterRole.
This step uses the YAML from the ClusterRole: cluster-scoped permissions subsection of Access policies as an example. After the ClusterRole is created, the custom ClusterRole test-clusterrole appears on the Cluster Role tab.

What to do next

To grant a custom RBAC authorization policy to a RAM user or a RAM role, see Grant RAM permissions.