Container Service for Kubernetes:Grant RBAC permissions to a RAM user or RAM role

Kubernetes RBAC mechanism

RBAC permissions are managed through two pairs of objects:

• ClusterRole and ClusterRoleBinding: A ClusterRole defines a set of permissions that apply cluster-wide. It is bound to a user or role using a ClusterRoleBinding.

• Role and RoleBinding: A Role defines permissions that are scoped to a single namespace. It is bound to a user or role within that namespace using a RoleBinding.

1. Log on to the Container Service Management Console . In the navigation pane on the left, click Authorizations.

2. Grant permissions to a RAM user or RAM role.

   • Grant permissions to a RAM user: On the RAM Users tab, find the one to authorize and click Modify Permissions in the Actions column.

   • To grant permissions to a RAM role: On the RAM Roles tab, select the one to authorize and click Modify Permissions.

3. In the Permission Management panel, click + Add Permissions, select the scope (either a specific cluster or namespace), and choose a predefined role to grant the desired level of access.

Step 1: Designate a RAM user or role as a permission administrator

{
    "Statement": [{
            "Action": [
                "ram:Get*",
                "ram:List*",
                "cs:Get*",
                "cs:Describe*",
                "cs:List*",
                "cs:GrantPermission"
            ],
            "Resource": "*",
            "Effect": "Allow"
        }
    ],
    "Version": "1"
}

Step 2: Grant RBAC permissions to other RAM users or RAM roles

Once the setup is complete, the permission administrator can log on to the ACK console and grant RBAC permissions to other RAM users or RAM roles on the Authorization page.

What is the relationship between RAM and RBAC?

ACK uses a layered authorization model where both RAM and RBAC are required (Logical AND):

• RAM: Determines whether a user can "see" the cluster in the console or access the cluster through OpenAPI.

• RBAC: Determines which Kubernetes resources (such as pods, ConfigMaps, Secrets) a user can operate on within the cluster.

Who has the authority to grant RBAC permissions?

• Root account: The Alibaba Cloud account has full authority to grant permissions to any RAM user or role.

• Cluster creator: By default, the RAM identity that creates the cluster is granted cluster-admin privileges for that specific cluster.

• Permission administrator: Any RAM user or role that has been granted the Administrator role can manage permissions for others.

Can I grant permissions to multiple clusters simultaneously?

Yes. In the ACK console, select multiple clusters or choose "All Clusters" when configuring permissions. If you select "All Clusters", the permissions will also be automatically applied to any new clusters created in the future.

What should I do if I encounter a permission error?

If an operation performed through the console or OpenAPI fails due to missing RBAC permissions, the system will return a permission-denied error code. Refer to the following table for common errors and their solutions:

How can I create custom permissions if the predefined RBAC roles do not meet my needs?

You can create a custom Role or ClusterRole through a YAML manifest. For example, a ClusterRole that only allows viewing pods. Then, when assigning permissions, select the custom permission type and bind it to your newly created ClusterRole. See Use custom RBAC to restrict resource operations in a cluster.

Kubernetes RBAC policies are additive and only support allow rules. There is no explicit deny rule.