Overview
The user role management function of the platform is implemented based on Kubernetes RBAC (Role-Based Access Control), which allows for flexible configuration of different permissions for different users by associating roles with users on the platform.
A role is a collection of permissions for operating Kubernetes resources on the platform. The permissions for operating resources on the platform include creating, viewing, updating, and deleting, and roles classify and combine the permissions for different resources. By assigning roles to users and setting the scope of permission, the operating permissions for resources on the platform can be quickly issued.
Similarly, permissions can be quickly revoked by removing roles from users.
A role can have one or more types of resources and one or more permissions for operating them. Multiple roles can be assigned to a user, and a role can be assigned to multiple users.
For example, Role A only has the permissions to view and create projects, while Role B has the permissions to create, view, update, and delete users, projects, and namespaces.
Role of system
To meet common permission configuration scenarios, the platform has set the following system roles by default, which can be used to implement access control for resources on the platform in a flexible and convenient way, and to issue and revoke permissions for users on the platform.
| Role Name | Description | Role Level |
|---|---|---|
| Platform Administrator | Has all permissions for all business and resources on the platform. | Platform |
| Platform Auditors | Responsible for auditing the entire platform, can view all resources and operation records on the platform, but has no other permissions. | Platform |
| Cluster Administrator (Alpha) | Responsible for management and maintenance within the cluster, has all permissions for all resources under the cluster. | Cluster |
| Project Administrator | Responsible for binding and unbinding namespace administrators, and managing namespace quotas. | Project |
| namespace-admin-system | Responsible for adding members and setting roles for namespaces. | Namespace |
| Developers | Responsible for developing, deploying, and maintaining custom applications in the namespace. | Namespace |
Custom roles
To enrich the platform’s resource access control scenarios, the platform supports custom roles, allowing you to flexibly configure role permissions. Compared to system roles, these roles can be updated and deleted, making them more flexible to manage. However, when performing update or delete operations, caution should be exercised to avoid accidentally causing users to lose their permissions. For example, deleting a custom role will automatically cause all users bound to that role to lose the permissions granted by the role.