Role-based access control (RBAC) for clusters

Your product supports several roles. Your role determines the actions that you can perform.

Kubernetes offers role-based access control (RBAC) authorization mechanisms, which are extended on the cluster. Users of the cluster platform can be grouped into teams and have namespaces dedicated to teams.

With your product, you can create a team and add users, user groups, and resources to that team. All users in a team have access to the team resources. A user, user group, or resource can be assigned to multiple teams.

Your product has one Cluster Administrator with cluster-wide access, while other users can be classified as Cloud Pak Administrator, Account Administrator, Administrator, Editor, Operator, Auditor, and Viewer, assigned to various namespaces. Based on the role that is assigned to a user or user group, the level of access to each logical resource on the cluster is defined.

• Platform roles and actions
• IAM roles and actions
• RBAC for IAM resources
• RBAC for resources in OpenShift clusters

Platform roles and actions

Your product supports the Cluster Administrator role. The Cluster Administrator has complete access to your product platform. Learn about roles in the following list:

Cluster Administrator access: The Cluster administrator has complete access for all operations.

• Connect to an LDAP directory
• Access and use the Administration panel UI dashboard
• Create teams, add users, and assign them the IAM roles
• Manage workloads, infrastructure, and applications across all namespaces
• Create namespaces
• Assign quotas
• Add pod security policies
• Add an internal Helm repository
• Delete an internal Helm repository
• Add Helm charts to the internal Helm repository
• Remove Helm charts from the internal Helm repository
• Synchronize internal and external Helm repositories
• Manage storage classes and persistent volumes across all namespaces
• Add, remove, and update image security enforcement policies
• Add, remove, and update service IDs in the cluster

Cloud Pak Administrator access: The Cloud Pak administrator has the access to the following resources

• Connect to an LDAP directory
• Access and use the Administration panel UI dashboard
• Create teams, add users, and assign them the IAM roles
• Manage workloads, infrastructure, and applications across the set of namespaces allocated to the corresponding Cloud Paks
• Create namespaces
• Manage storage classes and persistent volumes across the set of namespaces allocated to the corresponding Cloud Paks
• Add, remove, and update service IDs in the cluster
• Manage(all CRUD operations) on any other resource across the set of namespaces allocated to the corresponding Cloud Paks

Account Administrator access: The Account Administrator has all the privileges of the Administrator, and has add, update, view, and delete access for namespace.

Administrator access: The Administrator has add, update, view, and delete access.

Editor access: The Editor has read and edit access to team resources.

Operator access: The Operator has create, read, and edit access to team resources.

Auditor access: The Auditor can view logs within namespaces if given access to those namespaces.

Viewer access: The Viewer has read-only access. By default, users have Viewer access when they are added to a team.

IAM roles and actions

You can assign an IAM role to users or user groups when you add them to a team. Within a team, each user or user group can have only one role. However, a user might have multiple roles within a team when you add a user individually and also as a member of a team's group. If so, the user can act based on the highest role that is assigned to the user. For example, if you add the user as an administrator and you assign a Viewer role to the user's group, the user can act as an administrator for the team.

A user or user group can be a member of multiple teams and have different roles on each team.

An IAM role defines the actions that a user can perform on the team resources.

Your product supports the following IAM roles:

Note: Only the Cluster Administrator, Cloud Pak Administrator, and Administrator can access the Administration panel UI dashboard and manage teams, users, and roles. The Administrator cannot assign the Cluster Administrator or Cloud Pak Administrator role to any user or group.

Note: Viewers and editors cannot view logs on any of your product console pages.

RBAC for IAM resources

Note: A user can create Service ID policies with the same level of access that the user has. The user cannot create or assign policies with a higher role to a service ID.

RBAC for resources in OpenShift clusters

OpenShift clusters use the Cluster Administrator, Administrator, Operator or Editor, and Viewer roles. The Cluster Administrator has complete access to all the resources. For the Administrator, Operator or Editor, and Viewer roles, the following tables list the resources and the actions that are allowed on the resources.

• For Administrator role, see Allowed resources for the Administrator role in OpenShift clusters
• For Operator or Editor role, see Allowed resources for the Operator or Editor role in OpenShift clusters
• For Viewer role, see Allowed resources for the Viewer role in OpenShift clusters

For more information about OpenShift RBAC, see the following OpenShift documentation:

• For OpenShift Container Platform version 4.6, see Using RBAC to define and apply permissions
• For OpenShift Container Platform version 4.5, see Using RBAC to define and apply permissions
• For OpenShift Container Platform version 4.4, see Using RBAC to define and apply permissions

Allowed resources for the Administrator role in OpenShift clusters

Allowed resources for the Operator or Editor role in OpenShift clusters

Allowed resources for the Viewer role in OpenShift clusters