- What's New
- Function Overview
- Service Overview
- Billing
- Getting Started
- User Guide
- Best Practices
-
Developer Guide
- Overview
- Using Native kubectl (Recommended)
- Namespace and Network
- Pod
- Label
- Deployment
- EIPPool
- EIP
- Pod Resource Monitoring Metric
- Collecting Pod Logs
- Managing Network Access Through Service and Ingress
- Using PersistentVolumeClaim to Apply for Persistent Storage
- ConfigMap and Secret
- Creating a Workload Using Job and Cron Job
- YAML Syntax
-
API Reference
- Before You Start
- Calling APIs
- Getting Started
- Proprietary APIs
-
Kubernetes APIs
- ConfigMap
- Pod
- StorageClass
- Service
-
Deployment
- Querying All Deployments
- Deleting All Deployments in a Namespace
- Querying Deployments in a Namespace
- Creating a Deployment
- Deleting a Deployment
- Querying a Deployment
- Updating a Deployment
- Replacing a Deployment
- Querying the Scaling Operation of a Specified Deployment
- Updating the Scaling Operation of a Specified Deployment
- Replacing the Scaling Operation of a Specified Deployment
- Querying the Status of a Deployment
- Ingress
- OpenAPIv2
- VolcanoJob
- Namespace
- ClusterRole
- Secret
- Endpoint
- ResourceQuota
- CronJob
-
API groups
- Querying API Versions
- Querying All APIs of v1
- Querying an APIGroupList
- Querying APIGroup (/apis/apps)
- Querying APIs of apps/v1
- Querying an APIGroup (/apis/batch)
- Querying an APIGroup (/apis/batch.volcano.sh)
- Querying All APIs of batch.volcano.sh/v1alpha1
- Querying All APIs of batch/v1
- Querying All APIs of batch/v1beta1
- Querying an APIGroup (/apis/crd.yangtse.cni)
- Querying All APIs of crd.yangtse.cni/v1
- Querying an APIGroup (/apis/extensions)
- Querying All APIs of extensions/v1beta1
- Querying an APIGroup (/apis/metrics.k8s.io)
- Querying All APIs of metrics.k8s.io/v1beta1
- Querying an APIGroup (/apis/networking.cci.io)
- Querying All APIs of networking.cci.io/v1beta1
- Querying an APIGroup (/apis/rbac.authorization.k8s.io)
- Querying All APIs of rbac.authorization.k8s.io/v1
- Event
- PersistentVolumeClaim
- RoleBinding
- StatefulSet
- Job
- ReplicaSet
- Data Structure
- Permissions Policies and Supported Actions
- Appendix
- Out-of-Date APIs
- Change History
-
FAQs
- Product Consulting
-
Basic Concept FAQs
- What Is CCI?
- What Are the Differences Between Cloud Container Instance and Cloud Container Engine?
- What Is an Environment Variable?
- What Is a Service?
- What Is Mcore?
- What Are the Relationships Between Images, Containers, and Workloads?
- What Are Kata Containers?
- Can kubectl Be Used to Manage Container Instances?
- What Are Core-Hours in CCI Resource Packages?
- Workload Abnormalities
-
Container Workload FAQs
- Why Service Performance Does Not Meet the Expectation?
- How Do I Set the Quantity of Instances (Pods)?
- How Do I Check My Resource Quotas?
- How Do I Set Probes for a Workload?
- How Do I Configure an Auto Scaling Policy?
- What Do I Do If the Workload Created from the sample Image Fails to Run?
- How Do I View Pods After I Call the API to Delete a Deployment?
- Why an Error Is Reported When a GPU-Related Operation Is Performed on the Container Entered by Using exec?
- Can I Start a Container in Privileged Mode When Running the systemctl Command in a Container in a CCI Cluster?
- Why Does the Intel oneAPI Toolkit Fail to Run VASP Tasks Occasionally?
- Why Are Pods Evicted?
- Why Is the Workload Web-Terminal Not Displayed on the Console?
- Why Are Fees Continuously Deducted After I Delete a Workload?
-
Image Repository FAQs
- Can I Export Public Images?
- How Do I Create a Container Image?
- How Do I Upload Images?
- Does CCI Provide Base Container Images for Download?
- Does CCI Administrator Have the Permission to Upload Image Packages?
- What Permissions Are Required for Uploading Image Packages for CCI?
- What Do I Do If Authentication Is Required During Image Push?
-
Network Management FAQs
- How Do I View the VPC CIDR Block?
- Does CCI Support Load Balancing?
- How Do I Configure the DNS Service on CCI?
- Does CCI Support InfiniBand (IB) Networks?
- How Do I Access a Container from a Public Network?
- How Do I Access a Public Network from a Container?
- What Do I Do If Access to a Workload from a Public Network Fails?
- What Do I Do If Error 504 Is Reported When I Access a Workload?
- What Do I Do If the Connection Timed Out?
- Storage Management FAQs
- Log Collection
- Account
- SDK Reference
- Videos
- General Reference
Copied.
Granting Namespace Permissions to a User or User Group
This section describes how to grant CCI users and user groups the permissions to various namespaced resources. Process Flow describes the process for granting permissions.
Configuration Description
- You need to have a cloud account. Only the account and IAM users who have been assigned the CCIFullAccess policy or all RBAC policies can grant permissions to other users.
- In this example, both a user group and a user are granted permissions to access namespaced resources. You have the choice to grant permissions to either users or user groups.
- You can use the process flow only to add namespace permissions policies for users or user groups. To edit permissions policies of users or user groups, click Edit Policy under Operation on the Permissions Management page.
- If you grant multiple permissions policies to a user or user group, all these policies will take effect at the same time. The permissions policies that you grant to a user group apply to all users in the user group.
- If you enable RBAC authentication, the union set of permissions policies of the same type will be used, and the intersection set of permissions policies of different types will be used. For example, if you add multiple IAM fine-grained policies to a user group, all these policies will take effect. Similarly, if you add multiple permissions policies to a user or user group on the CCI permissions management page, all these policies will take effect. A user with the CCI CommonOperations policy can create Deployments. However, if the user and the user group to which the user belongs are not granted the RBAC policy in the target namespace, the user will fail the authentication and cannot create the Deployment. That is, the intersection set of permissions policies of different types will be used.
Process Flow
A namespace is an abstract collection of resources and objects. You can create multiple namespaces in a cluster. Data is isolated between namespaces so namespaces can share the same cluster service without affecting each other. A namespace can act as a virtual cluster to meet diversified requirements.
This section describes how you can grant namespace permissions to the IAM user James and the user group Developers created in Creating a User and Granting CCI Permissions.
Step 1: Grant Namespace Permissions to an IAM User or User Group
In this step, you will grant user James who has the CCI CommonOperations policy permissions to view the target namespace.
- Log in to the CCI console. In the navigation pane on the left, choose Permissions Management.
- Click Add Permissions.
Figure 1 Adding permissions
- Select the namespace whose access you want to manage. In this example, select cci-namespace-demo-rbac.
Figure 2 Selecting a namespace
- Add the admin permissions policy for the user group Developers.
- User/User Group: Select User group from the drop-down list and then select Developers from the user group list.
- Permissions Policy: Select admin.
- Click Add Policy for Namespaces. Add permissions on another namespace (cci-namespace-demo-rbac01) for user James.
- Namespace: Select cci-namespace-demo-rbac01.
- User/User Group: Select User from the drop-down list and then select James from the user list.
- Permissions Policy: Select view.
Figure 3 Adding a namespace permissions policy - Click OK. The namespace permissions granted to the user group and user are displayed in the permissions list.
Figure 4 Namespace permissions list
NOTE:
To sum up, the authorization result is as follows:
- The user group Developers has admin permissions on the namespace cci-namespace-demo-rbac. The admin permissions policy also applies to the IAM user James in the user group Developers.
- The IAM user James has view permissions on the namespace cci-namespace-demo-rbac01.
Step 2: Log In and Verify Permissions
Use the username James and identity credential to log in to the CCI console and verify that the IAM user James has the namespace permissions.
- Enter the account name, username, and password, and click Log In.
- The account is that you used to create the IAM user.
- The username and password are those set by the account when creating the IAM user. You will be prompted to change the initial password at initial login.
If the login fails, contact the account owner to verify the username and password. Alternatively, you can reset the password.
- After you log in, switch to a region where the user has been granted permissions.
- Choose Service List > Cloud Container Instance to launch the CCI console. Then verify that the IAM user has namespace permissions.
Feedback
Was this page helpful?
Provide feedbackThank you very much for your feedback. We will continue working to improve the documentation.See the reply and handling status in My Cloud VOC.
For any further questions, feel free to contact us through the chatbot.
Chatbot