Supported Actions in RBAC

This section describes the actions supported by CCI in role-based access control (RBAC).

Supported Actions

CCI provides system-defined policies that can be directly used in IAM. You can also create custom policies and use them to supplement system-defined policies, implementing more refined access control. Operations supported by policies are specific to APIs. The following are common concepts related to policies:

Permissions: statements that allow or deny certain operations in a policy
APIs: REST APIs that can be called by a user who has been granted specific permissions
Actions: specific operations that are allowed or denied
Dependencies: actions which a specific action depends on. When allowing an action for a user, you also need to allow any existing action dependencies for that user.
IAM projects or enterprise projects: the authorization scope of a custom policy. A custom policy can be applied to IAM projects or enterprise projects or both. Policies that contain actions for both IAM and enterprise projects can be used and applied for both IAM and Enterprise Management. Policies that contain actions only for IAM projects can be used and applied to IAM only. Administrators can check whether an action supports IAM projects or enterprise projects in the action list. For details about the differences between IAM and enterprise management, see Differences Between IAM and Enterprise Management.

CCI supports the following actions in custom policies:

Lifecycle management actions, such as the actions supported by the APIs for querying CCI namespace list, for querying the CCI pod list, for querying a CCI pod, for creating CCI pod, and for querying CCI pod logs
ConfigMap management actions, such as the actions supported by the APIs for creating, deleting, modifying, creating, and deleting a ConfigMap or secret

Lifecycle Management Actions

**Table 1** Lifecycle management actions
Permission	API	Action	IAM Project	Enterprise Project
Listing namespaces	GET /apis/cci/v2/namespaces	cci:namespace:list	√	√
Creating a namespace	POST /apis/cci/v2/namespaces	cci:namespace:create	√	√
Querying a namespace	GET /apis/cci/v2/namespaces/{name}	cci:namespace:get	√	√
Deleting a namespace	DELETE /apis/cci/v2/namespaces/{name}	cci:namespace:delete	√	√
Listing ConfigMaps in a namespace	GET /apis/cci/v2/namespaces/{namespace}/configmaps	cci:configmap:list	√	√
Creating a ConfigMap	POST /apis/cci/v2/namespaces/{namespace}/configmaps	cci:configmap:create	√	√
Replacing a ConfigMap	PUT /apis/cci/v2/namespaces/{namespace}/configmaps/{name}	cci:configmap:update	√	√
Deleting a ConfigMap	DELETE /apis/cci/v2/namespaces/{namespace}/configmaps/{name}	cci:configmap:delete	√	√
Listing pods in a namespace	GET /apis/cci/v2/namespaces/{namespace}/pods	cci:pod:list	√	√
Creating a pod	POST /apis/cci/v2/namespaces/{namespace}/pods	cci:pod:create	√	√
Querying a pod	GET /apis/cci/v2/namespaces/{namespace}/pods/{name}	cci:pod:get	√	√
Deleting a pod	DELETE /apis/cci/v2/namespaces/{namespace}/pods/{name}	cci:pod:delete	√	√
Listing secrets in a namespace	GET /apis/cci/v2/namespaces/{namespace}/secrets	cci:secret:list	√	√
Creating a secret	POST /apis/cci/v2/namespaces/{namespace}/secrets	cci:secret:create	√	√
Querying a secret	GET /apis/cci/v2/namespaces/{namespace}/secrets/{name}	cci:secret:get	√	√
Replacing a secret	PUT /apis/cci/v2/namespaces/{namespace}/secrets/{name}	cci:secret:update	√	√
Deleting a secret	DELETE /apis/cci/v2/namespaces/{namespace}/secrets/{name}	cci:secret:delete	√	√
Listing networks in a namespace	GET /apis/yangtse/v2/namespaces/{namespace}/networks	cci:network:list	√	√
Creating a network	POST /apis/yangtse/v2/namespaces/{namespace}/networks	cci:network:create	√	√
Replacing a network	PUT /apis/yangtse/v2/namespaces/{namespace}/networks/{name}	cci:network:update	√	√
Running commands in a container	POST /apis/cci/v2/namespaces/{namespace}/pods/{name}/exec	cci:pod:exec	√	√
Deleting a PersistentVolumeClaim	DELETE /apis/cci/v2/namespaces/{namespace}/persistentvolumeclaims/{name}	cci:persistentvolumeclaim:delete	√	√
Creating a Service	POST /apis/cci/v2/namespaces/{namespace}/services	cci:service:create	√	√
Replacing a Service	PUT /apis/cci/v2/namespaces/{namespace}/services/{name}	cci:service:update	√	√
Deleting a Service	DELETE /apis/cci/v2/namespaces/{namespace}/services/{name}	cci:service:delete	√	√
Listing Deployments in a namespace	GET /apis/cci/v2/namespaces/{namespace}/deployments	cci:deployment:list	√	√
Creating a Deployment	POST /apis/cci/v2/namespaces/{namespace}/deployments	cci:deployment:create	√	√
Querying a Deployment	GET /apis/cci/v2/namespaces/{namespace}/deployments/{name}	cci:deployment:get	√	√
Replacing a Deployment	PUT /apis/cci/v2/namespaces/{namespace}/deployments/{name}	cci:deployment:update	√	√
Deleting a Deployment	DELETE /apis/cci/v2/namespaces/{namespace}/deployments/{name}	cci:deployment:delete	√	√
Updating a Deployment	PATCH /apis/cci/v2/namespaces/{namespace}/deployments/{name}	cci:deployment:update	√	√
Listing HorizontalPodAutoscalers in a namespace	GET /apis/cci/v2/namespaces/{namespace}/horizontalpodautoscalers	cci:horizontalpodautoscaler:list	√	√
Creating a HorizontalPodAutoscaler	POST /apis/cci/v2/namespaces/{namespace}/horizontalpodautoscalers	cci:horizontalpodautoscaler:create	√	√
Querying a HorizontalPodAutoscaler	GET /apis/cci/v2/namespaces/{namespace}/horizontalpodautoscalers/{name}	cci:horizontalpodautoscaler:get	√	√
Replacing a HorizontalPodAutoscaler	PUT /apis/cci/v2/namespaces/{namespace}/horizontalpodautoscalers/{name}	cci:horizontalpodautoscaler:update	√	√
Deleting a HorizontalPodAutoscaler	DELETE /apis/cci/v2/namespaces/{namespace}/horizontalpodautoscalers/{name}	cci:horizontalpodautoscaler:delete	√	√
Updating a HorizontalPodAutoscaler	PATCH /apis/cci/v2/namespaces/{namespace}/horizontalpodautoscalers/{name}	cci:horizontalpodautoscaler:update	√	√