Permission Overview
CCE permissions management allows you to assign permissions to IAM users and user groups under your tenant accounts. CCE combines the advantages of Identity and Access Management (IAM) and Kubernetes Role-based Access Control (RBAC) authorization to provide a variety of authorization methods, including IAM fine-grained authorization, IAM token authorization, cluster-scoped authorization, and namespace-wide authorization.
CCE allows you to manage permissions on clusters and related resources at a finer granularity, for example, to control the access of employees in different departments to cloud resources.
This section describes the CCE permissions management mechanism and related concepts. If your account has met your service requirements, you can skip the configurations in this chapter.
CCE policies apply to all CCE products, including CCE standard, CCE Turbo, and CCE Autopilot clusters. Any permission that is specific to CCE Autopilot clusters will be described in special notes.
CCE Permissions Management
- Cluster-level permissions: Cluster-level permissions management evolves out of the system policy authorization feature of IAM. IAM users in the same user group have the same permissions. A user group is a collection of users. By granting cluster-level permissions to specific user groups, you can enable users in these groups to perform various operations on clusters, such as creating or deleting clusters, charts, and add-ons. You can also restrict other user groups to view-only access.
Cluster-level permissions involve CCE non-Kubernetes APIs and support fine-grained IAM policies and enterprise project management capabilities.
- Namespace-level permissions: You can regulate users' or user groups' access to Kubernetes resources in a single namespace based on their Kubernetes RBAC roles. CCE has also been enhanced based on open-source capabilities. It supports RBAC authorization based on IAM user or user group, and RBAC authentication on access to APIs using IAM tokens.
Namespace-level permissions involve CCE and Kubernetes APIs and are enhanced based on the Kubernetes RBAC capabilities. Namespace-level permissions can be granted to IAM users or user groups for authentication and authorization, but are independent of fine-grained IAM policies.
In general, CCE permissions can be categorized into two scenarios. The first is permissions for creating and managing clusters, which includes permissions to create and delete cluster resources. The second is using Kubernetes resources in the cluster, such as workloads and Services.
These permissions allow you to manage resource users at a finer granularity.
Cluster Permissions (IAM-based) and Namespace Permissions (Kubernetes RBAC-based)
Users with different cluster permissions (assigned using IAM) have different namespace permissions (assigned using Kubernetes RBAC). Table 1 lists the namespace permissions of different users.
| User | CCE Standard, CCE Turbo, and CCE Autopilot (v1.13 or Later) |
|---|---|
| User with the Tenant Administrator permissions (for example, an account) | All namespace permissions |
| IAM user with the CCE Administrator role | All namespace permissions |
| IAM user with the CCE FullAccess or CCE ReadOnlyAccess role | Kubernetes RBAC authorization |
| IAM user with the Tenant Guest role | Kubernetes RBAC authorization |
kubectl Permissions
You can use kubectl to access Kubernetes resources in a cluster.
When you access a cluster using kubectl, CCE uses kubeconfig.json generated in the cluster for authentication. This file contains user information, based on which CCE determines which Kubernetes resources can be accessed by kubectl. The permissions recorded in a kubeconfig.json file vary by user. The permissions that a user has are listed in Table 1.
Federated Users
IAM provides the identity provider function to implement federated identity authentication based on Security Assertion Markup Language (SAML) or OpenID Connect. This allows users in your management system to access the cloud platform through single sign-on (SSO).
Users who log in through federated identity authentication are called federated users. Federated users are equivalent to IAM users.
Pay attention to the following points when using CCE as a federated user:
- When a user creates a CCE cluster, the cluster-admin permissions are granted to the user by default. The ID of a federated user changes upon each login and logout. Therefore, the user is displayed as deleted on the Permissions page of the CCE console. Do not manually delete the permissions, or the authentication fails. You are advised to grant the cluster-admin permissions to a user group on CCE and add federated users to the user group.
- Federated users cannot create permanent access keys (AKs/SKs). In scenarios where AKs/SKs are required (for example, during the creation of OBS PVs or PVCs), only the account or an IAM user of this account can create a pair of AK and SK and share them with the federated users. An access key contains the permissions granted to a user, so it is recommended that the federated user request an IAM user in the same group to create an access key.
Supported Actions in IAM
CCE provides system-defined policies that can be directly used in IAM. You can also create custom policies to supplement system-defined policies for more refined access control. Operations supported by policies are specific to APIs. The following are common concepts related to policies:
- Permissions: statements that allow or deny certain operations in a policy
- APIs: REST APIs that can be called by a user who has been granted specific permissions.
- Actions: specific operations that are allowed or denied.
- Dependencies: actions which a specific action depends on. When allowing an action for a user, you also need to allow any existing action dependencies for that user.
- IAM projects/Enterprise projects: the authorization scope of a custom policy. A custom policy can be applied to IAM projects or enterprise projects or both. Policies that contain actions for both IAM and enterprise projects can be used and applied for both IAM and Enterprise Management. Policies that contain actions only for IAM projects can be used and applied to IAM only. For details about the differences between IAM and enterprise management, see What Are the Differences Between IAM and Enterprise Management?
The check mark (√) and cross symbol (x) indicate that an action takes effect or does not take effect for the corresponding type of projects.
CCE supports the following actions in custom policies.
| Permission | API | Action | IAM Project | Enterprise Project |
|---|---|---|---|---|
| Obtaining clusters in a project | [CCE standard and CCE Turbo clusters] GET /api/v3/projects/{project_id}/clusters [CCE Autopilot clusters] GET /autopilot/v3/projects/{project_id}/clusters | cce:cluster:list | √ | √ |
| Obtaining a cluster | [CCE standard and CCE Turbo clusters] GET /api/v3/projects/{project_id}/clusters/{cluster_id} [CCE Autopilot clusters] GET /autopilot/v3/projects/{project_id}/clusters/{cluster_id} | cce:cluster:get | √ | √ |
| Creating a cluster | [CCE standard and CCE Turbo clusters] POST /api/v3/projects/{project_id}/clusters [CCE Autopilot clusters] POST /autopilot/v3/projects/{project_id}/clusters | cce:cluster:create | √ | √ |
| Updating a cluster | [CCE standard and CCE Turbo clusters] PUT /api/v3/projects/{project_id}/clusters/{cluster_id} [CCE Autopilot clusters] PUT /autopilot/v3/projects/{project_id}/clusters/{cluster_id} | cce:cluster:update | √ | √ |
| Deleting a cluster | [CCE standard and CCE Turbo clusters] DELETE /api/v3/projects/{project_id}/clusters/{cluster_id} [CCE Autopilot clusters] DELETE /autopilot/v3/projects/{project_id}/clusters/{cluster_id} | cce:cluster:delete | √ | √ |
| Upgrading a cluster | [CCE standard and CCE Turbo clusters] POST /api/v3/projects/{project_id}/clusters/{cluster_id}/operation/upgrade [CCE Autopilot clusters] POST /autopilot/v3/projects/{project_id}/clusters/{cluster_id}/operation/upgrade | cce:cluster:upgrade | √ | √ |
| Waking up a cluster | [CCE standard and CCE Turbo clusters] POST /api/v3/projects/{project_id}/clusters/{cluster_id}/operation/awake [CCE Autopilot clusters] N/A | cce:cluster:start | √ | √ |
| Hibernating a cluster | [CCE standard and CCE Turbo clusters] POST /api/v3/projects/{project_id}/clusters/{cluster_id}/operation/hibernate [CCE Autopilot clusters] N/A | cce:cluster:stop | √ | √ |
| Changing the specifications of a cluster | [CCE standard and CCE Turbo clusters] POST /api/v2/projects/{project_id}/clusters/:clusterid/resize [CCE Autopilot clusters] N/A | cce:cluster:resize | √ | √ |
| Binding/Unbinding the public API server address of a cluster | [CCE standard and CCE Turbo clusters] PUT /api/v3/projects/{project_id}/clusters/{cluster_id}/mastereip [CCE Autopilot clusters] PUT /autopilot/v3/projects/{project_id}/clusters/{cluster_id}/mastereip | cce:cluster:update | √ | √ |
| Obtaining the certificate of a cluster | [CCE standard and CCE Turbo clusters] POST /api/v3/projects/{project_id}/clusters/{cluster_id}/clustercert [CCE Autopilot clusters] POST /autopilot/v3/projects/{project_id}/clusters/{cluster_id}/clustercert | cce:cluster:get | √ | √ |
| Permission | API | Action | IAM Project | Enterprise Project |
|---|---|---|---|---|
| Obtaining information about a job | [CCE standard and CCE Turbo clusters] GET /api/v3/projects/{project_id}/jobs/{job_id} [CCE Autopilot clusters] GET /autopilot/v3/projects/{project_id}/jobs/{job_id} | cce:job:get | √ | √ |
| Listing all jobs | [CCE standard and CCE Turbo clusters] GET /api/v2/projects/{project_id}/jobs [CCE Autopilot clusters] GET /autopilot/v2/projects/{project_id}/jobs | cce:job:list | √ | √ |
| Deleting one or all jobs | [CCE standard and CCE Turbo clusters] DELETE /api/v2/projects/{project_id}/jobs DELETE /api/v2/projects/{project_id}/jobs/{job_id} [CCE Autopilot clusters] DELETE /autopilot/v2/projects/{project_id}/jobs DELETE /autopilot/v2/projects/{project_id}/jobs/{job_id} | cce:job:delete | √ | √ |
| Permission | API | Action | IAM Project | Enterprise Project |
|---|---|---|---|---|
| Creating an image cache | [CCE standard and CCE Turbo clusters] N/A [CCE Autopilot clusters] POST /v5/imagecaches | cce:imageCache:create | √ | × |
| Deleting an image cache | [CCE standard and CCE Turbo clusters] N/A [CCE Autopilot clusters] DELETE /v5/imagecaches/{image_cache_id} | cce:imageCache:delete | √ | × |
| Listing all image caches | [CCE standard and CCE Turbo clusters] N/A [CCE Autopilot clusters] GET /v5/imagecaches | cce:imageCache:list | √ | × |
| Viewing details about an image cache | [CCE standard and CCE Turbo clusters] N/A [CCE Autopilot clusters] GET /v5/imagecaches/{image_cache_id} | cce:imageCache:get | √ | × |
| Permission | API | Action | IAM Project | Enterprise Project |
|---|---|---|---|---|
| Updating a chart | [CCE standard and CCE Turbo clusters] PUT /v2/charts/{id} [CCE Autopilot clusters] POST /autopilot/v2/charts | cce:chart:update | √ | × |
| Uploading a chart | [CCE standard and CCE Turbo clusters] POST /v2/charts [CCE Autopilot clusters] POST /autopilot/v2/charts | cce:chart:upload | √ | × |
| Downloading a chart | [CCE standard and CCE Turbo clusters] GET /v2/charts/{id}/archive [CCE Autopilot clusters] GET /autopilot/v2/charts/{id}/archive | cce:chart:get | √ | × |
| Listing all charts | [CCE standard and CCE Turbo clusters] GET /v2/charts [CCE Autopilot clusters] GET /autopilot/v2/charts | cce:chart:list | √ | × |
| Obtaining information about a chart | [CCE standard and CCE Turbo clusters] GET /v2/charts/{id} [CCE Autopilot clusters] GET /autopilot/v2/charts/{id} | cce:chart:get | √ | × |
| Obtaining a chart | [CCE standard and CCE Turbo clusters] GET /v2/charts/{id}/values [CCE Autopilot clusters] GET /autopilot/v2/charts/{id}/values | cce:chart:get | √ | × |
| Deleting a chart | [CCE standard and CCE Turbo clusters] DELETE /v2/charts/{id} [CCE Autopilot clusters] DELETE /autopilot/v2/charts/{id} | cce:chart:delete | √ | × |
| Obtaining the quota of a chart | [CCE standard and CCE Turbo clusters] GET /v2/charts/{project_id}/quotas [CCE Autopilot clusters] GET /autopilot/v2/charts/{project_id}/quotas | cce:chart:list | √ | × |
| Permission | API | Action | IAM Project | Enterprise Project |
|---|---|---|---|---|
| Updating a release | [CCE standard and CCE Turbo clusters] PUT /cce/cam/v3/clusters/{cluster_id}/namespace/{namespace}/releases/{name} PUT /v2/releases/{name} (deprecated) [CCE Autopilot clusters] PUT /autopilot/cam/v3/clusters/{cluster_id}/namespace/{namespace}/releases/{name} | cce:release:update | √ | √ |
| Listing all releases | [CCE standard and CCE Turbo clusters] GET /cce/cam/v3/clusters/{cluster_id}/releases GET /v2/releases (deprecated) [CCE Autopilot clusters] GET /autopilot/cam/v3/clusters/{cluster_id}/releases | cce:release:list | √ | √ |
| Creating a release | [CCE standard and CCE Turbo clusters] POST /cce/cam/v3/clusters/{cluster_id}/releases POST /v2/releases (deprecated) [CCE Autopilot clusters] POST /autopilot/cam/v3/clusters/{cluster_id}/releases | cce:release:create | √ | √ |
| Obtaining information about a release | [CCE standard and CCE Turbo clusters] GET /cce/cam/v3/clusters/{cluster_id}/namespace/{namespace}/releases/{name} GET /v2/releases/{name} (deprecated) [CCE Autopilot clusters] GET /autopilot/cam/v3/clusters/{cluster_id}/namespace/{namespace}/releases/{name} | cce:release:get | √ | √ |
| Querying historical records of a release | [CCE standard and CCE Turbo clusters] GET /cce/cam/v3/clusters/{cluster_id}/namespace/{namespace}/releases/{name}/history GET /v2/releases/{name}/history (deprecated) [CCE Autopilot clusters] GET /autopilot/cam/v3/clusters/{cluster_id}/namespace/{namespace}/releases/{name} | cce:release:get | √ | √ |
| Deleting a release | [CCE standard and CCE Turbo clusters] DELETE /cce/cam/v3/clusters/{cluster_id}/namespace/{namespace}/releases/{name} DELETE /v2/releases/{name} (deprecated) [CCE Autopilot clusters] DELETE /autopilot/cam/v3/clusters/{cluster_id}/namespace/{namespace}/releases/{name} | cce:release:delete | √ | √ |
| Permission | API | Action | IAM Project | Enterprise Project |
|---|---|---|---|---|
| Creating a PVC (to be deprecated) | [CCE standard and CCE Turbo clusters] POST /api/v1/namespaces/{namespace}/cloudpersistentvolumeclaims [CCE Autopilot clusters] N/A | cce:storage:create | √ | √ |
| Deleting a PVC (to be deprecated) | [CCE standard and CCE Turbo clusters] DELETE /api/v1/namespaces/{namespace}/cloudpersistentvolumeclaims/{name} [CCE Autopilot clusters] N/A | cce:storage:delete | √ | √ |
| Listing all volumes | [CCE standard and CCE Turbo clusters] GET /storage/api/v1/namespaces/{namespace}/listvolumes [CCE Autopilot clusters] N/A | cce:storage:list | √ | √ |
| Permission | API | Action | IAM Project | Enterprise Project |
|---|---|---|---|---|
| Listing all add-on templates | [CCE standard and CCE Turbo clusters] GET /api/v3/addontemplate [CCE Autopilot clusters] GET /autopilot/v3/addontemplates | cce:addonTemplate:get | √ | x |
| Creating an add-on instance | [CCE standard and CCE Turbo clusters] POST /api/v3/addons [CCE Autopilot clusters] POST /autopilot/v3/addons | cce:addonInstance:create | √ | √ |
| Obtaining an add-on instance | [CCE standard and CCE Turbo clusters] GET /api/v3/addons/{id}?cluster_id={cluster_id} [CCE Autopilot clusters] GET /autopilot/v3/addons/{id} | cce:addonInstance:get | √ | √ |
| Listing all add-on instances | [CCE standard and CCE Turbo clusters] GET /api/v3/addons?cluster_id={cluster_id} [CCE Autopilot clusters] GET /autopilot/v3/addons?cluster_id={cluster_id} | cce:addonInstance:list | √ | √ |
| Deleting an add-on instance | [CCE standard and CCE Turbo clusters] DELETE /api/v3/addons/{id} [CCE Autopilot clusters] DELETE /autopilot/v3/addons/{id} | cce:addonInstance:delete | √ | √ |
| Updating an add-on instance | [CCE standard and CCE Turbo clusters] PUT /api/v3/addons/{id} [CCE Autopilot clusters] PUT /autopilot/v3/addons/{id} | cce:addonInstance:update | √ | √ |
| Permission | API | Action | IAM Project | Enterprise Project |
|---|---|---|---|---|
| Obtaining quota details | [CCE standard and CCE Turbo clusters] GET /api/v3/projects/{project_id}/quotas [CCE Autopilot clusters] GET /autopilot/v3/projects/{project_id}/quotas | cce:quota:get | √ | √ |
| Permission | API | Action | IAM Project | Enterprise Project |
|---|---|---|---|---|
| Adding resource tags to a cluster in batches | [CCE standard and CCE Turbo clusters] POST /api/v3/projects/{project_id}/clusters/{cluster_id}/tags/create [CCE Autopilot clusters] POST /autopilot/v3/projects/{project_id}/clusters/{cluster_id}/tags/create | cce:tag:operate | √ | √ |
| Deleting resource tags from a cluster in batches | [CCE standard and CCE Turbo clusters] POST /api/v3/projects/{project_id}/clusters/{cluster_id}/tags/delete [CCE Autopilot clusters] POST /autopilot/v3/projects/{project_id}/clusters/{cluster_id}/tags/delete | cce:tag:operate | √ | √ |
| Permission | API | Action | IAM Project | Enterprise Project |
|---|---|---|---|---|
| Obtaining the details about a cluster upgrade task | [CCE standard and CCE Turbo clusters] GET /api/v3/projects/{project_id}/clusters/{cluster_id}/operation/upgrade/tasks/{task_id} [CCE Autopilot clusters] GET /autopilot/v3/projects/{project_id}/clusters/{cluster_id}/operation/upgrade/tasks/{task_id} | cce:cluster:get | √ | √ |
| Obtaining a list of cluster upgrade task details | [CCE standard and CCE Turbo clusters] GET /api/v3/projects/{project_id}/clusters/{cluster_id}/operation/upgrade/tasks [CCE Autopilot clusters] GET /autopilot/v3/projects/{project_id}/clusters/{cluster_id}/operation/upgrade/tasks | cce:cluster:get | √ | √ |
| Retrying a cluster upgrade task | [CCE standard and CCE Turbo clusters] POST /api/v3/projects/{project_id}/clusters/{cluster_id}/operation/upgrade/retry [CCE Autopilot clusters] POST /autopilot/v3/projects/{project_id}/clusters/{cluster_id}/operation/upgrade/retry | cce:cluster:upgrade | √ | √ |
| Performing a pre-upgrade check for a cluster | [CCE standard and CCE Turbo clusters] POST /api/v3/projects/{project_id}/clusters/{cluster_id}/operation/precheck [CCE Autopilot clusters] POST /autopilot/v3/projects/{project_id}/clusters/{cluster_id}/operation/precheck | cce:cluster:upgrade | √ | √ |
| Obtaining details about a pre-upgrade check task of a cluster | [CCE standard and CCE Turbo clusters] GET /api/v3/projects/{project_id}/clusters/{cluster_id}/operation/precheck/tasks/{task_id} [CCE Autopilot clusters] GET /autopilot/v3/projects/{project_id}/clusters/{cluster_id}/operation/precheck/tasks/{task_id} | cce:cluster:get | √ | √ |
| Obtaining a list of pre-upgrade check tasks of a cluster | [CCE standard and CCE Turbo clusters] GET /api/v3/projects/{project_id}/clusters/{cluster_id}/operation/precheck/tasks [CCE Autopilot clusters] GET /autopilot/v3/projects/{project_id}/clusters/{cluster_id}/operation/precheck/tasks | cce:cluster:get | √ | √ |
| Performing a post-upgrade check for a cluster | [CCE standard and CCE Turbo clusters] POST /api/v3/projects/{project_id}/clusters/{cluster_id}/operation/postcheck [CCE Autopilot clusters] POST /autopilot/v3/projects/{project_id}/clusters/{cluster_id}/operation/postcheck | cce:cluster:upgrade | √ | √ |
| Backing up a cluster | [CCE standard and CCE Turbo clusters] POST /api/v3.1/projects/{project_id}/clusters/{cluster_id}/operation/snapshot [CCE Autopilot clusters] POST /autopilot/v3.1/projects/{project_id}/clusters/{cluster_id}/operation/snapshot | cce:cluster:upgrade | √ | √ |
| Obtaining a list of cluster backup task details | [CCE standard and CCE Turbo clusters] GET /api/v3.1/projects/{project_id}/clusters/{cluster_id}/operation/snapshot/tasks [CCE Autopilot clusters] GET /autopilot/v3.1/projects/{project_id}/clusters/{cluster_id}/operation/snapshot/tasks | cce:cluster:get | √ | √ |
| Obtaining details about a cluster upgrade task | [CCE standard and CCE Turbo clusters] GET /api/v3/projects/{project_id}/clusters/{cluster_id}/upgradeinfo [CCE Autopilot clusters] GET /autopilot/v3/projects/{project_id}/clusters/{cluster_id}/upgradeinfo | cce:cluster:get | √ | √ |
| Enabling the cluster upgrade booting task | [CCE standard and CCE Turbo clusters] POST /api/v3/projects/{project_id}/clusters/{cluster_id}/operation/upgradeworkflows [CCE Autopilot clusters] POST /autopilot/v3/projects/{project_id}/clusters/{cluster_id}/operation/upgradeworkflows | cce:cluster:upgrade | √ | √ |
| Obtaining a list of historical cluster upgrade booting tasks | [CCE standard and CCE Turbo clusters] GET /api/v3/projects/{project_id}/clusters/{cluster_id}/operation/upgradeworkflows [CCE Autopilot clusters] GET /autopilot/v3/projects/{project_id}/clusters/{cluster_id}/operation/upgradeworkflows | cce:cluster:get | √ | √ |
| Obtaining details about a specified cluster upgrade booting task | [CCE standard and CCE Turbo clusters] GET /api/v3/projects/{project_id}/clusters/{cluster_id}/operation/upgradeworkflows/{upgrade_workflow_id} [CCE Autopilot clusters] GET /autopilot/v3/projects/{project_id}/clusters/{cluster_id}/operation/upgradeworkflows/{upgrade_workflow_id} | cce:cluster:get | √ | √ |
| Updating the status of a cluster upgrade booting task | [CCE standard and CCE Turbo clusters] PATCH /api/v3/projects/{project_id}/clusters/{cluster_id}/operation/upgradeworkflows/{upgrade_workflow_id} [CCE Autopilot clusters] PATCH /autopilot/v3/projects/{project_id}/clusters/{cluster_id}/operation/upgradeworkflows/{upgrade_workflow_id} | cce:cluster:upgrade | √ | √ |
What is your overall rating for this page?
Thank you very much for your feedback. We will continue working to improve the documentation.See the reply and handling status in My Cloud VOC.
For any further questions, feel free to contact us through the chatbot.
Chatbot
