Access control

Create and administer applications on all managed clusters with a user named username. You must create a cluster role binding and bind it to username. Run the following command:

oc create clusterrolebinding <role-binding-name> --clusterrole=open-cluster-management:cluster-manager-admin --user=<username>

This role is a super user, which has access to all resources and actions. You can create the namespace for the application and all application resources in the namespace with this role.

Create applications that deploy resources to multiple namespaces. You must create a cluster role binding to the open-cluster-management:subscription-admin cluster role, and bind it to a user named username. Run the following command:

oc create clusterrolebinding <role-binding-name> --clusterrole=open-cluster-management:subscription-admin --user=<username>

Create and administer an application named application-name in the cluster-name managed cluster, with the username user. You must create a cluster role binding to the open-cluster-management:admin:<cluster-name> cluster role and bind it to username by entering the following command:

oc create clusterrolebinding <role-binding-name> --clusterrole=open-cluster-management:admin:<cluster-name> --user=<username>

This role has read and write access to all application resources on the managed cluster, cluster-name. Repeat this if access for other managed clusters is required.

Create a namespace role binding to the application namespace using the admin role and bind it to username by entering the following command:

oc create rolebinding <role-binding-name> -n <application-namespace> --clusterrole=admin --user=<username>

This role has read and write access to all application resources in the application namspace. Repeat this if access for other applications is required or if the application deploys to multiple namespaces.

You can create applications that deploy resources to multiple namespaces. Create a cluster role binding to the open-cluster-management:subscription-admin cluster role and bind it to username by entering the following command:

oc create clusterrolebinding <role-binding-name> --clusterrole=open-cluster-management:subscription-admin --user=<username>

To view an application on a managed cluster named cluster-name with the user named username, create a cluster role binding to the open-cluster-management:view: cluster role and bind it to username. Enter the following command:

oc create clusterrolebinding <role-binding-name> --clusterrole=open-cluster-management:view:<cluster-name> --user=<username>

This role has read access to all application resources on the managed cluster, cluster-name. Repeat this if access for other managed clusters is required.

Create a namespace role binding to the application namespace using the view role and bind it to username. Enter the following command:

oc create rolebinding <role-binding-name> -n <application-namespace> --clusterrole=view --user=<username>

This role has read access to all application resources in the application namspace. Repeat this if access for other applications is required.

To create a policy in the policy namespace and apply it in a managed cluster named cluster-name, create a namespace role binding to the policy namespace using the open-cluster-management:admin:<cluster-name> cluster role. Run the following command:

oc create rolebinding <role-binding-name> -n <policy-namespace> --clusterrole=open-cluster-management:admin:<cluster-name> --user=<username>

To view a policy in a managed cluster, create a cluster role binding to open-cluster-management:view:<cluster-name> cluster role and bind it to the view role with the following command:

oc create clusterrolebinding <role-binding-name> --clusterrole=open-cluster-management:view:<cluster-name> --user=<username>

Access managed cluster metrics.

Users are denied access to managed cluster metrics, if they are not assigned to the view role for the managed cluster on the hub cluster. Run the following command to verify if a user has the authority to create a managedClusterView role in the managed cluster namespace:

oc auth can-i create ManagedClusterView -n <managedClusterName> --as=<user>

As a cluster administrator, create a managedClusterView role in the managed cluster namespace. Run the following command:

oc create role create-managedclusterview --verb=create --resource=managedclusterviews -n <managedClusterName>

Then apply and bind the role to a user by creating a role bind. Run the following command:

oc create rolebinding user-create-managedclusterview-binding --role=create-managedclusterview --user=<user>  -n <managedClusterName>

Search for resources.

To verify if a user has access to resource types, use the following command:

oc auth can-i list <resource-type> -n <namespace> --as=<rbac-user>

Note: <resource-type> must be plural.

To view observability data in Grafana, you must have a RoleBinding resource in the same namespace of the managed cluster.

View the following RoleBinding example:

kind: RoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
 name: <replace-with-name-of-rolebinding>
 namespace: <replace-with-name-of-managedcluster-namespace>
subjects:
 - kind: <replace with User|Group|ServiceAccount>
   apiGroup: rbac.authorization.k8s.io
   name: <replace with name of User|Group|ServiceAccount>
roleRef:
 apiGroup: rbac.authorization.k8s.io
 kind: ClusterRole
 name: view