Access control

Create and administer applications on all managed clusters with a user named username. You must create a cluster role binding and bind it to username. Run the following command:

oc create clusterrolebinding <role-binding-name> --clusterrole=open-cluster-management:cluster-manager-admin --user=<username>

This role is a super user, which has access to all resources and actions. You can create the namespace for the application and all application resources in the namespace with this role.

Create applications that deploy resources to multiple namespaces. You must create a cluster role binding to the open-cluster-management:subscription-admin cluster role, and bind it to a user named username. Run the following command:

oc create clusterrolebinding <role-binding-name> --clusterrole=open-cluster-management:subscription-admin --user=<username>

Create and administer applications in the cluster-name managed cluster, with the username user. You must create a cluster role binding to the open-cluster-management:admin:<cluster-name> cluster role and bind it to username by entering the following command:

oc create clusterrolebinding <role-binding-name> --clusterrole=open-cluster-management:admin:<cluster-name> --user=<username>

This role has read and write access to all application resources on the managed cluster, cluster-name. Repeat this if access for other managed clusters is required.

Create a namespace role binding to the application namespace using the admin role and bind it to username by entering the following command:

oc create rolebinding <role-binding-name> -n <application-namespace> --clusterrole=admin --user=<username>

This role has read and write access to all application resources in the application namspace. Repeat this if access for other applications is required or if the application deploys to multiple namespaces.

You can create applications that deploy resources to multiple namespaces. Create a cluster role binding to the open-cluster-management:subscription-admin cluster role and bind it to username by entering the following command:

oc create clusterrolebinding <role-binding-name> --clusterrole=open-cluster-management:subscription-admin --user=<username>

To view an application on a managed cluster named cluster-name with the user named username, create a cluster role binding to the open-cluster-management:view: cluster role and bind it to username. Enter the following command:

oc create clusterrolebinding <role-binding-name> --clusterrole=open-cluster-management:view:<cluster-name> --user=<username>

This role has read access to all application resources on the managed cluster, cluster-name. Repeat this if access for other managed clusters is required.

Create a namespace role binding to the application namespace using the view role and bind it to username. Enter the following command:

oc create rolebinding <role-binding-name> -n <application-namespace> --clusterrole=view --user=<username>

This role has read access to all application resources in the application namspace. Repeat this if access for other applications is required.

To create a ClusterRole named rhacm-edit-policy with Policy, PlacementBinding, and PolicyAutomation edit access, run the following command:

oc create clusterrole rhacm-edit-policy --resource=policies.policy.open-cluster-management.io,placementbindings.policy.open-cluster-management.io,policyautomations.policy.open-cluster-management.io,policysets.policy.open-cluster-management.io --verb=create,delete,get,list,patch,update,watch

To create a policy in the rhacm-policies namespace, create a namespace RoleBinding, such as rhacm-edit-policy, to the rhacm-policies namespace using the ClusterRole created previously. Run the following command:

oc create rolebinding rhacm-edit-policy -n rhacm-policies --clusterrole=rhacm-edit-policy --user=<username>

To view policy status of a managed cluster, you need permission to view policies in the managed cluster namespace on the hub cluster. If you do not have view access, such as through the OpenShift view ClusterRole, create a ClusterRole, such as rhacm-view-policy, with view access to policies with the following command:

oc create clusterrole rhacm-view-policy --resource=policies.policy.open-cluster-management.io --verb=get,list,watch

To bind the new ClusterRole to the managed cluster namespace, run the following command to create a namespace RoleBinding:

oc create rolebinding rhacm-view-policy -n <cluster name> --clusterrole=rhacm-view-policy --user=<username>

Access managed cluster metrics.

Users are denied access to managed cluster metrics, if they are not assigned to the view role for the managed cluster on the hub cluster. Run the following command to verify if a user has the authority to create a managedClusterView role in the managed cluster namespace:

oc auth can-i create ManagedClusterView -n <managedClusterName> --as=<user>

As a cluster administrator, create a managedClusterView role in the managed cluster namespace. Run the following command:

oc create role create-managedclusterview --verb=create --resource=managedclusterviews -n <managedClusterName>

Then apply and bind the role to a user by creating a role bind. Run the following command:

oc create rolebinding user-create-managedclusterview-binding --role=create-managedclusterview --user=<user>  -n <managedClusterName>

Search for resources.

To verify if a user has access to resource types, use the following command:

oc auth can-i list <resource-type> -n <namespace> --as=<rbac-user>

Note: <resource-type> must be plural.

To view observability data in Grafana, you must have a RoleBinding resource in the same namespace of the managed cluster.

View the following RoleBinding example:

kind: RoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
 name: <replace-with-name-of-rolebinding>
 namespace: <replace-with-name-of-managedcluster-namespace>
subjects:
 - kind: <replace with User|Group|ServiceAccount>
   apiGroup: rbac.authorization.k8s.io
   name: <replace with name of User|Group|ServiceAccount>
roleRef:
 apiGroup: rbac.authorization.k8s.io
 kind: ClusterRole
 name: view

Generate your CA RSA private keys with the following commands:

openssl genrsa -out serverCAKey.pem 2048
openssl genrsa -out clientCAKey.pem 2048

Generate the self-signed CA certificates using the private keys. Run the following commands:

openssl req -x509 -sha256 -new -nodes -key serverCAKey.pem -days 1825 -out serverCACert.pem
openssl req -x509 -sha256 -new -nodes -key clientCAKey.pem -days 1825 -out clientCACert.pem