Managing RBAC in Red Hat Advanced Cluster Security for Kubernetes 3.63 and newer - Managing user access | Operating | Red Hat Advanced Cluster Security for Kubernetes 3.71

System roles
System permission sets
- Viewing the permissions for a system permission set
- Creating a custom permission set
System access scopes
- Viewing the details for a system access scope
- Creating a custom access scope
Resource definitions

Red Hat Advanced Cluster Security for Kubernetes (RHACS) comes with role-based access control (RBAC) that you can use to configure roles and grant various levels of access to Red Hat Advanced Cluster Security for Kubernetes for different users.

Red Hat Advanced Cluster Security for Kubernetes 3.63 includes a scoped access control feature that enables you to configure fine-grained and specific sets of permissions that define how a given Red Hat Advanced Cluster Security for Kubernetes user or a group of users can interact with Red Hat Advanced Cluster Security for Kubernetes, which resources they can access, and which actions they can perform.

Roles are a collection of permission sets and access scopes. You can assign roles to users and groups by specifying rules. You can configure these rules when you configure an authentication provider. There are two types of roles in Red Hat Advanced Cluster Security for Kubernetes:

System roles that are created by Red Hat and cannot be changed.

Custom roles, which Red Hat Advanced Cluster Security for Kubernetes administrators can create and change at any time.

If you assign multiple roles for a user, they get access to the combined permissions of the assigned roles.
If you have users assigned to a custom role, and you delete that role, all associated users transfer to the minimum access role that you have configured.

Permission sets are a set of permissions that define what actions a role can perform on a given resource. Resources are the functionalities of Red Hat Advanced Cluster Security for Kubernetes for which you can set view (read) and modify (write) permissions. There are two types of permission sets in Red Hat Advanced Cluster Security for Kubernetes:
- System permission sets, which are created by Red Hat and cannot be changed.
- Custom permission sets, which Red Hat Advanced Cluster Security for Kubernetes administrators can create and change at any time.
Access scopes are a set of Kubernetes and OpenShift Container Platform resources that users can access. For example, you can define an access scope that only allows users to access information about pods in a given project. There are two types of access scopes in Red Hat Advanced Cluster Security for Kubernetes:
- System access scopes, which are created by Red Hat and cannot be changed.
- Custom access scopes, which Red Hat Advanced Cluster Security for Kubernetes administrators can create and change at any time.

System roles

Red Hat Advanced Cluster Security for Kubernetes includes some default system roles that you can apply to users when you create rules. You can also create custom roles as required.

System role	Description
Admin	This role is targeted for administrators. Use it to provide read and write access to all resources.
Analyst	This role is targeted for a user who cannot make any changes, but can view everything. Use it to provide read-only access for all resources.
Continuous Integration	This role is targeted for CI (continuous integration) systems and includes the permission set required to enforce deployment policies.
None	This role has no read and write access to any resource. You can set this role as the minimum access role for all users.
Sensor Creator	Red Hat Advanced Cluster Security for Kubernetes uses this role to automate new cluster setups. It includes the permission set to create Sensors in secured clusters.
Scope Manager	This role includes the minimum permissions required to create and modify access scopes.

System role

Description

Admin

This role is targeted for administrators. Use it to provide read and write access to all resources.

Analyst

This role is targeted for a user who cannot make any changes, but can view everything. Use it to provide read-only access for all resources.

Continuous Integration

This role is targeted for CI (continuous integration) systems and includes the permission set required to enforce deployment policies.

None

This role has no read and write access to any resource. You can set this role as the minimum access role for all users.

Sensor Creator

Red Hat Advanced Cluster Security for Kubernetes uses this role to automate new cluster setups. It includes the permission set to create Sensors in secured clusters.

Scope Manager

This role includes the minimum permissions required to create and modify access scopes.

Viewing the permission set and access scope for a system role

You can view the permission set and access scope for the default system roles.

Procedure

On the RHACS portal, navigate to Platform Configuration → Access control.
Select Roles.
Click on one of the roles to view its details. The details page shows the permission set and access scope for the slected role.

You cannot modify permission set and access scope for the default system roles.

Creating a custom role

You can create new roles from the Access Control view.

Prerequisites

You must have the Admin role, or a role with the permission set with read and write permissions for the AuthProvider and Role resources to create, modify, and delete custom roles.
You must create a permissions set and an access scope for the custom role before creating the role.

Procedure

On the RHACS portal, navigate to Platform Configuration → Access control.
Select the Roles tab.
Click Add role.
Enter a Name and Description for the new role.
Select a Permission set for the role.
Select an Access scope for the role.
Click Save.

Additional resources

Assigning a role to a user or a group

You can use the RHACS portal to assign roles to a user or a group.

Procedure

On the RHACS portal, navigate to Platform Configuration → Access Control.
From the list of authentication providers, select the authentication provider.
Click Edit minimum role and rules.
Under the Rules section, click Add new rule.
For Key, select one of the values from userid, name, email or group.
For Value, enter the value of the user ID, name, email address or group based on the key you selected.
Click the Role drop-down menu and select the role you want to assign.
Click Save.

You can repeat these instructions for each user or group and assign different roles.

System permission sets

Red Hat Advanced Cluster Security for Kubernetes includes some default system permission sets that you can apply to roles. You can also create custom permission sets as required.

Permission set	Description
Admin	Provides read and write access to all resources.
Analyst	Provides read-only access for all resources.
Continuous Integration	This permission set is targeted for CI (continuous integration) systems and includes the permissions required to enforce deployment policies.
None	No read and write permissions are allowed for any resource.
Sensor Creator	Provides permissions for resources that are required to create Sensors in secured clusters.

Permission set

Description

Admin

Provides read and write access to all resources.

Analyst

Provides read-only access for all resources.

Continuous Integration

This permission set is targeted for CI (continuous integration) systems and includes the permissions required to enforce deployment policies.

None

No read and write permissions are allowed for any resource.

Sensor Creator

Provides permissions for resources that are required to create Sensors in secured clusters.

Viewing the permissions for a system permission set

You can view the permissions for a system permission set in the RHACS portal.

Procedure

On the RHACS portal, navigate to Platform Configuration → Access control.
Select Permission sets.
Click on one of the permission sets to view its details. The details page shows a list of resources and their permissions for the selected permission set.

You cannot modify permissions for a system permission set.

Creating a custom permission set

You can create new permission sets from the Access Control view.

Prerequisites

You must have the Admin role, or a role with the permission set with read and write permissions for the AuthProvider and Role resources to create, modify, and delete permission sets.

Procedure

On the RHACS portal, navigate to Platform Configuration → Access control.
Select the Permission sets tab.
Click Add permission set.
Enter a Name and Description for the new permission set.

For each resource, under the Access level column, select one of the permissions from No access, Read access, Read and Write access.

If you are configuring a permission set for users, you must grant read-only permissions for the following resources:
- Alert
- Cluster
- Deployment
- Image
- NetworkPolicy
- NetworkGraph
- Policy
- Secret
These permissions are pre-selected when you create a new permission set.
If you do not grant these permissions, users will experience issues with viewing pages in the RHACS portal.

Click Save.

System access scopes

Red Hat Advanced Cluster Security for Kubernetes includes some default system access scopes that you can apply on roles. You can also create custom access scopes as required.

Acces scope	Description
Unrestricted	Provides access to all clusters and namespaces that Red Hat Advanced Cluster Security for Kubernetes monitors.
Deny All	Provides no access to any Kubernetes and OpenShift Container Platform resources.

Acces scope

Description

Unrestricted

Provides access to all clusters and namespaces that Red Hat Advanced Cluster Security for Kubernetes monitors.

Deny All

Provides no access to any Kubernetes and OpenShift Container Platform resources.

Viewing the details for a system access scope

You can view the Kubernetes and OpenShift Container Platform resources that are allowed and not allowed for an access scope in the RHACS portal.

Procedure

On the RHACS portal, navigate to Platform Configuration → Access control.
Select Access scopes.
Click on one of the access scopes to view its details. The details page shows a list of clusters and namespaces, and which ones are allowed for the selected access scope.

You cannot modify allowed resources for a system access scope.

Creating a custom access scope

You can create new access scopes from the Access Control view.

Prerequisites

You must have the Admin role, or a role with the permission set with read and write permissions for the AuthProvider and Role resources to create, modify, and delete permission sets.

Procedure

On the RHACS portal, navigate to Platform Configuration → Access control.
Select the Access scope tab.
Click Add access scope.
Enter a Name and Description for the new access scope.

Under the Allowed resources section:

Use the Cluster filter and Namespace filter boxes to filter the list of clusters and namespaces visible in the list.
Expand the <Cluster_name> to see the list of namespaces in that cluster.

Turn on the toggle under the Manual selection column for a cluster to allow access to all namespaces in that cluster.

Access to a specific cluster provides users with access to the following resources within the scope of the cluster:

OpenShift Container Platform or Kubernetes cluster metadata and security information
Compliance information for authorized clusters
Node metadata and security information
Access to all namespaces in that cluster and their associated security information

Turn on the toggle under the Manual selection column for a namespace to allow access to that namespace.

Access to a specific namespace gives access to the following information within the scope of the namespace:

Alerts and violations for deployments
Vulnerability data for images
Deployment metadata and security information
Role and user information
Network graph, policy, and baseline information for deployments
Process information and process baseline configuration
Prioritized risk information for each deployment

If you want to allow access to clusters and namespaces based on labels, click Add label selector under the Label selection rules section. Then click Add rules to specify Key and Value pairs for the label selector. You can specify labels for clusters and namespaces.
Click Save.

Resource definitions

Red Hat Advanced Cluster Security for Kubernetes includes multiple resources. The following table lists the resources and describes the actions that users can perform with the read or write permission.

Resource	Read permission	Write permission
APIToken	List existing API tokens.	Create new API tokens or revoke existing tokens.
Alert	View existing policy violations.	Resolve or edit policy violations.
AuthPlugin	View existing Authentication plugins	Modify these configurations. (Local administrator only.)
AuthProvider	View existing configurations for single sign-on.	Modify these configurations.
BackupPlugins	View existing integrations with automated backup systems such as AWS S3.	Modify these configurations.
CVE	Internal use only	Internal use only
Cluster	View existing secured clusters.	Add new secured clusters and modify or delete existing clusters.
Compliance	View compliance standards and results.	N/A
ComplianceRunSchedule	View scheduled compliance runs.	Create, modify, or delete scheduled compliance runs.
ComplianceRuns	View recent compliance runs and their completion status.	Trigger compliance runs.
Config	View options for data retention, security notices, and other related configurations.	Modify these configurations.
DebugLogs	View the current logging verbosity level in Red Hat Advanced Cluster Security for Kubernetes components.	Modify the logging level.
Deployment	View deployments (workloads) in secured clusters.	N/A
Detection	Check build-time policies against images or deployment YAML.	N/A
Group	View the existing RBAC rules that match user metadata to Red Hat Advanced Cluster Security for Kubernetes roles.	Create, modify, or delete configured RBAC rules.
Image	View images, their components, and their vulnerabilities.	N/A
ImageComponent	Internal use only	Internal use only
ImageIntegration	List existing image registry integrations.	Create, edit, or delete image registry integrations.
ImbuedLogs	Internal use only	Internal use only
Indicator	View process activity in deployments.	N/A
K8sRole	View roles for Kubernetes role-based access control in secured clusters.	N/A
K8sRoleBinding	View role bindings for Kubernetes role-based access control in secured clusters.	N/A
K8sSubject	View users and groups for Kubernetes role-based access control in secured clusters.	N/A
Licenses	View the status of the existing license for Red Hat Advanced Cluster Security for Kubernetes.	Upload a new license key.
Namespace	View existing Kubernetes namespaces in secured clusters.	N/A
NetworkGraph	View active and allowed network connections in secured clusters.	N/A
NetworkPolicy	View existing network policies in secured clusters and simulate changes.	Apply network policy changes in secured clusters.
Node	View existing Kubernetes nodes in secured clusters.	N/A
Notifier	View existing integrations for notification systems like email, Jira, or webhooks.	Create, modify, or delete these integrations.
Policy	View existing system policies.	Create, modify, or delete system policies.
ProbeUpload	Read manifests for the uploaded probe files.	Upload support packages to Central.
ProcessWhitelist	View process baselines.	Add or remove processes from baselines.
Risk	View Risk results.	N/A
Role	View existing Red Hat Advanced Cluster Security for Kubernetes RBAC roles and their permissions.	Add, modify, or delete roles and their permissions.
ScannerBundle	Download the scanner bundle.	N/A
ScannerDefinitions	List existing image scanner integrations.	Create, modify, or delete image scanner integrations.
Secret	View metadata about secrets in secured clusters.	N/A
SensorUpgradeConfig	Check the status of automatic upgrades.	Disable or enable automatic upgrades for secured clusters.
ServiceAccount	List Kubernetes service accounts in secured clusters.	N/A
ServiceIdentity	View metadata about Red Hat Advanced Cluster Security for Kubernetes service-to-service authentication.	Revoke or reissue service-to-service authentication credentials.
User	View users that have accessed your Red Hat Advanced Cluster Security for Kubernetes instance, including the metadata that the authentication provider provides about them.	N/A

Resource

Read permission

Write permission

APIToken

List existing API tokens.

Create new API tokens or revoke existing tokens.

Alert

View existing policy violations.

Resolve or edit policy violations.

AuthPlugin

View existing Authentication plugins

Modify these configurations. (Local administrator only.)

AuthProvider

View existing configurations for single sign-on.

Modify these configurations.

BackupPlugins

View existing integrations with automated backup systems such as AWS S3.

Modify these configurations.

CVE

Internal use only

Cluster

View existing secured clusters.

Add new secured clusters and modify or delete existing clusters.

Compliance

View compliance standards and results.

N/A

ComplianceRunSchedule

View scheduled compliance runs.

Create, modify, or delete scheduled compliance runs.

ComplianceRuns

View recent compliance runs and their completion status.

Trigger compliance runs.

Config

View options for data retention, security notices, and other related configurations.

Modify these configurations.

DebugLogs

View the current logging verbosity level in Red Hat Advanced Cluster Security for Kubernetes components.

Modify the logging level.

Deployment

View deployments (workloads) in secured clusters.

N/A

Detection

Check build-time policies against images or deployment YAML.

N/A

Group

View the existing RBAC rules that match user metadata to Red Hat Advanced Cluster Security for Kubernetes roles.

Create, modify, or delete configured RBAC rules.

Image

View images, their components, and their vulnerabilities.

N/A

ImageComponent

Internal use only

ImageIntegration

List existing image registry integrations.

Create, edit, or delete image registry integrations.

ImbuedLogs

Internal use only

Indicator

View process activity in deployments.

N/A

K8sRole

View roles for Kubernetes role-based access control in secured clusters.

N/A

K8sRoleBinding

View role bindings for Kubernetes role-based access control in secured clusters.

N/A

K8sSubject

View users and groups for Kubernetes role-based access control in secured clusters.

N/A

Licenses

View the status of the existing license for Red Hat Advanced Cluster Security for Kubernetes.

Upload a new license key.

Namespace

View existing Kubernetes namespaces in secured clusters.

N/A

NetworkGraph

View active and allowed network connections in secured clusters.

N/A

NetworkPolicy

View existing network policies in secured clusters and simulate changes.

Apply network policy changes in secured clusters.

Node

View existing Kubernetes nodes in secured clusters.

N/A

Notifier

View existing integrations for notification systems like email, Jira, or webhooks.

Create, modify, or delete these integrations.

Policy

View existing system policies.

Create, modify, or delete system policies.

ProbeUpload

Read manifests for the uploaded probe files.

Upload support packages to Central.

ProcessWhitelist

View process baselines.

Add or remove processes from baselines.

Risk

View Risk results.

N/A

Role

View existing Red Hat Advanced Cluster Security for Kubernetes RBAC roles and their permissions.

Add, modify, or delete roles and their permissions.

ScannerBundle

Download the scanner bundle.

N/A

ScannerDefinitions

List existing image scanner integrations.

Create, modify, or delete image scanner integrations.

Secret

View metadata about secrets in secured clusters.

N/A

SensorUpgradeConfig

Check the status of automatic upgrades.

Disable or enable automatic upgrades for secured clusters.

ServiceAccount

List Kubernetes service accounts in secured clusters.

N/A

ServiceIdentity

View metadata about Red Hat Advanced Cluster Security for Kubernetes service-to-service authentication.

Revoke or reissue service-to-service authentication credentials.

User

View users that have accessed your Red Hat Advanced Cluster Security for Kubernetes instance, including the metadata that the authentication provider provides about them.

N/A