You can use role-based access control (RBAC) to create and manage groups of users. Assigning roles to groups allows you to manage access for users as a group.

Roles assigned using RBAC apply to all clusters within your organization rather than a specific cluster. RBAC is available in the Identity & Access Management menu in the Settings gear of the Red Hat Hybrid Cloud Console.

Note

Only organization administrators can manage and assign roles to groups using role-based access control (RBAC).

Organization administrators can change the default access permissions for the users within their organization. Role-based access control defaults to two groups. The default member group has all users within the organization as members. The default admin group has all users with the organization administrator role as members.

OCM access policies are explicitly assigned through role assignments to these default groups. In this way, the existing RBAC policies are no longer explicit and customers can modify them. Organization administrators are able to remove the role assignments from the default groups to remove default permissions from all users. They can then assign these roles selectively to specific users or groups to manage the permissions for users within their organization.

Important

Removing all OCM roles from the default groups results in users losing the ability to view and provision clusters. It is recommended to create groups of users and assign specific roles to these groups before revoking access from the default groups.

A scope governs the level that the role is applied or granted to a user or a group. There are two scopes used within OCM, cluster scope and organization scope. Roles can be granted to a user or a group at either a cluster scope or at the organization scope.

A role granted at the cluster scope lets the user perform the allowed action for that specific cluster only.

A role granted at the organization scope lets the user perform the allowed action across all clusters in the organization.

Users can create and manage groups and group membership for users within the organization through the RBAC service within the Red Hat Hybrid Cloud Console.

Users can assign a role to a group by using RBAC. Any role assigned with RBAC is at the organization level and applies to all clusters within the organization.

Users can assign a role to a user in OCM for a particular cluster. They do this from within the context of a particular cluster and this role assignment is at the cluster scope. For the steps to grant a role to an individual user on a specific cluster, see Additional resources.

For more information about using RBAC within Red Hat Hybrid Cloud Console, read the User Access Configuration Guide for Role-based Access Control (RBAC) in Additional resources.

OCM-specific roles

When adding roles to created groups, you can add OCM-specific roles. Use these OCM-specific roles to give users or groups in your organization more precise access to clusters. When adding roles inside your group, use the search box and type "OCM" to find all the OCM-specific roles you can add.

The roles you can add are:

• Cluster viewer: This role allows a user to view a cluster.
• Cluster provisioner: This role allows a user to provision a cluster.
• Cluster editor: This role allows a user to manage and delete a cluster.
• Organization administrator: This role allows a user to perform all tasks within OCM for all clusters. Users are granted organization administrator permissions only within the OCM service and this does not apply to any other Red Hat service.
• IdP editor: This role allows a user to manage identity providers for a cluster.
• Machine pool editor: This role allows a user to create, scale, and delete machine pools within a cluster.

The Cluster Owner role is not included in this list. Cluster Owner is assigned automatically to the user who creates a cluster, or to a user who accepts an ownership transfer, rather than granted through role assignment. See Additional resources for more information about the Cluster Owner role.

For more detailed information about the process of adding roles to created groups, read Additional resources.