Defining Tectonic user roles

Tectonic Console allows you to define Roles used to grant access to system, namespace or cluster-wide resources.

Each Role is composed of a set of rules, which defines the type of resource and access allowed the Role.

Creating Roles

From Administration > Roles, click Create Role to open a YAML template, which may be edited to create a new Role.

apiVersion: rbac.authorization.k8s.io/v1beta1
kind: Role
metadata:
  name: example
  namespace: default
rules:
  - apiGroups:
      - '' # empty quotes ('') indicate the core API group
    resources:
      - pods
    verbs:
      - get
      - watch
      - list

Once the Role is created, click its Name in the Roles page, then click Add Rule to open the Create Access Rule page.

From the Create Access Rule page, select:

Type of Access: actions that can be taken on Kubernetes resources are grouped into easy categories.

• Read-only: allows users to view, but not edit the listed resources.
• All: allows full access to all resources, including the ability to edit or delete.
• Custom: grants a user-defined set of access privileges, as selected from the complete list of actions.

Allowed Resources:

• Recommended: grants access to the default set of safe resources, as recommended by Tectonic.
• All Access: grants full access to all resources, including administrative resources.
• Custom: grants access to a user-defined set of resources, as selected from the Safe Resources, API Resources, and API Groups listed below.
• Non-resource URLs: grants access to API URLs that do not correspond to objects.

Default Roles in Tectonic

Tectonic inherits most of the cluster-wide roles from Kubernetes upstream. The default cluster-wide roles in Tectonic are:

For more information on these roles, see User-facing Roles in the Kubernetes documentation.

Assign Users to Roles

To grant users access to Roles, use a Role Binding.