Skip to main content

Configuring role-based permissions

You can configure role-based access control (RBAC) for your Red Hat build of Kueue deployment to control which users can create specific Red Hat build of Kueue objects.

Cluster roles​

The Red Hat build of Kueue Operator deploys kueue-batch-admin-role and kueue-batch-user-role cluster roles by default.

kueue-batch-admin-role
This cluster role includes the permissions to manage cluster queues, local queues, workloads, and resource flavors.
kueue-batch-user-role
This cluster role includes the permissions to manage jobs and to view local queues and workloads.

Configuring permissions for batch administrators​

You can configure permissions for batch administrators by binding the kueue-batch-admin-role cluster role to a user or group of users.

Prerequisites

  • The Red Hat build of Kueue Operator is installed on your cluster.
  • You have cluster administrator permissions.
  • You have installed the OpenShift CLI (oc).

Procedure

  1. Create a ClusterRoleBinding object as a YAML file:

    Example ClusterRoleBinding object
    apiVersion: rbac.authorization.k8s.io/v1
    kind: ClusterRoleBinding
    metadata:
      name: kueue-admins
    subjects:
    - kind: User
      name: admin@example.com
      apiGroup: rbac.authorization.k8s.io
    roleRef:
      kind: ClusterRole
      name: kueue-batch-admin-role
      apiGroup: rbac.authorization.k8s.io

    where:

    metadata.name
    Specifies the name of the ClusterRoleBinding object.
    subjects
    Specifies the user or group of users you want to provide user permissions for.
    roleRef
    Specifies the kueue-batch-admin-role cluster role.

  2. Apply the ClusterRoleBinding object:

    $ oc apply -f <filename>.yaml

Verification

  • You can verify that the ClusterRoleBinding object was applied correctly by running the following command and verifying that the output contains the correct information for the kueue-batch-admin-role cluster role:

    $ oc describe clusterrolebinding.rbac
    Example output
    ...
    Name:         kueue-batch-admin-role
    Labels:       app.kubernetes.io/name=kueue
    Annotations:  <none>
    Role:
      Kind:  ClusterRole
      Name:  kueue-batch-admin-role
    Subjects:
      Kind            Name                      Namespace
      ----            ----                      ---------
      User            admin@example.com         admin-namespace
    ...

Configuring permissions for users​

You can configure permissions for Red Hat build of Kueue users by binding the kueue-batch-user-role cluster role to a user or group of users.

Prerequisites

  • The Red Hat build of Kueue Operator is installed on your cluster.
  • You have cluster administrator permissions.
  • You have installed the OpenShift CLI (oc).

Procedure

  1. Create a RoleBinding object as a YAML file:

    Example ClusterRoleBinding object
    apiVersion: rbac.authorization.k8s.io/v1
    kind: RoleBinding
    metadata:
      name: kueue-users
      namespace: user-namespace
    subjects:
    - kind: Group
      name: team-a@example.com
      apiGroup: rbac.authorization.k8s.io
    roleRef:
      kind: ClusterRole
      name: kueue-batch-user-role
      apiGroup: rbac.authorization.k8s.io

    where:

    metadata.name
    Specifies the name of the RoleBinding object.
    metadata.namespace
    Specifies the namespace the RoleBinding object applies to.
    subjects
    Specifies the user or group of users you want to provide user permissions for.
    roleRef
    Specifies the kueue-batch-user-role cluster role.

  2. Apply the RoleBinding object:

    $ oc apply -f <filename>.yaml

Verification

  • You can verify that the RoleBinding object was applied correctly by running the following command and verifying that the output contains the correct information for the kueue-batch-user-role cluster role:

    $ oc describe rolebinding.rbac
    Example output
    ...
    Name:         kueue-users
    Labels:       app.kubernetes.io/name=kueue
    Annotations:  <none>
    Role:
      Kind:  ClusterRole
      Name:  kueue-batch-user-role
    Subjects:
      Kind            Name                      Namespace
      ----            ----                      ---------
      Group           team-a@example.com        user-namespace
    ...

Additional resources