--- title: "RBAC & Permissions" canonical: "https://kb.uconn.edu/space/IKB/28729671714/RBAC%20%26%20Permissions" format: markdown --- OpenShift uses Role-Based Access Control (RBAC) to manage who can do what within a project. This guide explains how permissions work, the built-in roles, and how to manage access for your team. > ![security-compliance-20260506-020459.png](media://1d2e0726-de8e-4696-8cd2-2af4fb2013f4) --- ## How RBAC Works RBAC connects three things: | Concept | Description | Example | | --- | --- | --- | | **User / Group** | Who is performing the action | `jdoe`, `ci-bot`, `dev-team` | | **Role** | What actions are allowed | `view`, `edit`, `admin` | | **RoleBinding** | Connects a user to a role in a specific project | "jdoe gets edit in my-project" | > **Key Point:** Permissions are scoped to a **project (namespace)**. Having `edit` in one project does not give you access to another. --- ## Built-in Roles | Role | Can View | Can Edit | Can Manage Users | Use Case | | --- | --- | --- | --- | --- | | **view** | Yes | No | No | Read-only access — monitoring, auditing | | **edit** | Yes | Yes | No | Developers — deploy, build, configure | | **admin** | Yes | Yes | Yes | Project owners — manage members & quotas | | **cluster-admin** | Everything | Everything | Everything | Platform team only (UConn ITS) | ### What Each Role Can Do **view** — List and inspect pods, deployments, services, routes, config maps, builds, and logs. Cannot create, modify, or delete anything. **edit** — Everything in `view`, plus create/update/delete pods, deployments, services, routes, config maps, secrets, builds, and PVCs. Cannot manage role bindings or project settings. **admin** — Everything in `edit`, plus manage role bindings (add/remove users), set resource quotas, and configure project-level settings. --- ## Managing Access via CLI ### View Current Permissions ```shell # Who has access to the current project? oc get rolebindings # Detailed view with subjects and roles oc describe rolebindings # Check what YOU can do oc auth can-i --list # Check if you can do a specific action oc auth can-i create deployments oc auth can-i delete pods ``` ### Grant Access to a User ```shell # Grant view (read-only) access oc adm policy add-role-to-user view jdoe # Grant edit (developer) access oc adm policy add-role-to-user edit jdoe # Grant admin access oc adm policy add-role-to-user admin jdoe ``` ### Remove Access ```shell # Remove a role from a user oc adm policy remove-role-from-user edit jdoe # Remove all roles from a user in this project oc adm policy remove-role-from-user view jdoe oc adm policy remove-role-from-user edit jdoe oc adm policy remove-role-from-user admin jdoe ``` ### Grant Access to a Group ```shell # Add an entire group oc adm policy add-role-to-group edit dev-team # Remove a group oc adm policy remove-role-from-group edit dev-team ``` --- ## Managing Access via Web Console 1. Go to **Home → Projects** and select your project. 2. Click **Project → RoleBindings** (or **Project access** in some versions). 3. Click **Create binding** to add a user. 4. Select the **Role** (view, edit, or admin). 5. Enter the **username** and click **Create**. --- ## Service Accounts Service accounts are non-human identities used by applications, CI/CD pipelines, and automated processes. ### Default Service Accounts Every project has these automatically: | Service Account | Purpose | | --- | --- | | `default` | Used by pods if no other SA is specified | | `builder` | Used by build pods (S2I, Docker builds) | | `deployer` | Used by deployment processes | ### Create a Custom Service Account ```shell # Create a service account for CI/CD oc create serviceaccount ci-bot # Grant it edit permissions oc adm policy add-role-to-user edit -z ci-bot # Generate a token (valid for 1 year) oc create token ci-bot --duration=8760h # Use in CI config: # oc login --token= --server=https://api.opp.its.uconn.edu:6443 ``` ### When to Use Service Accounts | Scenario | Service Account | Role | | --- | --- | --- | | CI/CD pipeline deploying to OpenShift | `ci-bot` | `edit` | | Monitoring tool reading metrics | `monitor-sa` | `view` | | Cross-project image pulling | `default` + image-puller role | `system:image-puller` | --- ## Common Permission Scenarios ### "I can't deploy / create resources" You likely have `view` instead of `edit`. Ask a project admin to upgrade your role: ```shell # Admin runs this: oc adm policy add-role-to-user edit ``` ### "I can't add team members" You need `admin` role, not just `edit`: ```shell # Another admin runs this: oc adm policy add-role-to-user admin ``` ### "My build can't pull images from another project" Grant the builder service account access to the other project's images: ```shell # Run in the SOURCE project (where the image lives) oc policy add-role-to-user system:image-puller \ system:serviceaccount::default ``` ### "Pod can't access a secret in another namespace" Pods can only access secrets within their own namespace. If you need shared config, duplicate the secret or use an external secret manager. --- ## Best Practices | Practice | Why | | --- | --- | | Use **edit** for developers, not **admin** | Principle of least privilege | | Create dedicated **service accounts** for CI/CD | Don't use personal tokens in pipelines | | Audit permissions regularly | Run `oc get rolebindings` periodically | | Remove access when people leave the project | Prevents stale permissions | | Use **groups** for teams | Easier to manage than individual users | | Never share the **cluster-admin** token | Contact UConn ITS for cluster-level changes | --- ## Quick Reference ```shell # View permissions oc get rolebindings # List all bindings oc auth can-i --list # What can I do? oc auth can-i create pods # Specific check # Grant roles oc adm policy add-role-to-user view jdoe # Read-only oc adm policy add-role-to-user edit jdoe # Developer oc adm policy add-role-to-user admin jdoe # Project admin # Remove roles oc adm policy remove-role-from-user edit jdoe # Service accounts oc create serviceaccount ci-bot oc adm policy add-role-to-user edit -z ci-bot oc create token ci-bot --duration=8760h ``` --- *UConn ITS Infrastructure Services — OpenShift Knowledge Base*