Default cluster roles
Red Hat OpenShift Container Platform includes a set of default cluster roles that you can bind to users and groups cluster-wide or locally.
|
|
It is not recommended to manually modify the default cluster roles. Modifications to these system roles can prevent a cluster from functioning properly. |
| Default cluster role | Description |
|---|---|
|
A project manager. If used in a local binding, an |
|
A user that can get basic information about projects and users. |
|
A super-user that can perform any action in any project. When bound to a user with a local binding, they have full control over quota and every action on every resource in the project. |
|
A user that can get basic cluster status information. |
|
A user that can get or view most of the objects but cannot modify them. |
|
A user that can modify most objects in a project but does not have the power to view or modify roles or bindings. |
|
A user that can create their own projects. |
|
A user who cannot make any modifications, but can see most objects in a project. They cannot view or modify roles or bindings. |
Be mindful of the difference between local and cluster bindings. For example,
if you bind the cluster-admin role to a user by using a local role binding,
it might appear that this user has the privileges of a cluster administrator.
This is not the case. Binding the cluster-admin to a user in a project
grants super administrator privileges for only that project to the user. That user has the permissions of the cluster role admin, plus a few additional permissions like the ability to edit rate limits, for that project. This binding can be confusing via the web console UI, which does not list cluster role bindings that are bound to true cluster administrators. However, it does list local role bindings that you can use to locally bind cluster-admin.
The relationships between cluster roles, local roles, cluster role bindings, local role bindings, users, groups and service accounts are illustrated below.
|
|
The |