Kubernetes roles and bindings

Role-Based Access Control is only available in Portainer Business Edition.

When managing a Kubernetes environment with Portainer, the Role-Based Access Control (RBAC) configuration is based on two components:

• Kubernetes' cluster roles and namespace roles (which restrict access to Kubernetes itself)

• Portainer's authorization flags (which restrict access to Portainer's functionality)

The following tables provide a reference for how our Portainer roles map to capabilities within Kubernetes.

Role Allocations

Portainer Role	Cluster Role Binding	Namespace Role Binding
Environment Administrator	cluster-admin (k8s system)	N/A
Operator	portainer-operator, portainer-helpdesk	portainer-view (all non-system namespaces)
User	portainer-basic	portainer-edit, portainer-view (only assigned namespaces)
Helpdesk	portainer-helpdesk	portainer-view (all non-system namespaces)
Read-Only	portainer-basic	portainer-view (only assigned namespaces)

Cluster Roles

portainer-basic

API Group	Resources	Verbs
(Empty)	namespaces, nodes	get, list
storage.k8s.io	storageclasses	list
metrics.k8s.io	namespaces, pods, nodes	get, list
networking.k8s.io	ingressclasses	list

portainer-helpdesk

API Group	Resources	Verbs
(Empty)	componentstatuses, endpoints, events, namespaces, nodes	get, list, watch
storage.k8s.io	storageclasses	get, list, watch
networking.k8s.io	ingresses	get, watch
networking.k8s.io	ingressclasses	list
metrics.k8s.io	pods, nodes, nodes/stats, namespace	get, list, watch

portainer-operator

API Group	Resources	Verbs
(Empty)	configmaps	update
(Empty)	pods	delete
apps	daemonsets, deployments, statefulsets	patch
metrics.k8s.io	pods, nodes, nodes/stats, namespaces	get, list, watch

Namespace Roles

portainer-edit

portainer-view

Portainer Access Restrictions

Community Edition

The following tables cover the two roles available in Portainer Community Edition (CE). Note there is no Portainer access restriction in Portainer CE.

portainer-cr-user