Manage user roles through Keycloak

Mirantis Container Cloud creates the IAM roles in scopes. For each application type, such as kaas, k8s, or sl, Container Cloud creates a set of roles such as @admin, @cluster-admin, @reader, @writer, @operator.

Depending on the role, you can perform specific operations in a Container Cloud cluster. For example:

  • With the m:kaas@writer role, you can create a project using the Container Cloud web UI. The corresponding project-specific roles will be automatically created in Keycloak by iam-controller.

  • With the m:kaas* roles, you can download the kubeconfig of the management cluster.


The semantic structure of role naming in Container Cloud is as follows:

m:<appType>:<namespaceName>:<clusterName>@<roleName>
Role naming semantic structure

Element

Description

m

Prefix for all IAM roles in Container Cloud

<appType>

Application type:

  • kaas for the management cluster and Container Cloud API

  • k8s for the regional and managed cluster

  • sl for StackLight

<namespaceName>

Namespace name, is optional depending on the application type

<clusterName>

Managed cluster name, is optional depending on the application type

@

Delimiter between a scope and role

<roleName>

Short name of a role within a scope


This section outlines the IAM roles and scopes structure in Container Cloud and role assignment to users using the Keycloak Admin Console.