Create grants¶
MKE administrators create grants to control how users and organizations access
resource sets. A grant defines user permissions to access resources. Each grant
associates one subject with one role and one resource set. For example, you can
grant the Prod Team
Restricted Control
over services in the
/Production
collection.
The following is a common workflow for creating grants:
create-manually.
Define custom roles (or use defaults) by adding permitted API operations per type of resource.
Group cluster resources into Swarm collections or Kubernetes namespaces.
Create grants by combining subject, role, and resource set.
Note
This section assumes that you have created the relevant objects for the grant, including the subject, role, and resource set (Kubernetes namespace or Swarm collection).
To create a Kubernetes grant:
Log in to the MKE web UI.
Navigate to Access Control > Grants.
Select the Kubernetes tab and click Create Role Binding.
Under Subject, select Users, Organizations, or Service Account.
For Users, select the user from the pull-down menu.
For Organizations, select the organization and, optionally, the team from the pull-down menu.
For Service Account, select the namespace and service account from the pull-down menu.
Click Next to save your selections.
Under Resource Set, toggle the switch labeled Apply Role Binding to all namespaces (Cluster Role Binding).
Click Next.
Under Role, select a cluster role.
Click Create.
To create a Swarm grant:
Log in to the MKE web UI.
Navigate to Access Control > Grants.
Select the Swarm tab and click Create Grant.
Under Subject, select Users or Organizations.
For Users, select a user from the pull-down menu.
For Organizations, select the organization and, optionally, the team from the pull-down menu.
Click Next to save your selections.
Under Resource Set, click View Children until the required collection displays.
Click Select Collection next to the required collection.
Click Next.
Under Role, select a role type from the drop-down menu.
Click Create.
Note
MKE places new users in the docker-datacenter
organization by default.
To apply permissions to all MKE users, create a grant with the
docker-datacenter
organization as a subject.