#Create Kubernetes Roles

Starting from ACP 4.2, custom permissions are delivered through native Kubernetes roles. Use the Kubernetes Roles page (located under Users > Platform Roles > Kubernetes Roles) to create or manage Role and ClusterRole objects in the currently selected cluster.

#Prerequisites

• You are assigned a platform role that grants access to the Kubernetes Roles feature.
• You have selected the target cluster in the global cluster switcher.
• The cluster already contains any namespaces that your role will scope to.

#Create a Role or ClusterRole

1. In the left navigation bar, click Users > Platform Roles > Kubernetes Roles.
2. Click Create Role.
3. In the drawer:
   • Enter the Name (must satisfy Kubernetes naming rules).
   • Choose the Type (Role or ClusterRole).
   • If you selected Role, pick the Namespace that scopes the permissions.
4. Configure rules by adding one or more entries with:
   • API Groups
   • Resources
   • Resource Names (optional)
   • Verbs (get, list, watch, create, update, patch, delete)
5. Click Create.

The role is created directly inside the cluster and becomes available for RoleBinding operations immediately.

#Edit Role YAML (Optional)

1. Open the Kubernetes Roles tab and click the role name.
2. On the YAML tab, click Edit.
3. Update fields such as labels, annotations, or rules.
4. Click Save to apply the changes.

#Create RoleBindings

To grant the newly created role to users or groups:

1. While viewing a role, switch to the RoleBindings tab.
2. Click Create RoleBindings.
3. Provide:
   • Name
   • Binding Type (RoleBinding or ClusterRoleBinding — only RoleBinding is available when the source is a namespace-scoped role)
   • Namespace (for RoleBinding)
   • Subjects (User, Group, or ServiceAccount with the corresponding name)
4. Click Create.

Alternatively, open the Users or User Groups page, switch to the Kubernetes Roles tab, and create bindings directly from the user perspective.

#Verify

Use one of the following methods to confirm the role exists:

kubectl get role <role-name> -n <namespace>
kubectl get clusterrole <clusterrole-name>

Or refresh the Kubernetes Roles list and use the built-in search (by name or label) to locate the role.