You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
@@ -11,46 +12,131 @@ import NavStep from "@site/src/components/NavStep";
11
12
importLabelfrom"@site/src/components/Label";
12
13
importButtonfrom"@site/src/components/Button";
13
14
14
-
Access to a virtual cluster is automatically granted to the following users:
15
+
# Management access to the virtual cluster
16
+
17
+
Management access controls who can view, edit, or configure the virtual cluster object in the platform. It is separate from in-cluster access, which governs permissions inside the Kubernetes environment of the virtual cluster.
18
+
19
+
## Default management access
20
+
21
+
By default, the following users and roles have management access to a virtual cluster:
22
+
23
+
***Global administrators** – Access all virtual clusters on the platform.
24
+
***Project administrators** – Access all virtual clusters within their assigned projects.
25
+
***Virtual cluster owners** – Automatically receive access to the specific virtual cluster they create or own.
26
+
***Users with physical cluster permissions** – Any user or team with RBAC permissions on the underlying (physical) cluster and the `use` verb on the `virtualclusterinstances` resource in the `management.loft.sh` API group can access virtual clusters running on that cluster.
27
+
28
+
## Grant management access using the UI
29
+
30
+
To extend access to additional users or teams, use the **Permissions** section for each virtual cluster in the platform UI:
31
+
32
+
<Flowid="grant-management-access">
33
+
<Step>
34
+
Open the **Project** dropdown in the top-left corner and select the project that contains the virtual cluster.
35
+
</Step>
36
+
<Step>
37
+
Click **Virtual Clusters** in the sidebar to view the list.
38
+
</Step>
39
+
<Step>
40
+
Click **Edit** on the target virtual cluster.
41
+
</Step>
42
+
<Step>
43
+
Open the **Permissions** tab.
44
+
</Step>
45
+
<Step>
46
+
Use the **Add permission to** field to select the user or team.
47
+
</Step>
48
+
<Step>
49
+
If the user or team does not appear, confirm that they have access to the project.
50
+
</Step>
51
+
<Step>
52
+
Choose a **ClusterRole** to assign (e.g., `cluster-admin`, `edit`, or `view`). This role determines the user's Kubernetes permissions inside the virtual cluster.
53
+
</Step>
54
+
<Step>
55
+
Click **Save changes**.
56
+
</Step>
57
+
</Flow>
58
+
59
+
The platform grants the selected user or team management access to the virtual cluster object.
15
60
16
-
1.**Global Admins**: They have access to **all** virtual clusters in the platform.
17
-
2.**Project Admins**: They have access to **all** virtual clusters within the project.
18
-
2.**Virtual Cluster Owners**: They have access to the specific virtual cluster.
19
-
3.**Users with Physical Cluster Permissions**: Every user or team within the physical cluster that has the RBAC permission on the resource `virtualclusterinstances` in the API group `management.loft.sh` for the verb `use` can access any virtual cluster.
61
+
## vCluster roles
20
62
21
-
In order to extend access to other users or teams, you can edit the permissions for the virtual cluster.
63
+
vCluster roles define what users and teamscan do inside the virtual cluster. Kubernetes RBAC governs this access.
22
64
23
-
##How does access within a virtual cluster work?
65
+
### Default cluster role assignment
24
66
25
-
Each virtual cluster has a default cluster role when adding a user or team to give them access to the virtual cluster. The default cluster role is `cluster-admin`. The default cluster role can be changed in the virtual cluster template or on the virtual cluster object.
67
+
By default, the platform assigns the `cluster-admin` Kubernetes ClusterRole to users with virtual cluster access. This role grants full access in all namespaces.
26
68
27
-
Besides the default rule you can define extra rules on the virtual cluster or template that map a user or team to another cluster role. As soon as one rule matches a user or team, the default cluster role is not assigned. If multiple rules match a user, all the cluster roles defined in the rules are assigned.
69
+
### Change the default cluster role
28
70
29
-
## Grant Access to a virtual cluster
71
+
Administrators can override the default role in the virtual cluster template or in the virtual cluster configuration.
30
72
31
-
<Flowid="vcluster-share-ui">
73
+
<Flowid="change-default-role">
74
+
<Step>
75
+
Open the virtual cluster or template configuration.
76
+
</Step>
77
+
<Step>
78
+
Locate the **Default Cluster Role** field.
79
+
</Step>
32
80
<Step>
33
-
From the project drop-down menu (top left corner), select the project to find your virtual cluster.
81
+
Enter a more limited role such as `edit` or `view`.
34
82
</Step>
35
83
<Step>
36
-
Click on <NavStep>Virtual Clusters</NavStep>.
84
+
Save the updated configuration.
37
85
</Step>
86
+
</Flow>
87
+
88
+
### Define custom role mapping rules
89
+
90
+
Use mapping rules to assign specific users or teams to specific cluster roles.
91
+
92
+
- A user or team that matches at least one rule does **not** receive the default role.
93
+
- If multiple rules match, the system assigns all specified roles.
94
+
- If no rule matches, the system assigns the default role.
95
+
96
+
<Flowid="configure-role-mapping">
38
97
<Step>
39
-
Click on <Label>Edit</Label> on the virtual cluster that you want to edit.
98
+
Open the virtual cluster or template YAML configuration.
40
99
</Step>
41
100
<Step>
42
-
Click on the <NavStep>Permissions</NavStep>.
43
-
</Step>
101
+
Locate or create the `access.rules` section.
102
+
</Step>
44
103
<Step>
45
-
Click the <Label>Add Permission to"</Label> input and select the user or team to add. If you don't see the user or team you want to grant access in there,
46
-
confirm that they have project access.
104
+
List `subjects` for each user or team.
47
105
</Step>
48
106
<Step>
49
-
Specify the <Label>Cluster Role</Label> you want to assign the user or team.
107
+
Define the `clusterRole` for each rule.
50
108
</Step>
51
109
<Step>
52
-
Once all virtual options have been specified, click the{""}
53
-
<Button>Save Changes</Button>.
110
+
Save and apply the configuration.
54
111
</Step>
55
112
</Flow>
56
113
114
+
#### Example
115
+
116
+
```yaml
117
+
apiVersion: management.loft.sh/v1
118
+
kind: VirtualCluster
119
+
metadata:
120
+
name: example-vcluster
121
+
spec:
122
+
defaultClusterRole: cluster-admin
123
+
access:
124
+
rules:
125
+
- subjects:
126
+
- kind: User
127
+
name: Person 1
128
+
clusterRole: edit
129
+
- subjects:
130
+
- kind: Team
131
+
name: DevTeam
132
+
clusterRole: view
133
+
```
134
+
135
+
In this example:
136
+
137
+
- Person 1 receives the `edit` role.
138
+
- DevTeam receives the `view` role.
139
+
- Person 1, if part of DevTeam, receives both roles.
140
+
- All other users default to `cluster-admin`.
141
+
142
+
Custom mapping rules allow more precise and secure access control inside the virtual cluster.
0 commit comments