Help & Documentation>Tencent Kubernetes Engine

Configuring a Sub-account's Administrative Permissions to a Single TKE Cluster

Last updated: 2023-09-15 15:43:25

On this page:

Scenario

You can grant a user the permissions to view and use specific resources in the TKE console by using a CAM policy. This document describes how to configure the CAM policy of a single cluster in the console.

Instructions

Configuring full read/write permission for a single cluster

1. Log in to the CAM console.
2. In the left sidebar, click Policies to go to the policy management page.
3. Click Create Custom Policy and select Create by Policy Syntax.
4. Select the "Blank Template" type and click Next.
5. Enter a custom policy name and replace "Edit policy content" with the following content.
{
 "version": "2.0",
 "statement": [
     {
         "action": [
             "tke:*"
         ],
         "resource": [
             "qcs::tke:sh::cluster/cls-XXXXXXX",
             "qcs::cvm:sh::instance/*"
         ],
         "effect": "allow"
     },
     {
         "action": [
             "cvm:*"
         ],
         "resource": "*",
         "effect": "allow"
     },
     {
         "action": [
             "vpc:*"
         ],
         "resource": "*",
         "effect": "allow"
     },
     {
         "action": [
             "clb:*"
         ],
         "resource": "*",
         "effect": "allow"
     },
     {
         "action": [
             "monitor:*",
             "cam:ListUsersForGroup",
             "cam:ListGroups",
             "cam:GetGroup",
             "cam:GetRole"
         ],
         "resource": "*",
         "effect": "allow"
     }
 ]
}
6. In "Edit Policy Content", replace qcs::tke:sh::cluster/cls-XXXXXXX with the cluster in the specified region you want to grant permissions to. For example, if you need to grant full read/write permissions to the cls-69z7ek9l cluster in the Guangzhou region, change qcs::tke:sh::cluster/cls-XXXXXXX to "qcs::tke:gz::cluster/cls-69z7ek9l".
Note
Replace with the ID of the cluster in the specified region for which you want to grant permissions. If you want to allow sub-accounts to scale the cluster, you also need to configure the user payment permission for the sub-accounts.
7. Click Create Policy to complete the configuration of full read/write permissions for a single cluster.

Configuring read-only permission for a single cluster

1. Log in to the CAM console.
2. In the left sidebar, click Policies to go to the policy management page.
3. Click Create Custom Policy and select Create by Policy Syntax.
4. Select the "Blank Template" type and click Next.
5. Enter a custom policy name and replace "Edit policy content" with the following content.
{
 "version": "2.0",
 "statement": [
     {
         "action": [
             "tke:Describe*",
             "tke:Check*"
         ],
         "resource": "qcs::tke:gz::cluster/cls-1xxxxxx",
         "effect": "allow"
     },
     {
         "action": [
             "cvm:Describe*",
             "cvm:Inquiry*"
         ],
         "resource": "*",
         "effect": "allow"
     },
     {
         "action": [
             "vpc:Describe*",
             "vpc:Inquiry*",
             "vpc:Get*"
         ],
         "resource": "*",
         "effect": "allow"
     },
     {
         "action": [
             "clb:Describe*"
         ],
         "resource": "*",
         "effect": "allow"
     },
     {
         "effect": "allow",
         "action": [
             "monitor:*",
             "cam:ListUsersForGroup",
             "cam:ListGroups",
             "cam:GetGroup",
             "cam:GetRole"
         ],
         "resource": "*"
     }
 ]
}
6. In "Edit Policy Content", modify qcs::tke:gz::cluster/cls-1xxxxxx to the cluster in the specified region you want to grant permissions to. For example, if you need to grant read-only permission to the cls-19a7dz9c cluster in the Beijing region, change qcs::tke:gz::cluster/cls-1xxxxxx to qcs::tke:bj::cluster/cls-19a7dz9c.
7. Click Create Policy to complete the configuration of read-only permissions for a single cluster.
中国站 - English