In some operational environments, administrators may wish to limit what certain users can/cannot do on the clusters. For example, in higher environments, it is common practice for administrators to only allow developer access to "kubectl" with "read only" privileges if necessary. This may be critical for troubleshooting purposes etc.
As top level admins for an organization, users with this role are allowed access to all Kube API verbs in all clusters spanning all Projects in the organization.
Infra and Project Admins¶
As admins, users with this role are allowed access to all Kube API verbs in clusters in the Project.
Users with this role are allowed access to all Kube API verbs in clusters in the "namespace(s)" they are allowed to access.
Read Only Users¶
Users with "Read Only" roles in the Org are only allowed to perform the following Kube API verbs.
SSO users can also seamlessly use the "Zero Trust KubeCTL" capabilities. SSO users are handled in a manner identical to local users i.e. their access privileges are mapped to roles in the Org based on their group membership in the SSO Provider (IdP).