Project RBAC policy templates

The PaletteAI Helm chart renders template ConfigMaps into the Helm release namespace. Each template holds a default list of Kubernetes PolicyRule entries used when defining Project-scoped access for a role.

PaletteAI ships three roles — Viewer, Editor, and Admin — each backed by a template ConfigMap with a fixed, well-known name.

For what each role is for and how OIDC groups bind to roles, refer to Roles and Permissions. For the default permission matrix the core templates implement, refer to Role Permissions.

Role ConfigMap Templates

PaletteAI copies the role templates into each Tenant namespace. These Tenant-scoped copies are the source of truth for the Role resources in every Project namespace within that Tenant.

ConfigMap name	Namespace	Data key	Purpose
mural-project-rbac-viewer	Helm release namespace	rules.yaml	Default rules for viewers in all Tenants and Projects
mural-project-rbac-editor	Helm release namespace	rules.yaml	Default rules for editors in all Tenants and Projects
mural-project-rbac-admin	Helm release namespace	rules.yaml	Default rules for admins in all Tenants and Projects

Each rules.yaml value is a YAML list of PolicyRule objects, in the same shape as the rules field on a rbac.authorization.k8s.io/v1 Role. Use an empty string under apiGroups for the core Kubernetes API.

ConfigMap Contract

PaletteAI discovers the role templates by their fixed names — mural-project-rbac-viewer, mural-project-rbac-editor, and mural-project-rbac-admin. No labels or annotations are required.

• On Tenant creation, PaletteAI copies each template from the Helm release namespace into the Tenant namespace. If a copy already exists in the Tenant namespace, PaletteAI never overwrites it — the Tenant-namespace copies are the source of truth.
• The rules.yaml data key holds the Project-namespace Role rules.
• PaletteAI watches the fixed-name ConfigMaps, so edits to a Tenant-namespace copy trigger reconciliation of every Project in that Tenant.

Post-installation Customization

To adjust effective permissions for an existing tier after installation, edit the ConfigMap resources in each Tenant namespace. When you change any policy ConfigMap in a Tenant namespace, PaletteAI automatically updates the Role resources for every Project within that Tenant.

Upgrading the PaletteAI Helm chart does not reset or replace manual changes you make at the Tenant scope — overrides in Tenant namespaces are preserved.

Chart upgrades may update the template ConfigMap resources in the Helm release namespace when the PaletteAI defaults change. If you maintain customized permission sets, read the release notes for each upgrade and manually merge any new rules or modifications into your Tenant-scoped ConfigMap resources. PaletteAI does not overwrite customized ConfigMap resources in Tenant namespaces.