Skip to main content
Version: v1.1.x

Role Permissions Reference

This page lists the full Kubernetes Role-Based Access Control (RBAC) permissions that PaletteAI grants to each Tenant and Project role. For an overview of each role and how OpenID Connect (OIDC) groups bind to roles, refer to the Roles and Permissions concept page.

The tables below describe PaletteAI defaults for the three Project roles (Viewer, Editor, and Admin). Each role's permission rules come from a template ConfigMap. For details, refer to Project RBAC policy templates.

To change effective permissions for a role after installation, edit the Tenant-scoped RBAC policy ConfigMaps as described in Post-installation customization.

In the tables below, * means the role has full access to the resource (get, list, watch, create, update, patch, delete).

Tenant Role Permissions

When PaletteAI reconciles a Project, it creates a role named prj-<project-name>-tnt-adm in that Project's namespace (one per Project) with the following permissions.

ResourcesPermissionsAPI
ConfigMap*v1
Event*v1
PersistentVolumeClaim*v1
Pod*v1
Secret*v1
Service*v1
ServiceAccount*v1
All resources*apps
HelmRepositoryget, list, watch, create, update, patch, deletesource.toolkit.fluxcd.io
OCIRepositoryget, list, watch, create, update, patch, deletesource.toolkit.fluxcd.io
AIWorkload*spectrocloud.com/v1alpha1
Compute*spectrocloud.com/v1alpha1
ComputeConfig*spectrocloud.com/v1alpha1
ComputePool*spectrocloud.com/v1alpha1
ComputePoolEvaluation*spectrocloud.com/v1alpha1
Project*spectrocloud.com/v1alpha1
ScalingPolicy*spectrocloud.com/v1alpha1
Settings*spectrocloud.com/v1alpha1
ComponentDefinition*spectrocloud.com/v1beta1
DefinitionRevision*spectrocloud.com/v1beta1
Environment*spectrocloud.com/v1beta1
PolicyDefinition*spectrocloud.com/v1beta1
ProfileBundle*spectrocloud.com/v1beta1
TraitDefinition*spectrocloud.com/v1beta1
VariableSet*spectrocloud.com/v1beta1
Workload*spectrocloud.com/v1beta1
WorkloadDeployment*spectrocloud.com/v1beta1
WorkloadProfile*spectrocloud.com/v1beta1
Hub*fleetconfig.open-cluster-management.io/v1beta1
Spoke*fleetconfig.open-cluster-management.io/v1beta1

All OIDC groups in the Tenant tenantRoleMapping bind to this single role through one RoleBinding.

Tenant Admin Cluster Permissions

Tenant admins receive a shared ClusterRole named mural-tenant-admin-creator through a per-tenant ClusterRoleBinding named <tenant-name>-tenant-admin-creator, with create-only permissions that enable Project and resource creation cluster-wide.

ResourcesPermissionsAPI
Secretcreatev1
ComputeConfigcreatespectrocloud.com/v1alpha1
Projectcreatespectrocloud.com/v1alpha1
Settingscreatespectrocloud.com/v1alpha1

Tenant admins also receive a per-tenant ClusterRole named <tenant-name>-mural-tenant-admin-admin through a ClusterRoleBinding named <tenant-name>-tenant-admin, granting access to the tenant's own Tenant resource only.

ResourcesPermissionsAPI
Tenantget, update, patch, deletespectrocloud.com/v1alpha1

Tenant Admin Namespace Permissions

Tenant admins additionally receive full access to Tenant-namespace resources through a Role named mural-tenant-admin in the Tenant namespace, bound by a per-project RoleBinding named <project-name>-mural-tenant-admin. The Role's rules match the prj-<project-name>-tnt-adm permission table above.

Tenant Namespace Permissions

All Project users receive view-only access to the Tenant namespace through a Role named mural-tenant-viewer and a per-project RoleBinding in the Tenant namespace. PaletteAI aggregates OIDC groups from the Project's Viewer, Editor, and Admin mappings, plus the Tenant admin groups, into that RoleBinding. This enables access to Tenant-level configuration such as Settings and Secrets.

ResourcesPermissionsAPI
Secretget, list, watchv1
Settingsget, list, watchspectrocloud.com/v1alpha1

Project Role Permissions

Each Project automatically creates three roles with escalating permissions. The Viewer, Editor, and Admin roles ship with PaletteAI and use the roleMapping.viewer, roleMapping.editor, and roleMapping.admin fields on the Project resource.

Viewer Role Permissions

The Viewer role can view all resources but cannot make any modifications.

ResourcesPermissionsAPI
ConfigMapget, list, watchv1
Eventget, list, watchv1
PersistentVolumeClaimget, list, watchv1
Podget, list, watchv1
Secretget, list, watchv1
Serviceget, list, watchv1
ServiceAccountget, list, watchv1
All resourcesget, list, watchapps
HelmRepositoryget, list, watchsource.toolkit.fluxcd.io
OCIRepositoryget, list, watchsource.toolkit.fluxcd.io
AIWorkloadget, list, watchspectrocloud.com/v1alpha1
Computeget, list, watchspectrocloud.com/v1alpha1
ComputeConfigget, list, watchspectrocloud.com/v1alpha1
ComputePoolget, list, watchspectrocloud.com/v1alpha1
ComputePoolEvaluationget, list, watchspectrocloud.com/v1alpha1
Projectget, list, watchspectrocloud.com/v1alpha1
ScalingPolicyget, list, watchspectrocloud.com/v1alpha1
Settingsget, list, watchspectrocloud.com/v1alpha1
ComponentDefinitionget, list, watchspectrocloud.com/v1beta1
DefinitionRevisionget, list, watchspectrocloud.com/v1beta1
Environmentget, list, watchspectrocloud.com/v1beta1
PolicyDefinitionget, list, watchspectrocloud.com/v1beta1
ProfileBundleget, list, watchspectrocloud.com/v1beta1
TraitDefinitionget, list, watchspectrocloud.com/v1beta1
VariableSetget, list, watchspectrocloud.com/v1beta1
Workloadget, list, watchspectrocloud.com/v1beta1
WorkloadDeploymentget, list, watchspectrocloud.com/v1beta1
WorkloadProfileget, list, watchspectrocloud.com/v1beta1

Editor Role Permissions

The Editor role can deploy and manage AIWorkload resources within their assigned Project.

ResourcesPermissionsAPI
ConfigMapget, list, watch, create, update, patch, deletev1
Eventget, list, watch, create, update, patch, deletev1
PersistentVolumeClaimget, list, watch, create, update, patch, deletev1
Podget, list, watch, create, update, patch, deletev1
Secretget, list, watch, create, update, patch, deletev1
Serviceget, list, watch, create, update, patch, deletev1
ServiceAccountget, list, watch, create, update, patch, deletev1
All resourcesget, list, watch, create, update, patch, deleteapps
HelmRepositoryget, list, watch, create, update, patch, deletesource.toolkit.fluxcd.io
OCIRepositoryget, list, watch, create, update, patch, deletesource.toolkit.fluxcd.io
AIWorkloadget, list, watch, create, update, patch, deletespectrocloud.com/v1alpha1
Computeget, list, watch, create, update, patch, deletespectrocloud.com/v1alpha1
ComputeConfigget, list, watch, create, update, patch, deletespectrocloud.com/v1alpha1
ComputePoolget, list, watchspectrocloud.com/v1alpha1
ComputePoolEvaluationget, list, watch, create, update, patch, deletespectrocloud.com/v1alpha1
Projectget, list, watchspectrocloud.com/v1alpha1
ScalingPolicyget, list, watch, create, update, patch, deletespectrocloud.com/v1alpha1
Settingsget, list, watchspectrocloud.com/v1alpha1
ComponentDefinitionget, list, watchspectrocloud.com/v1beta1
DefinitionRevisionget, list, watchspectrocloud.com/v1beta1
Environmentget, list, watchspectrocloud.com/v1beta1
PolicyDefinitionget, list, watchspectrocloud.com/v1beta1
ProfileBundleget, list, watch, create, update, patch, deletespectrocloud.com/v1beta1
TraitDefinitionget, list, watchspectrocloud.com/v1beta1
VariableSetget, list, watch, update, patchspectrocloud.com/v1beta1
Workloadget, list, watchspectrocloud.com/v1beta1
WorkloadDeploymentget, list, watchspectrocloud.com/v1beta1
WorkloadProfileget, list, watch, create, update, patch, deletespectrocloud.com/v1beta1

Admin Role Permissions

The Admin role has full control over all resources and configurations in the Project scope.

ResourcesPermissionsAPI
ConfigMap*v1
Event*v1
PersistentVolumeClaim*v1
Pod*v1
Secret*v1
Service*v1
ServiceAccount*v1
All resources*apps
HelmRepositoryget, list, watch, create, update, patch, deletesource.toolkit.fluxcd.io
OCIRepositoryget, list, watch, create, update, patch, deletesource.toolkit.fluxcd.io
AIWorkload*spectrocloud.com/v1alpha1
Compute*spectrocloud.com/v1alpha1
ComputeConfig*spectrocloud.com/v1alpha1
ComputePool*spectrocloud.com/v1alpha1
ComputePoolEvaluation*spectrocloud.com/v1alpha1
Projectget, list, patch, watch, update, deletespectrocloud.com/v1alpha1
ScalingPolicy*spectrocloud.com/v1alpha1
Settings*spectrocloud.com/v1alpha1
ComponentDefinition*spectrocloud.com/v1beta1
DefinitionRevision*spectrocloud.com/v1beta1
Environment*spectrocloud.com/v1beta1
PolicyDefinition*spectrocloud.com/v1beta1
ProfileBundle*spectrocloud.com/v1beta1
TraitDefinition*spectrocloud.com/v1beta1
VariableSet*spectrocloud.com/v1beta1
Workload*spectrocloud.com/v1beta1
WorkloadDeployment*spectrocloud.com/v1beta1
WorkloadProfile*spectrocloud.com/v1beta1

System-defined / Built-in Roles

The PaletteAI Helm chart ships three read-only Roles in the system namespace (mural-system by default):

RolePurpose
mural-project-viewerRead-only access to system definitions
mural-project-editorRead-only access to system definitions
mural-project-adminRead-only access to system definitions

All system-definition Roles share the same read-only permissions regardless of role. For each Project, PaletteAI creates RoleBindings in the Helm release namespace (mural-system by default) that map each role's OIDC groups to the matching system Role, allowing users to access built-in platform definitions in addition to Project-level resources.

Each RoleBinding is named <project-name>-mural-project-<role> and binds the Project's OIDC groups for that role to the corresponding built-in Role in the Helm release namespace.

The following permissions are applied to the Helm release namespace only.

ResourcesPermissionsAPI
ConfigMapget, list, watchv1
ScalingPolicyget, list, watchspectrocloud.com/v1alpha1
ComponentDefinitionget, list, watchspectrocloud.com/v1beta1
DefinitionRevisionget, list, watchspectrocloud.com/v1beta1
PolicyDefinitionget, list, watchspectrocloud.com/v1beta1
ProfileBundleget, list, watchspectrocloud.com/v1beta1
TraitDefinitionget, list, watchspectrocloud.com/v1beta1
WorkloadDeploymentget, list, watchspectrocloud.com/v1beta1
WorkloadProfileget, list, watchspectrocloud.com/v1beta1
info

The ConfigMap permissions are resource-specific. They only grant access to the mural-feature-flags and branding ConfigMaps in the system namespace.