Role Permissions Reference
This page lists the full Kubernetes Role-Based Access Control (RBAC) permissions that PaletteAI grants to each Tenant and Project role. For an overview of each role and how OpenID Connect (OIDC) groups bind to roles, refer to the Roles and Permissions concept page.
The tables below describe PaletteAI defaults for the three Project roles (Viewer, Editor, and Admin). Each role's permission rules come from a template ConfigMap. For details, refer to Project RBAC policy templates.
To change effective permissions for a role after installation, edit the Tenant-scoped RBAC policy ConfigMaps as described in Post-installation customization.
In the tables below, * means the role has full access to the resource (get, list, watch, create, update, patch, delete).
Tenant Role Permissions
When PaletteAI reconciles a Project, it creates a role named prj-<project-name>-tnt-adm in that Project's namespace (one per Project) with the following permissions.
| Resources | Permissions | API |
|---|---|---|
ConfigMap | * | v1 |
Event | * | v1 |
PersistentVolumeClaim | * | v1 |
Pod | * | v1 |
Secret | * | v1 |
Service | * | v1 |
ServiceAccount | * | v1 |
| All resources | * | apps |
HelmRepository | get, list, watch, create, update, patch, delete | source.toolkit.fluxcd.io |
OCIRepository | get, list, watch, create, update, patch, delete | source.toolkit.fluxcd.io |
AIWorkload | * | spectrocloud.com/v1alpha1 |
Compute | * | spectrocloud.com/v1alpha1 |
ComputeConfig | * | spectrocloud.com/v1alpha1 |
ComputePool | * | spectrocloud.com/v1alpha1 |
ComputePoolEvaluation | * | spectrocloud.com/v1alpha1 |
Project | * | spectrocloud.com/v1alpha1 |
ScalingPolicy | * | spectrocloud.com/v1alpha1 |
Settings | * | spectrocloud.com/v1alpha1 |
ComponentDefinition | * | spectrocloud.com/v1beta1 |
DefinitionRevision | * | spectrocloud.com/v1beta1 |
Environment | * | spectrocloud.com/v1beta1 |
PolicyDefinition | * | spectrocloud.com/v1beta1 |
ProfileBundle | * | spectrocloud.com/v1beta1 |
TraitDefinition | * | spectrocloud.com/v1beta1 |
VariableSet | * | spectrocloud.com/v1beta1 |
Workload | * | spectrocloud.com/v1beta1 |
WorkloadDeployment | * | spectrocloud.com/v1beta1 |
WorkloadProfile | * | spectrocloud.com/v1beta1 |
Hub | * | fleetconfig.open-cluster-management.io/v1beta1 |
Spoke | * | fleetconfig.open-cluster-management.io/v1beta1 |
All OIDC groups in the Tenant tenantRoleMapping bind to this single role through one RoleBinding.
Tenant Admin Cluster Permissions
Tenant admins receive a shared ClusterRole named mural-tenant-admin-creator through a per-tenant ClusterRoleBinding named <tenant-name>-tenant-admin-creator, with create-only permissions that enable Project and resource creation cluster-wide.
| Resources | Permissions | API |
|---|---|---|
Secret | create | v1 |
ComputeConfig | create | spectrocloud.com/v1alpha1 |
Project | create | spectrocloud.com/v1alpha1 |
Settings | create | spectrocloud.com/v1alpha1 |
Tenant admins also receive a per-tenant ClusterRole named <tenant-name>-mural-tenant-admin-admin through a ClusterRoleBinding named <tenant-name>-tenant-admin, granting access to the tenant's own Tenant resource only.
| Resources | Permissions | API |
|---|---|---|
Tenant | get, update, patch, delete | spectrocloud.com/v1alpha1 |
Tenant Admin Namespace Permissions
Tenant admins additionally receive full access to Tenant-namespace resources through a Role named mural-tenant-admin in the Tenant namespace, bound by a per-project RoleBinding named <project-name>-mural-tenant-admin. The Role's rules match the prj-<project-name>-tnt-adm permission table above.
Tenant Namespace Permissions
All Project users receive view-only access to the Tenant namespace through a Role named mural-tenant-viewer and a per-project RoleBinding in the Tenant namespace. PaletteAI aggregates OIDC groups from the Project's Viewer, Editor, and Admin mappings, plus the Tenant admin groups, into that RoleBinding. This enables access to Tenant-level configuration such as Settings and Secrets.
| Resources | Permissions | API |
|---|---|---|
Secret | get, list, watch | v1 |
Settings | get, list, watch | spectrocloud.com/v1alpha1 |
Project Role Permissions
Each Project automatically creates three roles with escalating permissions. The Viewer, Editor, and Admin roles ship with PaletteAI and use the roleMapping.viewer, roleMapping.editor, and roleMapping.admin fields on the Project resource.
Viewer Role Permissions
The Viewer role can view all resources but cannot make any modifications.
| Resources | Permissions | API |
|---|---|---|
ConfigMap | get, list, watch | v1 |
Event | get, list, watch | v1 |
PersistentVolumeClaim | get, list, watch | v1 |
Pod | get, list, watch | v1 |
Secret | get, list, watch | v1 |
Service | get, list, watch | v1 |
ServiceAccount | get, list, watch | v1 |
| All resources | get, list, watch | apps |
HelmRepository | get, list, watch | source.toolkit.fluxcd.io |
OCIRepository | get, list, watch | source.toolkit.fluxcd.io |
AIWorkload | get, list, watch | spectrocloud.com/v1alpha1 |
Compute | get, list, watch | spectrocloud.com/v1alpha1 |
ComputeConfig | get, list, watch | spectrocloud.com/v1alpha1 |
ComputePool | get, list, watch | spectrocloud.com/v1alpha1 |
ComputePoolEvaluation | get, list, watch | spectrocloud.com/v1alpha1 |
Project | get, list, watch | spectrocloud.com/v1alpha1 |
ScalingPolicy | get, list, watch | spectrocloud.com/v1alpha1 |
Settings | get, list, watch | spectrocloud.com/v1alpha1 |
ComponentDefinition | get, list, watch | spectrocloud.com/v1beta1 |
DefinitionRevision | get, list, watch | spectrocloud.com/v1beta1 |
Environment | get, list, watch | spectrocloud.com/v1beta1 |
PolicyDefinition | get, list, watch | spectrocloud.com/v1beta1 |
ProfileBundle | get, list, watch | spectrocloud.com/v1beta1 |
TraitDefinition | get, list, watch | spectrocloud.com/v1beta1 |
VariableSet | get, list, watch | spectrocloud.com/v1beta1 |
Workload | get, list, watch | spectrocloud.com/v1beta1 |
WorkloadDeployment | get, list, watch | spectrocloud.com/v1beta1 |
WorkloadProfile | get, list, watch | spectrocloud.com/v1beta1 |
Editor Role Permissions
The Editor role can deploy and manage AIWorkload resources within their assigned Project.
| Resources | Permissions | API |
|---|---|---|
ConfigMap | get, list, watch, create, update, patch, delete | v1 |
Event | get, list, watch, create, update, patch, delete | v1 |
PersistentVolumeClaim | get, list, watch, create, update, patch, delete | v1 |
Pod | get, list, watch, create, update, patch, delete | v1 |
Secret | get, list, watch, create, update, patch, delete | v1 |
Service | get, list, watch, create, update, patch, delete | v1 |
ServiceAccount | get, list, watch, create, update, patch, delete | v1 |
| All resources | get, list, watch, create, update, patch, delete | apps |
HelmRepository | get, list, watch, create, update, patch, delete | source.toolkit.fluxcd.io |
OCIRepository | get, list, watch, create, update, patch, delete | source.toolkit.fluxcd.io |
AIWorkload | get, list, watch, create, update, patch, delete | spectrocloud.com/v1alpha1 |
Compute | get, list, watch, create, update, patch, delete | spectrocloud.com/v1alpha1 |
ComputeConfig | get, list, watch, create, update, patch, delete | spectrocloud.com/v1alpha1 |
ComputePool | get, list, watch | spectrocloud.com/v1alpha1 |
ComputePoolEvaluation | get, list, watch, create, update, patch, delete | spectrocloud.com/v1alpha1 |
Project | get, list, watch | spectrocloud.com/v1alpha1 |
ScalingPolicy | get, list, watch, create, update, patch, delete | spectrocloud.com/v1alpha1 |
Settings | get, list, watch | spectrocloud.com/v1alpha1 |
ComponentDefinition | get, list, watch | spectrocloud.com/v1beta1 |
DefinitionRevision | get, list, watch | spectrocloud.com/v1beta1 |
Environment | get, list, watch | spectrocloud.com/v1beta1 |
PolicyDefinition | get, list, watch | spectrocloud.com/v1beta1 |
ProfileBundle | get, list, watch, create, update, patch, delete | spectrocloud.com/v1beta1 |
TraitDefinition | get, list, watch | spectrocloud.com/v1beta1 |
VariableSet | get, list, watch, update, patch | spectrocloud.com/v1beta1 |
Workload | get, list, watch | spectrocloud.com/v1beta1 |
WorkloadDeployment | get, list, watch | spectrocloud.com/v1beta1 |
WorkloadProfile | get, list, watch, create, update, patch, delete | spectrocloud.com/v1beta1 |
Admin Role Permissions
The Admin role has full control over all resources and configurations in the Project scope.
| Resources | Permissions | API |
|---|---|---|
ConfigMap | * | v1 |
Event | * | v1 |
PersistentVolumeClaim | * | v1 |
Pod | * | v1 |
Secret | * | v1 |
Service | * | v1 |
ServiceAccount | * | v1 |
| All resources | * | apps |
HelmRepository | get, list, watch, create, update, patch, delete | source.toolkit.fluxcd.io |
OCIRepository | get, list, watch, create, update, patch, delete | source.toolkit.fluxcd.io |
AIWorkload | * | spectrocloud.com/v1alpha1 |
Compute | * | spectrocloud.com/v1alpha1 |
ComputeConfig | * | spectrocloud.com/v1alpha1 |
ComputePool | * | spectrocloud.com/v1alpha1 |
ComputePoolEvaluation | * | spectrocloud.com/v1alpha1 |
Project | get, list, patch, watch, update, delete | spectrocloud.com/v1alpha1 |
ScalingPolicy | * | spectrocloud.com/v1alpha1 |
Settings | * | spectrocloud.com/v1alpha1 |
ComponentDefinition | * | spectrocloud.com/v1beta1 |
DefinitionRevision | * | spectrocloud.com/v1beta1 |
Environment | * | spectrocloud.com/v1beta1 |
PolicyDefinition | * | spectrocloud.com/v1beta1 |
ProfileBundle | * | spectrocloud.com/v1beta1 |
TraitDefinition | * | spectrocloud.com/v1beta1 |
VariableSet | * | spectrocloud.com/v1beta1 |
Workload | * | spectrocloud.com/v1beta1 |
WorkloadDeployment | * | spectrocloud.com/v1beta1 |
WorkloadProfile | * | spectrocloud.com/v1beta1 |
System-defined / Built-in Roles
The PaletteAI Helm chart ships three read-only Roles in the system namespace (mural-system by default):
| Role | Purpose |
|---|---|
mural-project-viewer | Read-only access to system definitions |
mural-project-editor | Read-only access to system definitions |
mural-project-admin | Read-only access to system definitions |
All system-definition Roles share the same read-only permissions regardless of role. For each Project, PaletteAI creates RoleBindings in the Helm release namespace (mural-system by default) that map each role's OIDC groups to the matching system Role, allowing users to access built-in platform definitions in addition to Project-level resources.
Each RoleBinding is named <project-name>-mural-project-<role> and binds the Project's OIDC groups for that role to the corresponding built-in Role in the Helm release namespace.
The following permissions are applied to the Helm release namespace only.
| Resources | Permissions | API |
|---|---|---|
ConfigMap | get, list, watch | v1 |
ScalingPolicy | get, list, watch | spectrocloud.com/v1alpha1 |
ComponentDefinition | get, list, watch | spectrocloud.com/v1beta1 |
DefinitionRevision | get, list, watch | spectrocloud.com/v1beta1 |
PolicyDefinition | get, list, watch | spectrocloud.com/v1beta1 |
ProfileBundle | get, list, watch | spectrocloud.com/v1beta1 |
TraitDefinition | get, list, watch | spectrocloud.com/v1beta1 |
WorkloadDeployment | get, list, watch | spectrocloud.com/v1beta1 |
WorkloadProfile | get, list, watch | spectrocloud.com/v1beta1 |
The ConfigMap permissions are resource-specific. They only grant access to the mural-feature-flags and branding ConfigMaps in the system namespace.