Project RBAC policy templates

The PaletteAI Helm chart renders template ConfigMaps into the Helm release namespace. Each template holds a default list of Kubernetes PolicyRule entries used when defining Project-scoped access for a persona tier.

PaletteAI ships three core tiers — Viewer, Editor, and Admin — and Tenant admins can add net-new custom tiers by creating additional labeled ConfigMaps in the Tenant namespace. PaletteAI discovers personas by label.

For what each role is for and how OIDC groups bind to roles, refer to Roles and Permissions. For the default permission matrix the core templates implement, refer to Role Permissions.

Role ConfigMap Templates

PaletteAI copies the role templates into each Tenant namespace. These Tenant-scoped copies are the source of truth for the Role resources in every Project namespace within that Tenant.

ConfigMap name	Namespace	Data key	Purpose
mural-project-rbac-viewer	Helm release namespace	rules.yaml	Default rules for viewers in all Tenants and Projects
mural-project-rbac-editor	Helm release namespace	rules.yaml	Default rules for editors in all Tenants and Projects
mural-project-rbac-admin	Helm release namespace	rules.yaml	Default rules for admins in all Tenants and Projects

Each rules.yaml value is a YAML list of PolicyRule objects, in the same shape as the rules field on a rbac.authorization.k8s.io/v1 Role. Use an empty string under apiGroups for the core Kubernetes API.

ConfigMap Contract

Every persona template ConfigMap — core or custom — must carry the following metadata:

Field	Required	Purpose
Label app.kubernetes.io/component: palette-ai-project-rbac-template	yes	Discovery selector PaletteAI uses to find personas
Annotation palette.ai/project-rbac-tier: <tier-id>	yes	Persona tier ID used in Role names and additionalRoles keys
Data key rules.yaml	yes	Project-namespace Role rules
Annotation palette.ai/project-rbac-display-name: <label>	no	Human-readable label

Recommended ConfigMap name: mural-project-rbac-<tier-id> (matches the core Helm templates). The tier ID must be a valid DNS-1123 subdomain label and must not reuse core tier names (viewer, editor, admin) or the reserved tnt-adm tier.

Post-installation Customization

To adjust effective permissions for an existing tier after installation, edit the ConfigMap resources in each Tenant namespace. When you change any policy ConfigMap in a Tenant namespace, PaletteAI automatically updates the Role resources for every Project within that Tenant.

Upgrading the PaletteAI Helm chart does not reset or replace manual changes you make at the Tenant scope — overrides in Tenant namespaces are preserved.

Chart upgrades may update the template ConfigMap resources in the Helm release namespace when the PaletteAI defaults change. If you maintain customized permission sets, read the release notes for each upgrade and manually merge any new rules or modifications into your Tenant-scoped ConfigMap resources. PaletteAI does not overwrite customized ConfigMap resources in Tenant namespaces.

Add a Custom RBAC Tier

Adding a custom tier is a two-step process: define the persona template ConfigMap, then map OIDC groups on each Project that should use it.

Step 1: Create the template ConfigMap

Create a ConfigMap in the Tenant workload namespace (for example, tenant-acme-corp) with the discovery label and a palette.ai/project-rbac-tier annotation. The annotation value becomes the persona ID used throughout RBAC reconciliation.

apiVersion: v1
kind: ConfigMap
metadata:
  name: mural-project-rbac-compute-pool-editor
  namespace: tenant-acme-corp
  labels:
    app.kubernetes.io/component: palette-ai-project-rbac-template
  annotations:
    palette.ai/project-rbac-tier: compute-pool-editor
    palette.ai/project-rbac-display-name: Compute Pool Editor
data:
  # This example is narrowly scoped for illustration purposes,
  # but in practice it is recommended to start by copying one
  # of the out-of-the-box RBAC tier ConfigMaps.
  rules.yaml: |
    - apiGroups: ["spectrocloud.com"]
      resources: ["computepools"]
      verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]

PaletteAI copies platform RBAC templates into the Tenant namespace on Tenant creation. Custom ConfigMaps created directly in the Tenant namespace are discovered on the next reconcile without requiring a Helm change.

Step 2: Map OIDC groups on the Project

Creating the ConfigMap alone does not assign groups. You must update Project.spec.roleMapping.additionalRoles on each Project that should grant access to the custom tier. The map key must match the palette.ai/project-rbac-tier annotation value exactly.

apiVersion: spectrocloud.com/v1alpha1
kind: Project
metadata:
  name: ml-platform
  namespace: ml-platform
spec:
  tenantRef:
    name: acme-corp
  roleMapping:
    viewer: ['ml-viewers']
    editor: ['ml-editors']
    admin: ['ml-admins']
    additionalRoles:
      # Map of custom RBAC tier names to OIDC groups
      compute-pool-editor: ['compute-pool-editor']

Core tiers (viewer, editor, admin) must continue to use their dedicated roleMapping fields. Do not place them in additionalRoles.

After reconcile, PaletteAI creates or updates:

1. A Project-namespace Role and RoleBinding named prj-ml-platform-compute-pool-editor with the rules from rules.yaml.
2. A platform RoleBinding named ml-platform-mural-project-compute-pool-editor to the read-only mural-project-compute-pool-editor Role.
3. A Tenant-namespace {project}-mural-tenant-viewer RoleBinding that includes the compute-pool-editor OIDC group alongside the viewer, editor, admin, and tenant-admin groups already bound for that Project.

Tenant-namespace viewer bindings

Every persona assigned to a Project — core and custom — contributes its OIDC groups to the per-project {project}-mural-tenant-viewer RoleBinding in the Tenant namespace. That RoleBinding references the shared mural-tenant-viewer Role, which grants read-only access to Tenant-level Settings and Secrets.

If users in a custom tier cannot read Tenant-level resources, verify that:

1. The template ConfigMap exists in the Tenant namespace with the discovery label app.kubernetes.io/component: palette-ai-project-rbac-template.
2. The ConfigMap carries a valid palette.ai/project-rbac-tier annotation that matches the additionalRoles key.
3. Project.spec.roleMapping.additionalRoles includes the tier key with the correct OIDC group names.
4. The Project controller has reconciled (edit the Project or ConfigMap to trigger a reconcile if needed).

You can inspect the binding with:

kubectl get rolebinding --namespace tenant-acme-corp --selector palette.ai/role-type=tenant-viewer --output yaml

Identify Template ConfigMaps

Template ConfigMaps carry a discovery label and a tier annotation:

Label

• app.kubernetes.io/component: palette-ai-project-rbac-template

Annotation

• palette.ai/project-rbac-tier: <tier-id> — the persona tier ID (for example, viewer, editor, admin, or a custom value such as compute-pool-editor). This value must match the key used in Project.spec.roleMapping.additionalRoles.