Version: v1.2.x

Role Permissions Reference

This page lists the full Kubernetes Role-Based Access Control (RBAC) permissions that PaletteAI grants to each Tenant and Project role. For an overview of each role and how OpenID Connect (OIDC) groups bind to roles, refer to the Roles and Permissions concept page.

The tables below describe PaletteAI defaults for the three core Project roles (Viewer, Editor, and Admin). Tenant admins can also add net-new RBAC tiers — custom personas with their own permission sets — by creating additional template ConfigMaps in the Tenant namespace. Custom tiers follow the same Kubernetes RBAC surfaces as the core roles (Project-namespace Roles, platform RoleBindings, and Tenant-namespace viewer aggregation). For how to define a custom tier and assign OIDC groups, refer to Project RBAC policy templates.

To change effective permissions for an existing tier after installation, edit the Tenant-scoped RBAC policy ConfigMaps as described in Post-installation customization.

In the tables below, * means the role has full access to the resource (get, list, watch, create, update, patch, delete).

Tenant Role Permissions

When you create a Tenant, PaletteAI automatically creates a role named prj-<project-name>-tnt-adm in each Project namespace with the following permissions.

Resources	Permissions	API
`ConfigMap`	`*`	`v1`
`Event`	`*`	`v1`
`PersistentVolumeClaim`	`*`	`v1`
`Pod`	`*`	`v1`
`Secret`	`*`	`v1`
`Service`	`*`	`v1`
`ServiceAccount`	`*`	`v1`
All resources	`*`	`apps`
`HelmRepository`	`get`, `list`, `watch`, `create`, `update`, `patch`, `delete`	`source.toolkit.fluxcd.io`
`OCIRepository`	`get`, `list`, `watch`, `create`, `update`, `patch`, `delete`	`source.toolkit.fluxcd.io`
`AIWorkload`	`*`	`spectrocloud.com/v1alpha1`
`Compute`	`*`	`spectrocloud.com/v1alpha1`
`ComputeConfig`	`*`	`spectrocloud.com/v1alpha1`
`ComputePool`	`*`	`spectrocloud.com/v1alpha1`
`ComputePoolEvaluation`	`*`	`spectrocloud.com/v1alpha1`
`Project`	`*`	`spectrocloud.com/v1alpha1`
`ScalingPolicy`	`*`	`spectrocloud.com/v1alpha1`
`Settings`	`*`	`spectrocloud.com/v1alpha1`
`ComponentDefinition`	`*`	`spectrocloud.com/v1beta1`
`DefinitionRevision`	`*`	`spectrocloud.com/v1beta1`
`Environment`	`*`	`spectrocloud.com/v1beta1`
`PolicyDefinition`	`*`	`spectrocloud.com/v1beta1`
`ProfileBundle`	`*`	`spectrocloud.com/v1beta1`
`TraitDefinition`	`*`	`spectrocloud.com/v1beta1`
`VariableSet`	`*`	`spectrocloud.com/v1beta1`
`Workload`	`*`	`spectrocloud.com/v1beta1`
`WorkloadDeployment`	`*`	`spectrocloud.com/v1beta1`
`WorkloadProfile`	`*`	`spectrocloud.com/v1beta1`
`Hub`	`*`	`fleetconfig.open-cluster-management.io/v1beta1`
`Spoke`	`*`	`fleetconfig.open-cluster-management.io/v1beta1`

All OIDC groups in the Tenant tenantRoleMapping bind to this single role through one RoleBinding.

Tenant Admin Cluster Permissions

Tenant admins receive a shared ClusterRole named mural-tenant-admin-creator through a per-tenant ClusterRoleBinding named <tenant-name>-tenant-admin-creator, with create-only permissions that enable Project and resource creation cluster-wide.

Resources	Permissions	API
`Secret`	`create`	`v1`
`ComputeConfig`	`create`	`spectrocloud.com/v1alpha1`
`Project`	`create`	`spectrocloud.com/v1alpha1`
`Settings`	`create`	`spectrocloud.com/v1alpha1`

Tenant admins also receive a per-tenant ClusterRole named <tenant-name>-mural-tenant-admin-admin through a ClusterRoleBinding named <tenant-name>-tenant-admin, granting access to the tenant's own Tenant resource only.

Resources	Permissions	API
`Tenant`	`get`, `update`, `patch`, `delete`	`spectrocloud.com/v1alpha1`

Tenant Admin Namespace Permissions

Tenant admins additionally receive full access to Tenant-namespace resources through a Role named mural-tenant-admin in the Tenant namespace, bound by a per-project RoleBinding named <project-name>-mural-tenant-admin. The Role's rules match the prj-<project-name>-tnt-adm permission table above.

Tenant Namespace Permissions

All Project users — including users in custom RBAC tiers — receive view-only access to the Tenant namespace through a Role named mural-tenant-viewer and a per-project RoleBinding in the Tenant namespace. PaletteAI aggregates OIDC groups from every persona assigned to the Project (Viewer, Editor, Admin, and any custom tiers mapped in spec.roleMapping.additionalRoles) into that RoleBinding. This enables access to Tenant-level configuration such as Settings and Secrets.

Resources	Permissions	API
`Secret`	`get`, `list`, `watch`	`v1`
`Settings`	`get`, `list`, `watch`	`spectrocloud.com/v1alpha1`

Shared Tenant-Scoped Resource Permissions

When a Tenant admin shares a tenant-scoped resource with a Project through sharedWith, PaletteAI creates a dedicated Role in the Tenant namespace that grants get and watch on that specific resource by name, using resourceNames. It then binds the OIDC groups of every persona assigned to the Project — Viewer, Editor, Admin, and any custom tiers mapped in spec.roleMapping.additionalRoles — to that Role with a RoleBinding. This applies to AIWorkload, ComputeConfig, ComputePool, ProfileBundle, and ScalingPolicy resources.

Resources	Permissions	API
`AIWorkload`	`get`, `watch`	`spectrocloud.com/v1alpha1`
`ComputeConfig`	`get`, `watch`	`spectrocloud.com/v1alpha1`
`ComputePool`	`get`, `watch`	`spectrocloud.com/v1alpha1`
`ScalingPolicy`	`get`, `watch`	`spectrocloud.com/v1alpha1`
`ProfileBundle`	`get`, `watch`	`spectrocloud.com/v1beta1`

These Roles intentionally omit the list verb, because list cannot be restricted to specific resource names and would expose every tenant-scoped resource regardless of sharedWith. For the access model and how the PaletteAI UI lists these resources, refer to Tenant-Scoped Resources.

Project Role Permissions

Each Project automatically creates three core roles with escalating permissions. Tenant admins can add additional tiers beyond these three; each discovered tier gets its own Project-scoped Role and RoleBinding using the permission rules from its template ConfigMap.

Core Project Roles

The Viewer, Editor, and Admin tiers ship with PaletteAI and use the fixed roleMapping.viewer, roleMapping.editor, and roleMapping.admin fields on the Project resource.

Viewer Role Permissions

The Viewer role can view all resources but cannot make any modifications.

Resources	Permissions	API
`ConfigMap`	`get`, `list`, `watch`	`v1`
`Event`	`get`, `list`, `watch`	`v1`
`PersistentVolumeClaim`	`get`, `list`, `watch`	`v1`
`Pod`	`get`, `list`, `watch`	`v1`
`Secret`	`get`, `list`, `watch`	`v1`
`Service`	`get`, `list`, `watch`	`v1`
`ServiceAccount`	`get`, `list`, `watch`	`v1`
All resources	`get`, `list`, `watch`	`apps`
`HelmRepository`	`get`, `list`, `watch`	`source.toolkit.fluxcd.io`
`OCIRepository`	`get`, `list`, `watch`	`source.toolkit.fluxcd.io`
`AIWorkload`	`get`, `list`, `watch`	`spectrocloud.com/v1alpha1`
`Compute`	`get`, `list`, `watch`	`spectrocloud.com/v1alpha1`
`ComputeConfig`	`get`, `list`, `watch`	`spectrocloud.com/v1alpha1`
`ComputePool`	`get`, `list`, `watch`	`spectrocloud.com/v1alpha1`
`ComputePoolEvaluation`	`get`, `list`, `watch`	`spectrocloud.com/v1alpha1`
`Project`	`get`, `list`, `watch`	`spectrocloud.com/v1alpha1`
`ScalingPolicy`	`get`, `list`, `watch`	`spectrocloud.com/v1alpha1`
`Settings`	`get`, `list`, `watch`	`spectrocloud.com/v1alpha1`
`ComponentDefinition`	`get`, `list`, `watch`	`spectrocloud.com/v1beta1`
`DefinitionRevision`	`get`, `list`, `watch`	`spectrocloud.com/v1beta1`
`Environment`	`get`, `list`, `watch`	`spectrocloud.com/v1beta1`
`PolicyDefinition`	`get`, `list`, `watch`	`spectrocloud.com/v1beta1`
`ProfileBundle`	`get`, `list`, `watch`	`spectrocloud.com/v1beta1`
`TraitDefinition`	`get`, `list`, `watch`	`spectrocloud.com/v1beta1`
`VariableSet`	`get`, `list`, `watch`	`spectrocloud.com/v1beta1`
`Workload`	`get`, `list`, `watch`	`spectrocloud.com/v1beta1`
`WorkloadDeployment`	`get`, `list`, `watch`	`spectrocloud.com/v1beta1`
`WorkloadProfile`	`get`, `list`, `watch`	`spectrocloud.com/v1beta1`

Editor Role Permissions

The Editor role can deploy and manage AIWorkload resources within their assigned Project.

Resources	Permissions	API
`ConfigMap`	`get`, `list`, `watch`, `create`, `update`, `patch`, `delete`	`v1`
`Event`	`get`, `list`, `watch`, `create`, `update`, `patch`, `delete`	`v1`
`PersistentVolumeClaim`	`get`, `list`, `watch`, `create`, `update`, `patch`, `delete`	`v1`
`Pod`	`get`, `list`, `watch`, `create`, `update`, `patch`, `delete`	`v1`
`Secret`	`get`, `list`, `watch`, `create`, `update`, `patch`, `delete`	`v1`
`Service`	`get`, `list`, `watch`, `create`, `update`, `patch`, `delete`	`v1`
`ServiceAccount`	`get`, `list`, `watch`, `create`, `update`, `patch`, `delete`	`v1`
All resources	`get`, `list`, `watch`, `create`, `update`, `patch`, `delete`	`apps`
`HelmRepository`	`get`, `list`, `watch`, `create`, `update`, `patch`, `delete`	`source.toolkit.fluxcd.io`
`OCIRepository`	`get`, `list`, `watch`, `create`, `update`, `patch`, `delete`	`source.toolkit.fluxcd.io`
`AIWorkload`	`get`, `list`, `watch`, `create`, `update`, `patch`, `delete`	`spectrocloud.com/v1alpha1`
`Compute`	`get`, `list`, `watch`, `create`, `update`, `patch`, `delete`	`spectrocloud.com/v1alpha1`
`ComputeConfig`	`get`, `list`, `watch`, `create`, `update`, `patch`, `delete`	`spectrocloud.com/v1alpha1`
`ComputePool`	`get`, `list`, `watch`	`spectrocloud.com/v1alpha1`
`ComputePoolEvaluation`	`get`, `list`, `watch`, `create`, `update`, `patch`, `delete`	`spectrocloud.com/v1alpha1`
`Project`	`get`, `list`, `watch`	`spectrocloud.com/v1alpha1`
`ScalingPolicy`	`get`, `list`, `watch`, `create`, `update`, `patch`, `delete`	`spectrocloud.com/v1alpha1`
`Settings`	`get`, `list`, `watch`	`spectrocloud.com/v1alpha1`
`ComponentDefinition`	`get`, `list`, `watch`	`spectrocloud.com/v1beta1`
`DefinitionRevision`	`get`, `list`, `watch`	`spectrocloud.com/v1beta1`
`Environment`	`get`, `list`, `watch`	`spectrocloud.com/v1beta1`
`PolicyDefinition`	`get`, `list`, `watch`	`spectrocloud.com/v1beta1`
`ProfileBundle`	`get`, `list`, `watch`, `create`, `update`, `patch`, `delete`	`spectrocloud.com/v1beta1`
`TraitDefinition`	`get`, `list`, `watch`	`spectrocloud.com/v1beta1`
`VariableSet`	`get`, `list`, `watch`, `update`, `patch`	`spectrocloud.com/v1beta1`
`Workload`	`get`, `list`, `watch`	`spectrocloud.com/v1beta1`
`WorkloadDeployment`	`get`, `list`, `watch`	`spectrocloud.com/v1beta1`
`WorkloadProfile`	`get`, `list`, `watch`, `create`, `update`, `patch`, `delete`	`spectrocloud.com/v1beta1`

Admin Role Permissions

The Admin role has full control over all resources and configurations in the Project scope.

Resources	Permissions	API
`ConfigMap`	`*`	`v1`
`Event`	`*`	`v1`
`PersistentVolumeClaim`	`*`	`v1`
`Pod`	`*`	`v1`
`Secret`	`*`	`v1`
`Service`	`*`	`v1`
`ServiceAccount`	`*`	`v1`
All resources	`*`	`apps`
`HelmRepository`	`get`, `list`, `watch`, `create`, `update`, `patch`, `delete`	`source.toolkit.fluxcd.io`
`OCIRepository`	`get`, `list`, `watch`, `create`, `update`, `patch`, `delete`	`source.toolkit.fluxcd.io`
`AIWorkload`	`*`	`spectrocloud.com/v1alpha1`
`Compute`	`*`	`spectrocloud.com/v1alpha1`
`ComputeConfig`	`*`	`spectrocloud.com/v1alpha1`
`ComputePool`	`*`	`spectrocloud.com/v1alpha1`
`ComputePoolEvaluation`	`*`	`spectrocloud.com/v1alpha1`
`Project`	`get`, `list`, `patch`, `watch`, `update`, `delete`	`spectrocloud.com/v1alpha1`
`ScalingPolicy`	`*`	`spectrocloud.com/v1alpha1`
`Settings`	`*`	`spectrocloud.com/v1alpha1`
`ComponentDefinition`	`*`	`spectrocloud.com/v1beta1`
`DefinitionRevision`	`*`	`spectrocloud.com/v1beta1`
`Environment`	`*`	`spectrocloud.com/v1beta1`
`PolicyDefinition`	`*`	`spectrocloud.com/v1beta1`
`ProfileBundle`	`*`	`spectrocloud.com/v1beta1`
`TraitDefinition`	`*`	`spectrocloud.com/v1beta1`
`VariableSet`	`*`	`spectrocloud.com/v1beta1`
`Workload`	`*`	`spectrocloud.com/v1beta1`
`WorkloadDeployment`	`*`	`spectrocloud.com/v1beta1`
`WorkloadProfile`	`*`	`spectrocloud.com/v1beta1`

Custom Project Role Tiers

Tenant admins can define net-new RBAC tiers by creating labeled template ConfigMaps in the Tenant namespace. Each custom tier:

Declares its permission rules in a template ConfigMap (rules.yaml) in the Tenant namespace.
Maps OIDC groups through Project.spec.roleMapping.additionalRoles.
Receives a Project-scoped Role and RoleBinding named prj-<project-name>-<tier>.
Receives a platform RoleBinding to a read-only mural-project-<tier> Role (same platform-definition access pattern as the core tiers).
Includes its OIDC groups in the per-project {project}-mural-tenant-viewer RoleBinding in the Tenant namespace.

Custom tier IDs must be valid DNS-1123 subdomain labels and must not reuse core tier names (viewer, editor, admin) or the reserved tnt-adm tier. The tier ID in the ConfigMap annotation must match the key used in additionalRoles.

For a worked example of adding a custom tier and mapping groups, refer to Project RBAC policy templates.

Platform Roles

In the platform namespace (mural-system by default, distinct from the System scope's pai-system), PaletteAI creates one read-only Role per discovered persona tier:

Role	Purpose
`mural-project-viewer`	Read-only access to platform definitions
`mural-project-editor`	Read-only access to platform definitions
`mural-project-admin`	Read-only access to platform definitions
`mural-project-<tier>`	Read-only access to platform definitions (custom tiers)

All platform roles share the same read-only permissions regardless of tier. For each Project created, role bindings are created in the mural-system namespace to grant Project users access to platform-level definitions. These role bindings map each persona's OIDC groups to the matching platform role, allowing users to access platform-level definitions in addition to Project-level definitions.

Each role binding is named <project-name>-mural-project-<tier> and binds the Project's OIDC groups for that tier to the corresponding platform role in the mural-system namespace.

The following permissions are applied to the mural-system namespace only.

Resources	Permissions	API
`ConfigMap`	`get`, `list`, `watch`	`v1`
`ScalingPolicy`	`get`, `list`, `watch`	`spectrocloud.com/v1alpha1`
`ComponentDefinition`	`get`, `list`, `watch`	`spectrocloud.com/v1beta1`
`DefinitionRevision`	`get`, `list`, `watch`	`spectrocloud.com/v1beta1`
`PolicyDefinition`	`get`, `list`, `watch`	`spectrocloud.com/v1beta1`
`ProfileBundle`	`get`, `list`, `watch`	`spectrocloud.com/v1beta1`
`TraitDefinition`	`get`, `list`, `watch`	`spectrocloud.com/v1beta1`
`WorkloadDeployment`	`get`, `list`, `watch`	`spectrocloud.com/v1beta1`
`WorkloadProfile`	`get`, `list`, `watch`	`spectrocloud.com/v1beta1`

info

The ConfigMap permissions are resource-specific. They only grant access to the mural-feature-flags and branding ConfigMaps in the platform namespace.

Tenant Role Permissions​

Tenant Admin Cluster Permissions​

Tenant Admin Namespace Permissions​

Tenant Namespace Permissions​

Shared Tenant-Scoped Resource Permissions​

Project Role Permissions​

Core Project Roles​

Viewer Role Permissions​

Editor Role Permissions​

Admin Role Permissions​

Custom Project Role Tiers​

Platform Roles​