Authorization in OpenShift is built around the following concepts:
- Rules: Sets of actions allowed to be performed on specific resources.
- Roles: Collections of rules that allow them to be applied to a user according to a specific usage profile. Roles can be applied either at the cluster or project level.
- Role bindings: Associations between users/groups and roles. A given user or group can be associated with multiple roles.
Let's return to our MiniShift environment. To see a list of all available cluster roles, run the following command:
$ oc get clusterrole
NAME
admin
basic-user
cluster-admin
...
<output omitted>
...
view
Use the describe command to understand what rules are in a particular role:
$ oc describe clusterrole/edit
...
<output omitted>
...
You can see from the preceding output that, for example, users with this role...