> For the complete documentation index, see [llms.txt](https://docs.acecloud.ai/knowledge-base/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.acecloud.ai/knowledge-base/kubernetes-hosted/how-to-configure-rbac-for-a-hosted-kubernetes-cluster.md).

# How to Configure RBAC for a Hosted Kubernetes Cluster?

## **Overview**

Role-Based Access Control (RBAC) in Hosted Kubernetes allows you to control who can access a Kubernetes cluster and what actions they can perform.

The **RBAC** tab provides two options:

* **Access Policies** – View standard policies and create custom policies.
* **Access Rules** – Grant and revoke cluster access for users or groups by assigning an access policy.

![](/files/QefR99hJ7c05RUzxIHW1)

## **Access Policies**

The **Access Policies** tab displays the policies available for the cluster.

### **Standard Policies**

Standard policies are applied automatically and cannot be modified from the cluster.

The following standard policies are available:

| **Policy**        | **Kind**     | **Scope** |
| ----------------- | ------------ | --------- |
| **Admin**         | Cluster Role | Cluster   |
| **Cluster Admin** | Cluster Role | Cluster   |
| **Editor**        | Cluster Role | Cluster   |
| **Viewer**        | Cluster Role | Cluster   |

The **Rules** column displays the number of permissions associated with each policy.

### **Custom Policies**

You can create custom policies to define your own permission sets according to your requirements.

To create a custom policy:

1. Go to the **RBAC** tab of the required Hosted Kubernetes cluster.
2. Select **Access Policies**.
3. Under **Custom policies**, click **Create custom policy**.

![](/files/VATm4b93iT7JB7PHRp0N)

4. Configure the required permissions.
5. Save the custom policy.

The created policy is then available for assignment through **Access Rules**.

## **Grant Cluster Access**

The **Access Rules** tab allows you to assign an access policy to a user or group.

To grant access:

1. Select **Access Rules**.

![](/files/WfguLOGpq1HWnq2Bbz2u)

2. Under **Grant cluster access**, enter a **Binding name**.
3. Under **Who**, select one of the following:

* **a. Group** – Grant access to a group.
* **b. User** – Grant access to an individual user.

4. Select the required group or user.
5. Under **Access policy**, select the policy to assign.
6. Under **Where**, select the access scope:

* **Entire cluster** – Grants access across the cluster.
* **Specific namespace** – Restricts access to a specific namespace.

7. Review the **Binding preview** to verify the selected subject, policy, and scope.
8. Click **Grant access**.

![](/files/9wW8HqyH6F9nid6I98Cm)

The new binding is added to the **Active access rules** section.

## **View Active Access Rules**

The **Active access rules** section displays the access bindings currently configured for the cluster.

The table includes information such as:

* **Name** – Name of the access binding.
* **Subject** – User or group assigned to the policy.
* **Policy** – Access policy assigned to the subject.
* **Scope** – Whether access applies cluster-wide or to a specific namespace.
* **Granted On** – Time when the access was granted.
* **Actions** – Available action for the access rule.

Use the search field to search for a specific subject, policy, or access rule.

![](/files/KsLjQpR2js9Xz9MzDIaE)

## **Revoke Cluster Access**

You can revoke an existing access rule from the **Active access rules** section.

1. Go to **RBAC > Access Rules**.
2. Locate the access rule that you want to remove.
3. Click **Revoke** in the **Actions** column.

![](/files/9CNUMzUZl8wbbSsC1ZTv)

4. Confirm the action.

The access rule is removed, and the associated user or group no longer has access through that binding.

**Note:** The access revocation may take up to **15 minutes** to take effect when the user's access token is refreshed. For the change to take effect immediately, revoke the user's **KubeConfig** from **IAM** and ask the user to download a new KubeConfig from the AceCloud portal.

**Note:** Assign permissions according to the user's or group's responsibilities. Use namespace-specific access where cluster-wide permissions are not required.