How does RBAC work in Rancher and what are the different permission levels?

Think of Rancher RBAC as a corporate security badge system. Your badge (global role) determines which buildings you can enter, your floor access card (cluster role) determines which floors you can visit within a building, and your office key (project role) determines which rooms and resources you can use on that floor. Each layer narrows your access to exactly what you need.

Rancher's RBAC model builds on top of Kubernetes' native RBAC but adds two important layers: global roles and project roles. At the global level, Rancher defines roles like Administrator (full control of Rancher and all clusters), Standard User (can create new clusters and access assigned clusters), and User-Base (login access only, no cluster permissions). These global roles determine what a user can do across the entire Rancher installation. When a new user logs in through an external authentication provider like LDAP, they are automatically assigned a default global role.

At the cluster level, Rancher provides roles like Cluster Owner (full control of a specific cluster), Cluster Member (can view cluster resources and create projects), and custom roles that you define. Cluster roles map to Kubernetes ClusterRoleBindings under the hood, but Rancher manages them through its own UI and API rather than requiring you to write YAML manifests. When you assign a user a cluster role, Rancher creates the corresponding Kubernetes RBAC objects in the downstream cluster automatically.

Project roles are Rancher's unique addition to Kubernetes RBAC. Since Kubernetes has no concept of projects (only namespaces), Rancher groups namespaces into projects and allows you to assign roles at the project level. Project Owner can manage all resources within the project's namespaces, Project Member can deploy workloads and manage services, and Read-Only can only view resources. For example, the payments-api team gets Project Owner on the 'payments' project, which includes namespaces 'payments-dev,' 'payments-staging,' and 'payments-prod.' They can deploy, scale, and debug within those namespaces but cannot see or modify resources in the 'orders' project managed by a different team.

In production, this layered model is critical for multi-tenant environments. A platform engineering team holds Cluster Owner roles across all clusters, managing node pools, networking, and cluster upgrades. Application teams receive Project Member or Project Owner roles scoped to their projects. External contractors might receive Read-Only project roles, allowing them to view logs and metrics without modifying anything. Custom roles enable fine-grained control: you can create a 'Deployer' role that allows creating and updating deployments but blocks access to secrets, ensuring that CI/CD service accounts cannot read sensitive credentials.