// Module included in the following assemblies:
//
// * ai_workloads/kueue/rbac-permissions.adoc

:_mod-docs-content-type: PROCEDURE
[id="configure-rbac-batch-users_{context}"]
= Configuring permissions for users

You can configure permissions for {kueue-name} users by binding the `kueue-batch-user-role` cluster role to a user or group of users.

.Prerequisites

include::snippets/prereqs-snippet-yaml-admin.adoc[]

.Procedure

. Create a `RoleBinding` object as a YAML file:
+
.Example `ClusterRoleBinding` object
[source,yaml]
----
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: kueue-users <1>
  namespace: user-namespace <2>
subjects: <3>
- kind: Group
  name: team-a@example.com
  apiGroup: rbac.authorization.k8s.io
roleRef: <4>
  kind: ClusterRole
  name: kueue-batch-user-role
  apiGroup: rbac.authorization.k8s.io

----
<1> Provide a name for the `RoleBinding` object.
<2> Add details about which namespace the `RoleBinding` object applies to.
<3> Add details about which user or group of users you want to provide user permissions for.
<4> Add details about the `kueue-batch-user-role` cluster role.

. Apply the `RoleBinding` object:
+
[source,terminal]
----
$ oc apply -f <filename>.yaml
----

.Verification

* You can verify that the `RoleBinding` object was applied correctly by running the following command and verifying that the output contains the correct information for the `kueue-batch-user-role` cluster role:
+
[source,yaml]
----
$ oc describe rolebinding.rbac
----
+
.Example output
[source,terminal]
----
...
Name:         kueue-users
Labels:       app.kubernetes.io/name=kueue
Annotations:  <none>
Role:
  Kind:  ClusterRole
  Name:  kueue-batch-user-role
Subjects:
  Kind            Name                      Namespace
  ----            ----                      ---------
  Group           team-a@example.com        user-namespace
...
----
