// Module included in the following assemblies:
//
// * ai_workloads/kueue/rbac-permissions.adoc

:_mod-docs-content-type: PROCEDURE
[id="configure-rbac-batch-admins_{context}"]
= Configuring permissions for batch administrators

You can configure permissions for batch administrators by binding the `kueue-batch-admin-role` cluster role to a user or group of users.

.Prerequisites

include::snippets/prereqs-snippet-yaml-admin.adoc[]

.Procedure

. Create a `ClusterRoleBinding` object as a YAML file:
+
.Example `ClusterRoleBinding` object
[source,yaml]
----
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: kueue-admins <1>
subjects: <2>
- kind: User
  name: admin@example.com
  apiGroup: rbac.authorization.k8s.io
roleRef: <3>
  kind: ClusterRole
  name: kueue-batch-admin-role
  apiGroup: rbac.authorization.k8s.io
----
<1> Provide a name for the `ClusterRoleBinding` object.
<2> Add details about which user or group of users you want to provide user permissions for.
<3> Add details about the `kueue-batch-admin-role` cluster role.

. Apply the `ClusterRoleBinding` object:
+
[source,terminal]
----
$ oc apply -f <filename>.yaml
----

.Verification

* You can verify that the `ClusterRoleBinding` object was applied correctly by running the following command and verifying that the output contains the correct information for the `kueue-batch-admin-role` cluster role:
+
[source,yaml]
----
$ oc describe clusterrolebinding.rbac
----
+
.Example output
[source,terminal]
----
...
Name:         kueue-batch-admin-role
Labels:       app.kubernetes.io/name=kueue
Annotations:  <none>
Role:
  Kind:  ClusterRole
  Name:  kueue-batch-admin-role
Subjects:
  Kind            Name                      Namespace
  ----            ----                      ---------
  User            admin@example.com         admin-namespace
...
----
