---
title: "Managing IAM authentication user (ConfigMap)"
slug: "k8s-iam-auth-management-configmap"
updated: 2026-09-17T09:33:15Z
published: 2026-09-17T09:33:15Z
canonical: "guide.ncloud-docs.com/k8s-iam-auth-management-configmap"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://guide.ncloud-docs.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Managing IAM authentication user (ConfigMap)

Available in VPC

When creating a cluster, both the SubAccount that created the cluster and the main account are automatically set as the system:masters group within the cluster's RBAC configuration. This setting is not displayed in the cluster information or ConfigMaps. In order to give usage permissions a cluster to an IAM user, `ncp-auth` ConfigMap must be registered in the kube-system namespace.

              Note

              

You can configure this when the ncp-iam-authenticator is installed and the kubeconfig is created. See [Install ncp-iam-authenticator](/docs/en/k8s-iam-auth-ncp-iam-authenticator), and [Create IAM authentication kubeconfig](/docs/en/k8s-iam-auth-kubeconfig).

### Add IAM user to cluster

1. The kubectl credentials must be configured with the SubAccount user who created the cluster or the main account.
2. Create `ncp-auth` ConfigMap.

```
$ cat <<EOF | kubectl --kubeconfig $KUBE_CONFIG apply -f -
apiVersion: v1
kind: ConfigMap
metadata:
  name: ncp-auth
  namespace: kube-system
data:
  mapSubAccounts: |
    - subAccountIdNo: <iam-user-idno>
      username: <username>
      groups:
        - <groups>
EOF
```

1. ConfigMap's IAM user parameters are as follows:
  - subaccountIdNo: the ID of the SubAccount user to be added that can be checked on the SubAccount console
  - username: the name of the user to be mapped to the IAM user in Kubernetes
  - groups: list of groups to be mapped to users in Kubernetes For more details, see [Default roles and role bindings](https://kubernetes.io/docs/en/reference/access-authn-authz/rbac/#default-roles-and-role-bindings).
2. `ncp-auth` You can check the list of applied users through the ncloud.com/applied-ncp-auth annotation in the ConfigMap.

```
$ kubectl --kubeconfig $KUBE_CONFIG -n kube-system get configmap ncp-auth -o yaml
...
metadata:
  annotations:
     ncloud.com/applied-ncp-auth: '[{"SubAccountIdNo":"<iam-user-idno>","Username":"<username>","Groups":["<groups>"]}]'
...
```

1. Check if the IAM user, or the user or user group with a role mapped, is bound to a Kubernetes role by using RoleBinding or ClusterRoleBinding. For more information, see [Using RBAC Authorization](https://kubernetes.io/docs/en/reference/access-authn-authz/rbac/) in the Kubernetes documents.

- Permission to view resources in all namespaces - The group name is full-access-group, and this needs to be mapped to the IAM user groups in the `ncp-auth` ConfigMap.

              Note

              

- Full-access-group holds many permissions, but it is not the master authority for the cluster manager.
- If the cluster master authority is needed, you can map the relevant user to the [system:masters](https://kubernetes.io/docs/en/reference/access-authn-authz/rbac/#user-facing-roles) group offered by default.

```
$ cat <<EOF | kubectl --kubeconfig $KUBE_CONFIG apply -f -  
apiVersion: rbac.authorization.k8s.io/v1  
kind: ClusterRole  
metadata:  
 name: full-access-clusterrole  
rules:  
- apiGroups:  
  - ""  
  resources:  
  - nodes  
  - namespaces  
  - pods  
  verbs:  
  - get  
  - list  
- apiGroups:  
  - apps  
  resources:  
  - deployments  
  - daemonsets  
  - statefulsets  
  - replicasets  
  verbs:  
  - get  
  - list  
- apiGroups:  
  - batch  
  resources:  
  - jobs  
  verbs:  
  - get  
  - list  
---  
apiVersion: rbac.authorization.k8s.io/v1  
kind: ClusterRoleBinding  
metadata:  
 name: full-access-binding  
subjects:  
- kind: Group  
  name: full-access-group  
  apiGroup: rbac.authorization.k8s.io  
roleRef:  
 kind: ClusterRole  
 name: full-access-clusterrole  
 apiGroup: rbac.authorization.k8s.io  
EOF
```

- Permission to view resources for a specific namespace - As the namespace set to the file is restricted-access-group, specify the namespace you want and edit it. The group name is restricted-access-group, and this needs to be mapped to IAM user groups in the `ncp-auth` ConfigMap.

```
$ cat <<EOF | kubectl --kubeconfig $KUBE_CONFIG apply -f -  
apiVersion: rbac.authorization.k8s.io/v1  
kind: ClusterRole  
metadata:  
  name: restricted-access-clusterrole  
rules:  
- apiGroups:  
  - ""  
  resources:  
  - nodes  
  - namespaces  
  verbs:  
  - get  
  - list  
---  
apiVersion: rbac.authorization.k8s.io/v1  
kind: ClusterRoleBinding  
metadata:  
  name: restricted-access-clusterrole-binding  
subjects:  
- kind: Group  
  name: restricted-access-group  
  apiGroup: rbac.authorization.k8s.io  
roleRef:  
  kind: ClusterRole  
  name: restricted-access-clusterrole  
  apiGroup: rbac.authorization.k8s.io  
---  
apiVersion: rbac.authorization.k8s.io/v1  
kind: Role  
metadata:  
  namespace: default  
  name: restricted-access-role  
rules:  
- apiGroups:  
  - ""  
  resources:  
  - pods  
  verbs:  
  - get  
  - list  
- apiGroups:  
  - apps  
  resources:  
  - deployments  
  - daemonsets  
  - statefulsets  
  - replicasets  
  verbs:  
  - get  
  - list  
- apiGroups:  
  - batch  
  resources:  
  - jobs  
  verbs:  
  - get  
  - list  
---  
apiVersion: rbac.authorization.k8s.io/v1  
kind: RoleBinding  
metadata:  
  name: restricted-access-role-binding  
  namespace: default  
subjects:  
- kind: Group  
  name: restricted-access-group  
  apiGroup: rbac.authorization.k8s.io  
roleRef:  
  kind: Role  
  name: restricted-access-role  
  apiGroup: rbac.authorization.k8s.io  
EOF
```

### Authenticate all without registering them in mapSubAccounts

1. If you add the authenticateAll value to the `ncp-auth` ConfigMap as true, all SubAccount accounts are authenticated even if they are not added to mapSubAccounts.

```
$ cat <<EOF | kubectl --kubeconfig $KUBE_CONFIG apply -f -  
apiVersion: v1  
kind: ConfigMap  
metadata:  
  name: ncp-auth  
  namespace: kube-system  
data:  
  authenticateAll: "true"  
EOF
```

1. Authenticated users must use RoleBinding or ClusterRoleBinding to ensure that Kubernetes users or groups are bound to a Kubernetes role in the same way as [SubAccount users are added to the cluster](/docs/en/k8s-iam-auth-management#iam-%EC%82%AC%EC%9A%A9%EC%9E%90%EB%A5%BC-%ED%81%B4%EB%9F%AC%EC%8A%A4%ED%84%B0%EC%97%90-%EC%B6%94%EA%B0%80).

### Use SubAccount group as Kubernetes group

1. SubAccount users belonging to the SubAccount group will be included in the Kubernetes group to which ncp-sub-account-group: is added as a prefix.
2. An example of granting full-access-clusterrole to all users belonging to the SubAccount group called full-access is as follows:

```
$ cat <<EOF | kubectl --kubeconfig $KUBE_CONFIG apply -f -  
apiVersion: rbac.authorization.k8s.io/v1  
kind: ClusterRole  
metadata:  
 name: full-access-clusterrole  
rules:  
- apiGroups:  
  - ""  
  resources:  
  - nodes  
  - namespaces  
  - pods  
  verbs:  
  - get  
  - list  
- apiGroups:  
  - apps  
  resources:  
  - deployments  
  - daemonsets  
  - statefulsets  
  - replicasets  
  verbs:  
  - get  
  - list  
- apiGroups:  
  - batch  
  resources:  
  - jobs  
  verbs:  
  - get  
  - list  
---  
apiVersion: rbac.authorization.k8s.io/v1  
kind: ClusterRoleBinding  
metadata:  
 name: full-access-binding  
subjects:  
- kind: Group  
  name: ncp-sub-account-group:full-access  
  apiGroup: rbac.authorization.k8s.io  
roleRef:  
 kind: ClusterRole  
 name: full-access-clusterrole  
 apiGroup: rbac.authorization.k8s.io  
EOF
```