--- title: "IAM認証ユーザーの管理(アクセス項目)" slug: "k8s-iam-auth-management-access-entry" updated: 2026-09-17T09:31:52Z published: 2026-09-17T09:31:52Z canonical: "guide.ncloud-docs.com/k8s-iam-auth-management-access-entry" --- > ## Documentation Index > Fetch the complete documentation index at: https://guide.ncloud-docs.com/llms.txt > Use this file to discover all available pages before exploring further. # IAM認証ユーザーの管理(アクセス項目) VPC環境で利用できます。 クラスタ作成時にブートストラップクラスタ管理者許可を選択するか、[クラスタ詳細] - [認証] タブで AccessEntryを追加してアクセスできるプリンシパルを登録します ### クラスタを作成したアクセス項目をクラスタ管理者として追加 1. クラスタ作成画面の**ブートストラップクラスタ管理者アクセス**項目で**クラスタ管理者アクセス許可**を選択します。 2. クラスタ作成をリクエストしたユーザーが [アクセス] - [AccessEntry]に IAMアクセス項目 NRNで登録されます。 参考 アクセス項目方式のクラスタは、SubAccountでクラスタを作成する際、メインアカウントがクラスタ管理者として自動追加されません。 ### アクセス項目をクラスタに追加 1. [クラスタ詳細画面] - [アクセスタブ] - [AccessEntry] - [作成する] ボタンをクリックします。 2. 追加するアクセス項目の情報を入力します。 - IAMプリンシパル: ポリシーを適用するアクセス項目の NRN - グループ(任意項目): クラスタで認証されるユーザーグループ。(最大30個) - Policy: プリンシパルに適用されるクラスタアクセスポリシーのリスト。 - Scope: ポリシーの適用範囲(Cluster/Namespace) - Namespaces(任意項目): Scopeが Namespaceの場合、ポリシーが適用される Namespaceのリスト。「*-ns」でパターン指定可能。(最大50個) - Policy: 適用されるポリシー - NKSClusterAdminPolicy: クラスタのすべての権限を保有 - NKSAdminPolicy: リソースのほとんどの権限を保有 - NKSEditPolicy: 書き込み権限を保有 - NKSViewPolicy: 読み取り権限を保有 1. [作成] ボタンをクリックしてポリシーを登録します。 2. 登録されたプリンシパルの AccessKeyで権限が付与されたか確認します。 ### アクセスポリシー Ncloud Kubernetes Serviceクラスタの IAM認証**アクセス項目**に適用できるポリシーには、`NKSClusterAdminPolicy`、`NKSAdminPolicy`、`NKSEditPolicy`、`NKSViewPolicy`があります。 注意 - Managed NKSの場合、以下の権限でノード、システム Namespaceなどのリソースの使用やユーザーの成り代わりなどが制限されます。 - アクセスポリシーを通じて適用された権限は kubectl auth can-i --listコマンドで確認できません。 - ユーザー/グループに成り代わって kubectlコマンドを使用する場合、アクセス項目に適用されたアクセスポリシーは適用されません。 - NKSClusterAdminPolicy すべての権限 - NKSAdminPolicy | APIグループ | リソース | 動詞 | | --- | --- | --- | | apps | daemonsets, deployments, deployments/rollback, deployments/scale, replicasets, replicasets/scale, statefulsets, statefulsets/scale | create, delete, deletecollection, patch, update | | apps | controllerrevisions, daemonsets, daemonsets/status, deployments, deployments/scale, deployments/status, replicasets, replicasets/scale, replicasets/status, statefulsets, statefulsets/scale, statefulsets/status | get, list, watch | | authorization.k8s.io | localsubjectaccessreviews | create | | autoscaling | horizontalpodautoscalers | create, delete, deletecollection, patch, update | | autoscaling | horizontalpodautoscalers, horizontalpodautoscalers/status | get, list, watch | | batch | cronjobs, jobs | create, delete, deletecollection, patch, update | | batch | cronjobs, cronjobs/status, jobs, jobs/status | get, list, watch | | discovery.k8s.io | endpointslices | get, list, watch | | extensions | daemonsets, deployments, deployments/rollback, deployments/scale, ingresses, networkpolicies, replicasets, replicasets/scale, replicationcontrollers/scale | create, delete, deletecollection, patch, update | | extensions | daemonsets, daemonsets/status, deployments, deployments/scale, deployments/status, ingresses, ingresses/status, networkpolicies, replicasets, replicasets/scale, replicasets/status, replicationcontrollers/scale | get, list, watch | | networking.k8s.io | ingresses, ingresses/status, networkpolicies | get, list, watch | | networking.k8s.io | ingresses, networkpolicies | create, delete, deletecollection, patch, update | | policy | poddisruptionbudgets | create, delete, deletecollection, patch, update | | policy | poddisruptionbudgets, poddisruptionbudgets/status | get, list, watch | | rbac.authorization.k8s.io | rolebindings, roles | create, delete, deletecollection, get, list, patch, update, watch | | | configmaps, endpoints, persistentvolumeclaims, persistentvolumeclaims/status, pods, replicationcontrollers, replicationcontrollers/scale, serviceaccounts, services, services/status | get,list, watch | | | pods/attach, pods/exec, pods/portforward, pods/proxy, secrets, services/proxy | get, list, watch | | | configmaps, events, persistentvolumeclaims, replicationcontrollers, replicationcontrollers/scale, secrets, serviceaccounts, services, services/proxy | create, delete, deletecollection, patch, update | | | pods, pods/attach, pods/exec, pods/portforward, pods/proxy | create, delete, deletecollection, patch, update | | | serviceaccounts | impersonate | | | bindings, events, limitranges, namespaces/status, pods/log, pods/status, replicationcontrollers/status, resourcequotas, resourcequotas/status | get, list, watch | | | namespaces | get,list, watch | - NKSEditPolicy | APIグループ | リソース | 動詞 | | --- | --- | --- | | apps | daemonsets, deployments, deployments/rollback, deployments/scale, replicasets, replicasets/scale, statefulsets, statefulsets/scale | create, delete, deletecollection, patch, update | | apps | controllerrevisions, daemonsets, daemonsets/status, deployments, deployments/scale, deployments/status, replicasets, replicasets/scale, replicasets/status, statefulsets, statefulsets/scale, statefulsets/status | get, list, watch | | autoscaling | horizontalpodautoscalers, horizontalpodautoscalers/status | get, list, watch | | autoscaling | horizontalpodautoscalers | create, delete, deletecollection, patch, update | | batch | cronjobs, jobs | create, delete, deletecollection, patch, update | | batch | cronjobs, cronjobs/status, jobs, jobs/status | get, list, watch | | discovery.k8s.io | endpointslices | get, list, watch | | extensions | daemonsets, deployments, deployments/rollback, deployments/scale, ingresses, networkpolicies, replicasets, replicasets/scale, replicationcontrollers/scale | create, delete, deletecollection, patch, update | | extensions | daemonsets, daemonsets/status, deployments, deployments/scale, deployments/status, ingresses, ingresses/status, networkpolicies, replicasets, replicasets/scale, replicasets/status, replicationcontrollers/scale | get, list, watch | | networking.k8s.io | ingresses, networkpolicies | create, delete, deletecollection, patch, update | | networking.k8s.io | ingresses, ingresses/status, networkpolicies | get, list, watch | | policy | poddisruptionbudgets | create, delete, deletecollection, patch, update | | policy | poddisruptionbudgets, poddisruptionbudgets/status | get, list, watch | | | namespaces | get, list, watch | | | pods/attach, pods/exec, pods/portforward, pods/proxy, secrets, services/proxy | get, list, watch | | | serviceaccounts | impersonate | | | pods, pods/attach, pods/exec, pods/portforward, pods/proxy | create, delete, deletecollection, patch, update | | | configmaps, events, persistentvolumeclaims, replicationcontrollers, replicationcontrollers/scale, secrets, serviceaccounts, services, services/proxy | create, delete, deletecollection, patch, update | | | configmaps, endpoints, persistentvolumeclaims, persistentvolumeclaims/status, pods, replicationcontrollers, replicationcontrollers/scale, serviceaccounts, services, services/status | get, list, watch | | | bindings, events, limitranges, namespaces/status, pods/log, pods/status, replicationcontrollers/status, resourcequotas, resourcequotas/status | get, list, watch | - NKSViewPolicy | APIグループ | リソース | 動詞 | | --- | --- | --- | | apps | controllerrevisions, daemonsets, daemonsets/status, deployments, deployments/scale, deployments/status, replicasets, replicasets/scale, replicasets/status, statefulsets, statefulsets/scale, statefulsets/status | get, list, watch | | autoscaling | horizontalpodautoscalers, horizontalpodautoscalers/status | get, list, watch | | batch | cronjobs, cronjobs/status, jobs, jobs/status | get, list, watch | | discovery.k8s.io | endpointslices | get, list, watch | | extensions | daemonsets, daemonsets/status, deployments, deployments/scale, deployments/status, ingresses, ingresses/status, networkpolicies, replicasets, replicasets/scale, replicasets/status, replicationcontrollers/scale | get, list, watch | | networking.k8s.io | ingresses, ingresses/status, networkpolicies | get, list, watch | | policy | poddisruptionbudgets, poddisruptionbudgets/status | get, list, watch | | | configmaps, endpoints, persistentvolumeclaims, persistentvolumeclaims/status, pods, replicationcontrollers, replicationcontrollers/scale, serviceaccounts, services, services/status | get, list, watch | | | bindings, events, limitranges, namespaces/status, pods/log, pods/status, replicationcontrollers/status, resourcequotas, resourcequotas/status | get, list, watch | | | namespaces | get, list, watch |