---
title: "Configure user roles and permissions"
description: "Configure roles and permissions for Calico Enterprise features and functions."
product: "Calico Enterprise"
version: "3.21"
section: "Operations"
canonical_url: "https://docs.tigera.io/calico-enterprise/3.21/operations/cnx/roles-and-permissions"
---

# Configure user roles and permissions

## Big picture

Configure roles using Kubernetes RBAC and lock down user permissions to Calico Enterprise features and functions.

## Value

Self-service is an important part of your Kubernetes platform networking and network security. When you allow developers to define policies with guardrails, you create more self-service in the CI/CD process. But network security architects require assurances that developers can access only the resources they are entitled to.

## Concepts

### Kubernetes RBAC authorization

The [Calico Enterprise API server](https://docs.tigera.io/calico-enterprise/3.21/reference/installation/api.md#apiserver) is an extension to the standard [kubernetes rbac authorization apis](https://kubernetes.io/docs/reference/access-authn-authz/rbac/). You configure fine-grained user permissions using `Role`, `ClusterRole`, `RoleBinding`and `ClusterRoleBinding` with the standard RBAC controls: get, list, watch, create, update, patch, delete.

| Features                       | RBAC controls for...                                                                                                                                                                                                                  |
| ------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Network policy                 | - Tiered policy, including AWS security groups and federated services. - Kubernetes network policy (in default tier) - Calico Enterprise network policies including namespaces - Staged policy, policy recommendation, policy preview |
| Compliance                     | Report management, generation, export, and status.                                                                                                                                                                                    |
| Visibility and troubleshooting | Elasticsearch logs: flow, audit, dns, intrusion detection, bgp                                                                                                                                                                        |
| Multi-cluster management       | Management and managed clusters in single management plane.                                                                                                                                                                           |

### Predefined roles and permissions

Calico Enterprise provides the following predefined roles and permissions:

`tigera-ui-user`

- Basic user with access to the Calico Enterprise web console and Kibana:

  - List/view Calico Enterprise policy and tier resources in the `projectcalico.org` and `networking.k8s.io` API groups
  - List/view logs in Kibana

`tigera-network-admin`

- Superuser access for Kibana (including Elastic user and license management), and all Calico resources in `projectcalico.org` and `networking.k8s.io` API groups (get, list, watch, create, update, patch, delete)

## Additional resources

For RBAC details on any given feature, see the feature. For example:

- [Tiered policy RBAC](https://docs.tigera.io/calico-enterprise/3.21/network-policy/policy-tiers/rbac-tiered-policies.md)
- [Policy preview RBAC](https://docs.tigera.io/calico-enterprise/3.21/network-policy/policy-impact-preview.md)
- [Staged policy RBAC](https://docs.tigera.io/calico-enterprise/3.21/network-policy/staged-network-policies.md)
- [Elasticsearch logs RBAC](https://docs.tigera.io/calico-enterprise/3.21/observability/elastic/rbac-elasticsearch.md)
- [Compliance reports RBAC](https://docs.tigera.io/calico-enterprise/3.21/compliance/overview.md)
- [Multi-cluster management RBAC](https://docs.tigera.io/calico-enterprise/3.21/multicluster/set-up-multi-cluster-management/standard-install/create-a-management-cluster.md)