How to recreate the default roles in the default workspace if accidentally deleted

We have deleted one or more of the three default RBAC roles in the default workspace but still need them. How do I recreate the role?

Once the super-admin role has been deleted from the default workspace or you do not have any Admin user who is a member of that role, you have to turn off RBAC before being able to re-create any of the roles.

Warning: turning off RBAC alone is not enough if admin_gui_auth/admin_gui_session_conf are configured. KONG_ENFORCE_RBAC, KONG_ADMIN_GUI_AUTH, and KONG_ADMIN_GUI_SESSION_CONF must all be disabled together — if RBAC is disabled while admin_gui_auth/admin_gui_session_conf remain set, Kong fails to start with Error: enforce_rbac must be enabled when admin_gui_auth is enabled (live-confirmed). Note this is one-directional: enforce_rbac=on by itself, with no admin_gui_auth/admin_gui_session_conf configured at all, boots fine and correctly enforces RBAC on the Admin API — that combination is not a problem.

Note: if you need to delete an existing role as part of recovering from this (for example, a partially-recreated or duplicate role), an admin cannot delete a role they currently hold themselves — that request returns a 403 (live-confirmed: DELETE /rbac/roles/<role-held-by-caller> → 403 {"message":"the admin should not delete their own roles"}, while deleting a role the same admin does not hold succeeds normally). This also extends to modifying your own role assignments: POST/PUT .../admins/<self>/roles for the currently-authenticated admin fails with 403 {"message":"the admin should not update their own roles"} — live-confirmed. If you’re using the “still have a super-admin user” path below to re-associate a role, associate it to a different admin account, not the one whose credentials you’re currently using. You can only delete/reassign a role you are not a member of; use a different admin account or unassign the role first.

After disabling RBAC (and the two admin GUI auth settings above), you can recreate the three default roles and their permissions with the following API calls:

super-admin role:

1. Create role:

   curl -v -X POST <adminapi-endpoint>/default/rbac/roles -H "content-type: application/json"  -d "{\"name\":\"super-admin\",\"comment\":\"Full access to all endpoints, across all workspaces\"}"

   Copied!

2. Create permissions:

   curl -v -X POST <adminapi-endpoint>/default/rbac/roles/super-admin/endpoints -H "content-type: application/json"  -d "{\"workspace\":\"*\",\"actions\":\"delete,create,update,read\",\"endpoint\":\"*\",\"negative\":false}"

   Copied!

3. Associate role to existing Admin user:

   curl -v -X POST <adminapi-endpoint>/default/admins/<adminNameOrId>/roles -H "content-type: application/json" -d "{\"roles\":\"super-admin\"}"

   Copied!

read-only role:

1. Create role:

   curl -v -X POST <adminapi-endpoint>/default/rbac/roles -H "content-type: application/json" -d "{\"name\":\"read-only\",\"comment\":\"Read access to all endpoints, across all workspace\"}"

   Copied!

2. Create permissions:

   curl -v -X POST <adminapi-endpoint>/default/rbac/roles/read-only/endpoints -H "content-type: application/json" -d "{\"workspace\":\"*\",\"actions\":\"read\",\"endpoint\":\"*\",\"negative\":false}"

   Copied!

admin role:

1. Create role:

   curl -v -X POST <adminapi-endpoint>/default/rbac/roles -H "content-type: application/json"  -d "{\"name\":\"admin\",\"comment\":\"Full access to all endpoints, across all workspaces—except RBAC Admin API\"}"

   Copied!

2. Create permissions:

   curl -v -X POST <adminapi-endpoint>/default/rbac/roles/admin/endpoints -H "content-type: application/json"  -d "{\"workspace\":\"*\",\"actions\":\"delete,create,update,read\",\"endpoint\":\"*\",\"negative\":false}"
   
   curl -v -X <adminapi-endpoint>/default/rbac/roles/admin/endpoints  -H "content-type: application/json" -d "{\"workspace\":\"*\",\"actions\":\"delete,create,update,read\",\"endpoint\":\"rbac/*\",\"negative\":true}"
   
   curl -v -X POST <adminapi-endpoint>/default/rbac/roles/admin/endpoints  -H "content-type: application/json" -d "{\"workspace\":\"*\",\"actions\":\"delete,create,update,read\",\"endpoint\":\"rbac/*/*\",\"negative\":true}"
   
   curl -v -X POST <adminapi-endpoint>/default/rbac/roles/admin/endpoints  -H "content-type: application/json" -d "{\"workspace\":\"*\",\"actions\":\"delete,create,update,read\",\"endpoint\":\"rbac/*/*/*\",\"negative\":true}"
   
   curl -v -X POST <adminapi-endpoint>/default/rbac/roles/admin/endpoints  -H "content-type: application/json" -d "{\"workspace\":\"*\",\"actions\":\"delete,create,update,read\",\"endpoint\":\"rbac/*/*/*/*\",\"negative\":true}"
   
   curl -v -X POST <adminapi-endpoint>/default/rbac/roles/admin/endpoints  -H "content-type: application/json" -H "Kong-Admin-Token: $3" -d "{\"workspace\":\"*\",\"actions\":\"delete,create,update,read\",\"endpoint\":\"rbac/*/*/*/*/*\",\"negative\":true}"

   Copied!

If you still have a super-admin user, and just want to recreate one or both of the other default roles, you can use the above API calls with the addition of the kong-admin-token header: -H kong-admin-token: <yoursuperadmintoken>

If you can not turn off RBAC but need to re-create the super-admin role, please contact Kong Support.