Granular RBAC Permissions Reference (Beta)

Full capability-by-capability permissions reference for PCD's Granular Role-Based Access Control (Beta): what each of the six roles can do, grouped by resource area.

Overview

Beta

Granular Role-Based Access Control is currently in beta. Production use is not recommended at this time. If these role options are not available in your deployment, contact Platform9 support.

This page lists what each of the six granular RBAC roles can do, grouped by resource area. Yes means the role can perform that capability; No means it cannot. For role definitions and how to assign these roles to users, see Granular RBAC Roles (Beta).

Granular Self-Service User vs. built-in Self-Service User

The Self-Service User column on this page describes the granular RBAC Self-Service User role only. It is distinct from the built-in or legacy Self-Service User role, even though the display names are similar. For example, the granular RBAC Self-Service User is denied some capabilities that may be available through the built-in OpenStack member-style role, such as live migration, cold migration, and volume snapshot operations.

Scope of this reference

This reference covers capabilities enforced by Private Cloud Director's core compute, storage, and networking policy engine (identity, compute, storage, and networking). Some areas — including compute cluster and blueprint management, service agent administration, custom roles, audit logging, monitoring, and add-on services such as Kubernetes-as-a-Service, DNS-as-a-Service, and load-balancing-as-a-Service — are not yet covered by this policy engine and are intentionally omitted rather than shown as denied.

A small number of capabilities (roughly 8% of the role/capability combinations on this page) may not yet fully match the access described here while the policy engine is in beta. This reference documents the intended, designed behavior for each role.

Domains & Tenants

Capability	Platform Admin	SP Admin	Cust. Domain Admin	Self-Service User	Tenant Admin	Tenant User
Domains — Read - list all domains (global)	Yes	Yes	No	No	No	No
Domains — Read - list domains assigned to me	Yes	Yes	Yes	Yes	Yes	Yes
Tenants — Read - list all tenants (global)	Yes	Yes	No	No	No	No
Tenants — Read - list tenants in scope	Yes	Yes	Yes	Yes	Yes	Yes
Tenants — Read - get tenant details	Yes	Yes	Yes	Yes	Yes	Yes
Tenants — Create - tenant in a domain	Yes	Yes	No	No	No	No
Tenants — Update - rename or edit tenant	Yes	Yes	No	No	No	No
Tenants — Delete - delete tenant	Yes	Yes	No	No	No	No
Cross-tenant resources — Read - view resources owned by other tenants	Yes	Yes	Yes	No	No	No

9 capabilities.

Users, Groups & Role Assignments

Capability	Platform Admin	SP Admin	Cust. Domain Admin	Self-Service User	Tenant Admin	Tenant User
Domain User — Create - provision user in domain	Yes	Yes	Yes	No	No	No
Domain User — Read - list / get user	Yes	Yes	Yes	No	Yes	No
Domain User — Update profile / password / status	Yes	Yes	Yes	No	Yes	No
Domain User — Update enable / disable user	Yes	Yes	Yes	No	Yes	No
Domain User — Delete remove user from domain	Yes	Yes	Yes	No	No	No
Group — Create - domain group	Yes	Yes	Yes	No	No	No
Group — Read list / get	Yes	Yes	Yes	No	Yes	No
Group — Update group membership	Yes	Yes	Yes	No	No	No
Group — Delete group	Yes	Yes	Yes	No	No	No
User to Tenant assignment — Create add existing user to tenant	Yes	Yes	Yes	No	Yes	No
User to Tenant assignment — Delete - remove user from tenant	Yes	Yes	Yes	No	Yes	No
Role Binding (tenant) — Create / Update / Delete role binding within tenant	Yes	Yes	Yes	No	Yes	No
Role Binding (tenant) — Read	Yes	Yes	Yes	No	Yes	No
Role Binding (cross tenant in domain) — Create / Update / Delete	Yes	Yes	Yes	No	No	No
Role Binding (cross-domain) — Create / Update / Delete (with explicit grant)	Yes	No	No	No	No	No
IdP Binding — Create bind external IdP to domain	Yes	Yes	Yes	No	No	No
IdP Binding — Read list / get	Yes	Yes	No	No	No	No
IdP Binding — Update - rotate cert / group mappings	Yes	No	No	No	No	No
IdP Binding — Delete - unbind IdP	Yes	Yes	No	No	No	No

19 capabilities.

Quotas

Capability	Platform Admin	SP Admin	Cust. Domain Admin	Self-Service User	Tenant Admin	Tenant User
Quota - Security Groups per tenant — Update set	Yes	No	No	No	No	No
Quota - Security Groups per tenant — Read usage	Yes	Yes	Yes	Yes	Yes	Yes
Quota - Security Group Rules per tenant — Update set	Yes	No	No	No	No	No
Quota - Security Group Rules per tenant — Read usage	Yes	Yes	Yes	Yes	Yes	Yes
Tenant Quota - compute (vCPU, RAM, instances) — Update - set tenant quota	Yes	No	No	No	No	No
Tenant Quota - compute — get quota + usage	Yes	Yes	Yes	Yes	Yes	Yes
Tenant Quota - storage (GB, volumes, snapshots) — Update - set tenant quota	Yes	No	No	No	No	No
Tenant Quota - storage — Read	Yes	Yes	Yes	Yes	Yes	Yes
Tenant Quota - network (FIPs, networks, routers, SGs) — Update - set tenant quota	Yes	No	No	No	No	No
Tenant Quota - network — Read	Yes	Yes	Yes	Yes	Yes	Yes
Per-user Quota within tenant — Update - set	Yes	No	No	No	Yes	No
Per-user Quota within tenant — Read	Yes	Yes	Yes	Yes	Yes	Yes

12 capabilities.

Platform-Managed Compute Resources

Capability	Platform Admin	SP Admin	Cust. Domain Admin	Self-Service User	Tenant Admin	Tenant User
Host (hypervisor) — Read - list hosts (full detail)	Yes	No	No	No	No	No
Host (hypervisor) — Read - host CPU/RAM/GPU capacity	Yes	No	No	No	No	No
Host (hypervisor) — Update - drain / maintenance mode	Yes	No	No	No	No	No
Host (hypervisor) — Update - evacuate VMs from host	Yes	No	No	No	No	No
Platform Image — Create - upload image	Yes	Yes	Yes	No	No	No
Platform Image — Read - list / get image	Yes	Yes	Yes	Yes	Yes	Yes
Platform Image — Update - metadata / properties	Yes	Yes	Yes	No	No	No
Platform Image — Update - visibility (public/private/shared)	Yes	Yes	Yes	No	No	No
Platform Image — Delete - platform image	Yes	Yes	Yes	No	No	No
Domain-published Image — Create - publish image to domain catalog	Yes	Yes	Yes	No	No	No
Domain-published Image — Read - list domain catalog	Yes	Yes	Yes	Yes	Yes	No
Domain-published Image — Delete - unpublish from domain	Yes	Yes	Yes	No	No	No
Platform Flavor — Create - define platform flavor	Yes	Yes	Yes	No	No	No
Platform Flavor — Read - list / get flavors	Yes	Yes	Yes	Yes	Yes	No
Platform Flavor — Update - flavor extra-specs	Yes	Yes	Yes	No	No	No
Platform Flavor — Delete - platform flavor	Yes	Yes	Yes	No	No	No
Tenant-scoped Flavor — Create - private tenant flavor	Yes	Yes	Yes	No	Yes	No
Tenant-scoped Flavor — Read / Update / Delete	Yes	Yes	Yes	No	Yes	No
Volume Type — Create - volume type	Yes	Yes	Yes	No	No	No
Volume Type — Read - list / get	Yes	Yes	Yes	Yes	Yes	No
Volume Type — Update - settings	Yes	Yes	Yes	No	No	No
Volume Type — Delete - volume type	Yes	Yes	Yes	No	No	No
Tenant Default Volume Type — Update - set default for tenant	Yes	No	No	No	No	No

23 capabilities.

Virtual Machines

Capability	Platform Admin	SP Admin	Cust. Domain Admin	Self-Service User	Tenant Admin	Tenant User
Virtual Machine — Create - boot VM	Yes	Yes	Yes	Yes	Yes	Yes
Virtual Machine — Read - list / get	Yes	Yes	Yes	Yes	Yes	Yes
Virtual Machine — Update - rename / retag / metadata	Yes	Yes	Yes	Yes	Yes	Yes
Virtual Machine — Update - resize (flavor change)	Yes	Yes	Yes	Yes	Yes	Yes
Virtual Machine — Update - reconfigure (NIC, disk)	Yes	Yes	Yes	Yes	Yes	Yes
Virtual Machine — Update - live migrate	Yes	Yes	Yes	No	Yes	No
Virtual Machine — Update - cold migrate	Yes	Yes	Yes	No	Yes	No
Virtual Machine — Delete - terminate VM	Yes	Yes	Yes	Yes	Yes	Yes
VM Power — Start	Yes	Yes	Yes	Yes	Yes	Yes
VM Power — Stop	Yes	Yes	Yes	Yes	Yes	Yes
VM Power — Reboot (soft)	Yes	Yes	Yes	Yes	Yes	Yes
VM Power — Reboot (hard)	Yes	Yes	Yes	Yes	Yes	Yes
VM Power — Pause / Unpause	Yes	Yes	Yes	Yes	Yes	Yes
VM Power — Suspend / Resume	Yes	Yes	Yes	Yes	Yes	Yes
VM Console — Read	Yes	Yes	Yes	Yes	Yes	Yes
VM Snapshot — Create snapshot VM	Yes	Yes	Yes	Yes	Yes	Yes
SSH Keypair — Create / Read / Update / Delete (own keypair)	Yes	Yes	Yes	Yes	Yes	Yes

17 capabilities.

Storage

Capability	Platform Admin	SP Admin	Cust. Domain Admin	Self-Service User	Tenant Admin	Tenant User
Volume — Create provision volume	Yes	Yes	Yes	Yes	Yes	Yes
Volume — Read list / get	Yes	Yes	Yes	Yes	Yes	Yes
Volume — Update resize	Yes	Yes	Yes	Yes	Yes	Yes
Volume — Update retype	Yes	Yes	Yes	Yes	Yes	Yes
Volume — Update metadata	Yes	Yes	Yes	Yes	Yes	Yes
Volume — Delete volume	Yes	Yes	Yes	Yes	Yes	Yes
Volume Attachment — Create attach volume to VM	Yes	Yes	Yes	Yes	Yes	Yes
Volume Attachment — Delete detach volume	Yes	Yes	Yes	Yes	Yes	Yes
Volume Snapshot — Create snapshot volume	Yes