Inbyggda roller
Alla inbyggda roller och de åtgärder och dataåtgärder de ger.
Genererad från plattformens RBAC-katalog — redigera inte. Listorna över vad som ges expanderar varje rolls jokertecken och undantag mot katalogen.
Apps Operator
Manage app services including deployment, scaling, and configuration.
- Roll-id:
10000000-0000-0000-0000-000000000021 - Deklarerade åtgärder:
apps/read,apps/write,apps/scale,containerinstance/read,containerinstance/write,containerinstance/scale,containerinstance/delete,staticwebapp/read,staticwebapp/write,staticwebapp/scale,staticwebapp/delete,boundaries/read,resourcegroups/read,kernel/activity/write,kernel/operations/read,kernel/resourceStatus/read,monitoring/read,managedidentities/read,search/read,sentinel/read,sentinel/write,boundaries/workloads/read,kernel/deployments/read - Undantagna åtgärder: —
- Deklarerade dataåtgärder:
apps/readLogs,apps/readFiles,apps/writeFiles,staticwebapp/deploy,staticwebapp/readLogs,boundaries/workloads/readLogs - Undantagna dataåtgärder: —
Ger
| Åtgärd | Dataåtgärd | Namn |
|---|---|---|
kernel/deployments/read |
Nej | Deployments/Read |
kernel/activity/write |
Nej | Activity/Write |
kernel/operations/read |
Nej | Operations/Read |
kernel/resourceStatus/read |
Nej | ResourceStatus/Read |
apps/read |
Nej | Apps/Read |
apps/write |
Nej | Apps/Write |
apps/delete |
Nej | Apps/Delete |
apps/scale |
Nej | Apps/Scale |
apps/readLogs |
Ja | Apps/Read Logs |
apps/readFiles |
Ja | Apps/Read Files |
apps/writeFiles |
Ja | Apps/Write Files |
managedidentities/read |
Nej | Managed Identities/Read |
containerinstance/read |
Nej | Container Instance/Read |
containerinstance/write |
Nej | Container Instance/Write |
containerinstance/delete |
Nej | Container Instance/Delete |
containerinstance/scale |
Nej | Container Instance/Scale |
staticwebapp/read |
Nej | Static Web App/Read |
staticwebapp/write |
Nej | Static Web App/Write |
staticwebapp/delete |
Nej | Static Web App/Delete |
staticwebapp/scale |
Nej | Static Web App/Scale |
staticwebapp/deploy |
Ja | Static Web App/Deploy |
staticwebapp/readLogs |
Ja | Static Web App/Read Logs |
boundaries/read |
Nej | Boundaries/Read |
boundaries/workloads/read |
Nej | Boundaries/Workloads Read |
boundaries/workloads/readLogs |
Ja | Boundaries/Workloads Read Logs |
resourcegroups/read |
Nej | Resource Groups/Read |
sentinel/read |
Nej | Sentinel/Read |
sentinel/write |
Nej | Sentinel/Write |
monitoring/read |
Nej | Monitoring/Read |
search/read |
Nej | Search/Read |
Kubernetes RBAC-regler som rollen lägger till utöver sina åtgärder:
| API-grupp | Resurser | Verb | Namn |
|---|---|---|---|
"" |
pods |
get, list, watch |
— |
"" |
pods/exec |
create |
— |
Apps Reader
View app services and their configuration. Cannot make changes.
- Roll-id:
10000000-0000-0000-0000-000000000020 - Deklarerade åtgärder:
apps/read,containerinstance/read,staticwebapp/read,boundaries/read,resourcegroups/read,kernel/activity/write,kernel/operations/read,kernel/resourceStatus/read,monitoring/read,managedidentities/read,search/read,sentinel/read,boundaries/workloads/read,kernel/deployments/read - Undantagna åtgärder: —
- Deklarerade dataåtgärder: —
- Undantagna dataåtgärder: —
Ger
| Åtgärd | Dataåtgärd | Namn |
|---|---|---|
kernel/deployments/read |
Nej | Deployments/Read |
kernel/activity/write |
Nej | Activity/Write |
kernel/operations/read |
Nej | Operations/Read |
kernel/resourceStatus/read |
Nej | ResourceStatus/Read |
apps/read |
Nej | Apps/Read |
managedidentities/read |
Nej | Managed Identities/Read |
containerinstance/read |
Nej | Container Instance/Read |
staticwebapp/read |
Nej | Static Web App/Read |
boundaries/read |
Nej | Boundaries/Read |
boundaries/workloads/read |
Nej | Boundaries/Workloads Read |
resourcegroups/read |
Nej | Resource Groups/Read |
sentinel/read |
Nej | Sentinel/Read |
monitoring/read |
Nej | Monitoring/Read |
search/read |
Nej | Search/Read |
Blueprint Reader
View the template catalog and the container instances deployed from it, and stream their logs. Cannot make changes.
- Roll-id:
10000000-0000-0000-0000-000000000043 - Deklarerade åtgärder:
blueprints/read,containerinstance/read,kernel/crates/read,boundaries/read,resourcegroups/read,kernel/activity/write,kernel/operations/read,kernel/resourceStatus/read,monitoring/read,managedidentities/read,sentinel/read,boundaries/workloads/read,search/read - Undantagna åtgärder: —
- Deklarerade dataåtgärder:
containerinstance/readLogs,containerinstance/access,kernel/crates/readLogs,boundaries/workloads/readLogs - Undantagna dataåtgärder: —
Ger
| Åtgärd | Dataåtgärd | Namn |
|---|---|---|
kernel/activity/write |
Nej | Activity/Write |
kernel/operations/read |
Nej | Operations/Read |
kernel/resourceStatus/read |
Nej | ResourceStatus/Read |
kernel/crates/read |
Nej | Crates/Read |
kernel/crates/readLogs |
Ja | Crates/ReadLogs |
blueprints/read |
Nej | Blueprints/Read |
managedidentities/read |
Nej | Managed Identities/Read |
containerinstance/read |
Nej | Container Instance/Read |
containerinstance/readLogs |
Ja | Container Instance/Read Logs |
containerinstance/access |
Ja | Container Instance/Access |
boundaries/read |
Nej | Boundaries/Read |
boundaries/workloads/read |
Nej | Boundaries/Workloads Read |
boundaries/workloads/readLogs |
Ja | Boundaries/Workloads Read Logs |
resourcegroups/read |
Nej | Resource Groups/Read |
sentinel/read |
Nej | Sentinel/Read |
monitoring/read |
Nej | Monitoring/Read |
search/read |
Nej | Search/Read |
Blueprints Operator
Author blueprint templates and manage the container instances deployed from them, including runtime logs and interactive terminals.
- Roll-id:
10000000-0000-0000-0000-000000000041 - Deklarerade åtgärder:
blueprints/read,blueprints/templates/write,containerinstance/read,containerinstance/write,containerinstance/delete,secretvault/read,secretvault/write,secretvault/writeSecrets,kernel/deployments/read,kernel/crates/read,boundaries/read,resourcegroups/read,kernel/activity/write,kernel/operations/read,kernel/resourceStatus/read,monitoring/read,managedidentities/read,sentinel/read,sentinel/write,boundaries/workloads/read,search/read - Undantagna åtgärder: —
- Deklarerade dataåtgärder:
containerinstance/readLogs,containerinstance/exec,containerinstance/readFiles,containerinstance/writeFiles,containerinstance/access,kernel/crates/readLogs,kernel/crates/exec,boundaries/workloads/readLogs - Undantagna dataåtgärder: —
Ger
| Åtgärd | Dataåtgärd | Namn |
|---|---|---|
kernel/deployments/read |
Nej | Deployments/Read |
kernel/activity/write |
Nej | Activity/Write |
kernel/operations/read |
Nej | Operations/Read |
kernel/resourceStatus/read |
Nej | ResourceStatus/Read |
kernel/crates/read |
Nej | Crates/Read |
kernel/crates/readLogs |
Ja | Crates/ReadLogs |
kernel/crates/exec |
Ja | Crates/Exec |
blueprints/read |
Nej | Blueprints/Read |
blueprints/templates/write |
Nej | Blueprints/Templates/Write |
managedidentities/read |
Nej | Managed Identities/Read |
secretvault/read |
Nej | Secret Vault/Read |
secretvault/write |
Nej | Secret Vault/Write |
secretvault/delete |
Nej | Secret Vault/Delete |
containerinstance/read |
Nej | Container Instance/Read |
containerinstance/write |
Nej | Container Instance/Write |
containerinstance/delete |
Nej | Container Instance/Delete |
containerinstance/readLogs |
Ja | Container Instance/Read Logs |
containerinstance/exec |
Ja | Container Instance/Exec Terminal |
containerinstance/readFiles |
Ja | Container Instance/Read Files |
containerinstance/writeFiles |
Ja | Container Instance/Write Files |
containerinstance/access |
Ja | Container Instance/Access |
boundaries/read |
Nej | Boundaries/Read |
boundaries/workloads/read |
Nej | Boundaries/Workloads Read |
boundaries/workloads/readLogs |
Ja | Boundaries/Workloads Read Logs |
resourcegroups/read |
Nej | Resource Groups/Read |
sentinel/read |
Nej | Sentinel/Read |
sentinel/write |
Nej | Sentinel/Write |
monitoring/read |
Nej | Monitoring/Read |
search/read |
Nej | Search/Read |
Kubernetes RBAC-regler som rollen lägger till utöver sina åtgärder:
| API-grupp | Resurser | Verb | Namn |
|---|---|---|---|
"" |
pods, pods/log |
get, list, watch |
— |
"" |
pods/exec |
create |
— |
Contributor
All control + data actions within a boundary except member management and inviting new users to the boundary. Data Explorer access is OPT-IN — explicit "Database Explorer" assignment required.
- Roll-id:
24000000-0000-0000-0000-000000000000 - Deklarerade åtgärder:
*/* - Undantagna åtgärder:
boundaries/create,boundaries/delete,boundaries/projections/manage,boundaries/members/manage,boundaries/invitations/create,rbac/members/write,rbac/members/admin,rbac/boundaryTrusts/admin,kernel/clusters/write,postgrescluster/restoreSnapshot,postgrescluster/deleteSnapshot,sqlservercluster/restoreSnapshot,sqlservercluster/deleteSnapshot,containerinstance/restoreSnapshot,containerinstance/deleteSnapshot - Deklarerade dataåtgärder:
*/* - Undantagna dataåtgärder:
workflow/readStepIo,postgrescluster/dataRead,postgrescluster/dataWrite,postgrescluster/queryExecute,postgrescluster/queryExecuteWrite,postgrescluster/schemaRead,postgrescluster/schemaWrite,postgrescluster/schemaDrop
Ger
| Åtgärd | Dataåtgärd | Namn |
|---|---|---|
kernel/clusters/read |
Nej | Clusters/Read |
kernel/platform/read |
Nej | Platform/Read |
kernel/platform/diagnose |
Nej | Platform/Diagnose |
kernel/deployments/read |
Nej | Deployments/Read |
kernel/deployments/write |
Nej | Deployments/Write |
kernel/deployments/delete |
Nej | Deployments/Delete |
kernel/deployments/token |
Nej | Deployments/Token |
kernel/activity/read |
Nej | Activity/Read |
kernel/activity/write |
Nej | Activity/Write |
kernel/k8sChannel/read |
Nej | Kubernetes Channel/Read |
kernel/k8sChannel/write |
Nej | Kubernetes Channel/Write |
kernel/k8sChannel/readSecretMetadata |
Nej | Kubernetes Channel/Read Secret Metadata |
kernel/k8sChannel/readNamespacedRbac |
Nej | Kubernetes Channel/Read Namespaced RBAC |
kernel/k8sChannel/readNamespaceDiagnostics |
Nej | Kubernetes Channel/Read Namespace Diagnostics |
kernel/operations/read |
Nej | Operations/Read |
kernel/resourceStatus/read |
Nej | ResourceStatus/Read |
kernel/crates/read |
Nej | Crates/Read |
kernel/crates/readLogs |
Ja | Crates/ReadLogs |
kernel/crates/exec |
Ja | Crates/Exec |
kernel/emailTemplates/manage |
Nej | EmailTemplates/Manage |
kernel/emailSettings/manage |
Nej | EmailSettings/Manage |
kernel/mcpSettings/manage |
Nej | McpSettings/Manage |
kernel/telemetrySettings/manage |
Nej | TelemetrySettings/Manage |
kernel/docsFeedback/export |
Nej | DocsFeedback/Export |
kernel/llmGateways/read |
Nej | LlmGateways/Read |
kernel/llmGateways/write |
Nej | LlmGateways/Write |
kernel/llmGateways/delete |
Nej | LlmGateways/Delete |
kernel/llmGateways/resolve |
Nej | LlmGateways/Resolve |
apps/read |
Nej | Apps/Read |
apps/write |
Nej | Apps/Write |
apps/delete |
Nej | Apps/Delete |
apps/scale |
Nej | Apps/Scale |
apps/readLogs |
Ja | Apps/Read Logs |
apps/readFiles |
Ja | Apps/Read Files |
apps/writeFiles |
Ja | Apps/Write Files |
blueprints/read |
Nej | Blueprints/Read |
blueprints/templates/write |
Nej | Blueprints/Templates/Write |
functions/read |
Nej | Functions/Read |
functions/write |
Nej | Functions/Write |
functions/delete |
Nej | Functions/Delete |
functions/scale |
Nej | Functions/Scale |
functions/readLogs |
Ja | Functions/Read Logs |
jobs/read |
Nej | Jobs/Read |
jobs/write |
Nej | Jobs/Write |
jobs/delete |
Nej | Jobs/Delete |
jobs/readLogs |
Ja | Jobs/Read Logs |
managedidentities/read |
Nej | Managed Identities/Read |
managedidentities/write |
Nej | Managed Identities/Write |
managedidentities/delete |
Nej | Managed Identities/Delete |
managedidentities/readSecrets |
Ja | Managed Identities/Read Tokens |
secretvault/read |
Nej | Secret Vault/Read |
secretvault/write |
Nej | Secret Vault/Write |
secretvault/delete |
Nej | Secret Vault/Delete |
secretvault/readSecrets |
Ja | Secret Vault/Read Secrets |
secretvault/writeSecrets |
Ja | Secret Vault/Write Secrets |
postgrescluster/read |
Nej | Postgres Cluster/Read |
postgrescluster/write |
Nej | Postgres Cluster/Write |
postgrescluster/delete |
Nej | Postgres Cluster/Delete |
postgrescluster/scale |
Nej | Postgres Cluster/Scale |
postgrescluster/createSnapshot |
Nej | Postgres Cluster/Create Snapshot |
postgrescluster/readSecrets |
Ja | Postgres Cluster/Read Secrets |
postgrescluster/writeSecrets |
Ja | Postgres Cluster/Write Secrets |
sqlservercluster/read |
Nej | SQL Server/Read |
sqlservercluster/write |
Nej | SQL Server/Write |
sqlservercluster/delete |
Nej | SQL Server/Delete |
sqlservercluster/scale |
Nej | SQL Server/Scale |
sqlservercluster/createSnapshot |
Nej | SQL Server/Create Snapshot |
sqlservercluster/readSecrets |
Ja | SQL Server/Read Secrets |
sqlservercluster/writeSecrets |
Ja | SQL Server/Write Secrets |
sqlservercluster/manageLicense |
Ja | SQL Server/Manage License |
sqlservercluster/dataRead |
Ja | SQL Server/Data Read |
sqlservercluster/dataWrite |
Ja | SQL Server/Data Write |
sqlservercluster/queryExecute |
Ja | SQL Server/Query Execute |
sqlservercluster/queryExecuteWrite |
Ja | SQL Server/Query Execute Write |
sqlservercluster/schemaRead |
Ja | SQL Server/Schema Read |
sqlservercluster/schemaWrite |
Ja | SQL Server/Schema Write |
sqlservercluster/schemaDrop |
Ja | SQL Server/Schema Drop |
qdrantcluster/read |
Nej | Qdrant Cluster/Read |
qdrantcluster/write |
Nej | Qdrant Cluster/Write |
qdrantcluster/delete |
Nej | Qdrant Cluster/Delete |
qdrantcluster/scale |
Nej | Qdrant Cluster/Scale |
qdrantcluster/readSecrets |
Ja | Qdrant Cluster/Read Secrets |
qdrantcluster/writeSecrets |
Ja | Qdrant Cluster/Write Secrets |
valkey/read |
Nej | Valkey/Read |
valkey/write |
Nej | Valkey/Write |
valkey/delete |
Nej | Valkey/Delete |
valkey/readSecrets |
Ja | Valkey/Read Secrets |
valkey/writeSecrets |
Ja | Valkey/Write Secrets |
workflow/read |
Nej | Workflow/Read |
workflow/write |
Nej | Workflow/Write |
workflow/delete |
Nej | Workflow/Delete |
workflow/trigger |
Ja | Workflow/Trigger |
containerinstance/read |
Nej | Container Instance/Read |
containerinstance/write |
Nej | Container Instance/Write |
containerinstance/delete |
Nej | Container Instance/Delete |
containerinstance/scale |
Nej | Container Instance/Scale |
containerinstance/createSnapshot |
Nej | Container Instance/Create Snapshot |
containerinstance/readLogs |
Ja | Container Instance/Read Logs |
containerinstance/exec |
Ja | Container Instance/Exec Terminal |
containerinstance/readFiles |
Ja | Container Instance/Read Files |
containerinstance/writeFiles |
Ja | Container Instance/Write Files |
containerinstance/access |
Ja | Container Instance/Access |
staticwebapp/read |
Nej | Static Web App/Read |
staticwebapp/write |
Nej | Static Web App/Write |
staticwebapp/delete |
Nej | Static Web App/Delete |
staticwebapp/scale |
Nej | Static Web App/Scale |
staticwebapp/deploy |
Ja | Static Web App/Deploy |
staticwebapp/readLogs |
Ja | Static Web App/Read Logs |
boundaries/tenant/admin |
Nej | Boundaries/Tenant Admin |
boundaries/list |
Nej | Boundaries/List |
boundaries/read |
Nej | Boundaries/Read |
boundaries/manage |
Nej | Boundaries/Manage |
boundaries/projections/read |
Nej | Boundaries/Projections Read |
boundaries/projections/write |
Nej | Boundaries/Projections Write |
boundaries/projections/delete |
Nej | Boundaries/Projections Delete |
boundaries/members/read |
Nej | Boundaries/Members Read |
boundaries/invitations/read |
Nej | Boundaries/Invitations Read |
boundaries/network/read |
Nej | Boundaries/Network Read |
boundaries/workloads/read |
Nej | Boundaries/Workloads Read |
crosslink/admin |
Nej | Crosslink/Admin |
boundaries/workloads/manage |
Nej | Boundaries/Workloads Manage |
boundaries/workloads/readLogs |
Ja | Boundaries/Workloads Read Logs |
pods/exec |
Ja | Pods/Exec |
pods/portForward |
Ja | Pods/Port Forward |
pods/attach |
Ja | Pods/Attach |
pods/log |
Ja | Pods/Log |
secrets/readSecretData |
Ja | Secrets/Read Secret Data |
resourcegroups/read |
Nej | Resource Groups/Read |
resourcegroups/write |
Nej | Resource Groups/Write |
resourcegroups/delete |
Nej | Resource Groups/Delete |
sentinel/read |
Nej | Sentinel/Read |
sentinel/write |
Nej | Sentinel/Write |
sentinel/admin |
Nej | Sentinel/Admin |
monitoring/platform/read |
Nej | Monitoring/Platform/Read |
monitoring/platform/alerts/write |
Nej | Monitoring/Platform/Alerts/Write |
monitoring/read |
Nej | Monitoring/Read |
compliance/read |
Nej | Compliance/Read |
policies/read |
Nej | Policies/Read |
policies/write |
Nej | Policies/Write |
s3storageaccounts/read |
Nej | StorageAccounts/Read |
s3storageaccounts/write |
Nej | StorageAccounts/Write |
s3storageaccounts/delete |
Nej | StorageAccounts/Delete |
s3storageaccounts/admin |
Nej | StorageAccounts/Admin |
s3buckets/read |
Nej | S3/Buckets/Read |
s3buckets/write |
Nej | S3/Buckets/Write |
s3buckets/delete |
Nej | S3/Buckets/Delete |
s3objects/read |
Nej | S3/Objects/Read |
s3objects/write |
Nej | S3/Objects/Write |
s3objects/delete |
Nej | S3/Objects/Delete |
s3accesskeys/read |
Nej | S3/AccessKeys/Read |
s3accesskeys/write |
Nej | S3/AccessKeys/Write |
s3accesskeys/delete |
Nej | S3/AccessKeys/Delete |
s3sts/issue |
Nej | S3/STS/Issue |
s3/audit/read |
Nej | S3/Audit/Read |
registry/audit/read |
Nej | Registry/Audit/Read |
registry/retention/manage |
Nej | Registry/Retention/Manage |
lifecycle/view |
Nej | Lifecycle/View |
lifecycle/plan |
Nej | Lifecycle/Plan |
lifecycle/execute |
Nej | Lifecycle/Execute |
lifecycle/rollback |
Nej | Lifecycle/Rollback |
lifecycle/install |
Nej | Lifecycle/Install |
lifecycle/backupsManage |
Nej | Lifecycle/Backups Manage |
search/read |
Nej | Search/Read |
rbac/projector/apply |
Nej | Rbac/Projector Apply |
rbac/projector/read |
Nej | Rbac/Projector Read |
rbac/members/read |
Nej | Members/Read |
rbac/idpBindings/admin |
Nej | IdpBindings/Admin |
rbac/users/list |
Nej | Users/List |
Kubernetes RBAC-regler som rollen lägger till utöver sina åtgärder:
| API-grupp | Resurser | Verb | Namn |
|---|---|---|---|
"" |
namespaces, pods, pods/log, pods/exec, services, configmaps, persistentvolumeclaims, persistentvolumes, replicationcontrollers |
get, list, watch, create, update, patch, delete |
— |
apps |
deployments, statefulsets, replicasets, daemonsets |
get, list, watch, create, update, patch, delete |
— |
autoscaling |
horizontalpodautoscalers |
get, list, watch, create, update, patch, delete |
— |
batch |
jobs, cronjobs |
get, list, watch, create, update, patch, delete |
— |
networking.k8s.io |
ingresses |
get, list, watch, create, update, patch, delete |
— |
networking.k8s.io |
networkpolicies |
get, list, watch |
— |
snapshot.storage.k8s.io |
volumesnapshots |
get, list, watch, create, update, patch, delete |
— |
velero.io |
backups |
get, list, watch, create, update, patch, delete |
— |
velero.io |
schedules, restores |
get, list, watch |
— |
Database Explorer
Full access to the Postgres / SQL Server Data Explorer surface — read + write data, run SELECT and UPDATE / DELETE queries, browse + mutate schemas. Must be granted explicitly; Platform Owner, Platform Contributor, Owner, and Contributor do NOT grant these data actions by default.
- Roll-id:
10000000-0000-0000-0000-000000000032 - Deklarerade åtgärder:
postgrescluster/read,sqlservercluster/read,boundaries/read,resourcegroups/read,kernel/activity/write,kernel/operations/read,kernel/resourceStatus/read,monitoring/read,boundaries/workloads/read,search/read - Undantagna åtgärder: —
- Deklarerade dataåtgärder:
postgrescluster/dataRead,postgrescluster/dataWrite,postgrescluster/queryExecute,postgrescluster/queryExecuteWrite,postgrescluster/schemaRead,postgrescluster/schemaWrite,sqlservercluster/dataRead,sqlservercluster/dataWrite,sqlservercluster/queryExecute,sqlservercluster/queryExecuteWrite,sqlservercluster/schemaRead,sqlservercluster/schemaWrite - Undantagna dataåtgärder: —
Ger
| Åtgärd | Dataåtgärd | Namn |
|---|---|---|
kernel/activity/write |
Nej | Activity/Write |
kernel/operations/read |
Nej | Operations/Read |
kernel/resourceStatus/read |
Nej | ResourceStatus/Read |
postgrescluster/read |
Nej | Postgres Cluster/Read |
postgrescluster/dataRead |
Ja | Postgres Cluster/Data Read |
postgrescluster/dataWrite |
Ja | Postgres Cluster/Data Write |
postgrescluster/queryExecute |
Ja | Postgres Cluster/Query Execute |
postgrescluster/queryExecuteWrite |
Ja | Postgres Cluster/Query Execute Write |
postgrescluster/schemaRead |
Ja | Postgres Cluster/Schema Read |
postgrescluster/schemaWrite |
Ja | Postgres Cluster/Schema Write |
sqlservercluster/read |
Nej | SQL Server/Read |
sqlservercluster/dataRead |
Ja | SQL Server/Data Read |
sqlservercluster/dataWrite |
Ja | SQL Server/Data Write |
sqlservercluster/queryExecute |
Ja | SQL Server/Query Execute |
sqlservercluster/queryExecuteWrite |
Ja | SQL Server/Query Execute Write |
sqlservercluster/schemaRead |
Ja | SQL Server/Schema Read |
sqlservercluster/schemaWrite |
Ja | SQL Server/Schema Write |
boundaries/read |
Nej | Boundaries/Read |
boundaries/workloads/read |
Nej | Boundaries/Workloads Read |
resourcegroups/read |
Nej | Resource Groups/Read |
monitoring/read |
Nej | Monitoring/Read |
search/read |
Nej | Search/Read |
Databases Operator
Manage database clusters including scaling, backups, and configuration.
- Roll-id:
10000000-0000-0000-0000-000000000031 - Deklarerade åtgärder:
postgrescluster/read,postgrescluster/write,postgrescluster/scale,postgrescluster/createSnapshot,postgrescluster/restoreSnapshot,postgrescluster/deleteSnapshot,qdrantcluster/read,qdrantcluster/write,qdrantcluster/scale,sqlservercluster/read,sqlservercluster/write,sqlservercluster/scale,sqlservercluster/createSnapshot,sqlservercluster/restoreSnapshot,sqlservercluster/deleteSnapshot,valkey/read,valkey/write,boundaries/read,resourcegroups/read,kernel/activity/write,kernel/operations/read,kernel/resourceStatus/read,monitoring/read,managedidentities/read,sentinel/read,sentinel/write,boundaries/workloads/read,search/read - Undantagna åtgärder: —
- Deklarerade dataåtgärder:
postgrescluster/readSecrets,postgrescluster/writeSecrets,sqlservercluster/readSecrets,sqlservercluster/writeSecrets,valkey/readSecrets,valkey/writeSecrets,sqlservercluster/manageLicense,qdrantcluster/readSecrets,qdrantcluster/writeSecrets,boundaries/workloads/readLogs - Undantagna dataåtgärder: —
Ger
| Åtgärd | Dataåtgärd | Namn |
|---|---|---|
kernel/activity/write |
Nej | Activity/Write |
kernel/operations/read |
Nej | Operations/Read |
kernel/resourceStatus/read |
Nej | ResourceStatus/Read |
managedidentities/read |
Nej | Managed Identities/Read |
postgrescluster/read |
Nej | Postgres Cluster/Read |
postgrescluster/write |
Nej | Postgres Cluster/Write |
postgrescluster/delete |
Nej | Postgres Cluster/Delete |
postgrescluster/scale |
Nej | Postgres Cluster/Scale |
postgrescluster/createSnapshot |
Nej | Postgres Cluster/Create Snapshot |
postgrescluster/restoreSnapshot |
Nej | Postgres Cluster/Restore Snapshot |
postgrescluster/deleteSnapshot |
Nej | Postgres Cluster/Delete Snapshot |
postgrescluster/readSecrets |
Ja | Postgres Cluster/Read Secrets |
postgrescluster/writeSecrets |
Ja | Postgres Cluster/Write Secrets |
sqlservercluster/read |
Nej | SQL Server/Read |
sqlservercluster/write |
Nej | SQL Server/Write |
sqlservercluster/delete |
Nej | SQL Server/Delete |
sqlservercluster/scale |
Nej | SQL Server/Scale |
sqlservercluster/createSnapshot |
Nej | SQL Server/Create Snapshot |
sqlservercluster/restoreSnapshot |
Nej | SQL Server/Restore Snapshot |
sqlservercluster/deleteSnapshot |
Nej | SQL Server/Delete Snapshot |
sqlservercluster/readSecrets |
Ja | SQL Server/Read Secrets |
sqlservercluster/writeSecrets |
Ja | SQL Server/Write Secrets |
sqlservercluster/manageLicense |
Ja | SQL Server/Manage License |
qdrantcluster/read |
Nej | Qdrant Cluster/Read |
qdrantcluster/write |
Nej | Qdrant Cluster/Write |
qdrantcluster/delete |
Nej | Qdrant Cluster/Delete |
qdrantcluster/scale |
Nej | Qdrant Cluster/Scale |
qdrantcluster/readSecrets |
Ja | Qdrant Cluster/Read Secrets |
qdrantcluster/writeSecrets |
Ja | Qdrant Cluster/Write Secrets |
valkey/read |
Nej | Valkey/Read |
valkey/write |
Nej | Valkey/Write |
valkey/delete |
Nej | Valkey/Delete |
valkey/readSecrets |
Ja | Valkey/Read Secrets |
valkey/writeSecrets |
Ja | Valkey/Write Secrets |
boundaries/read |
Nej | Boundaries/Read |
boundaries/workloads/read |
Nej | Boundaries/Workloads Read |
boundaries/workloads/readLogs |
Ja | Boundaries/Workloads Read Logs |
resourcegroups/read |
Nej | Resource Groups/Read |
sentinel/read |
Nej | Sentinel/Read |
sentinel/write |
Nej | Sentinel/Write |
monitoring/read |
Nej | Monitoring/Read |
search/read |
Nej | Search/Read |
Databases Reader
View database clusters and their configuration. Cannot make changes.
- Roll-id:
10000000-0000-0000-0000-000000000030 - Deklarerade åtgärder:
postgrescluster/read,qdrantcluster/read,sqlservercluster/read,valkey/read,boundaries/read,resourcegroups/read,kernel/activity/write,kernel/operations/read,kernel/resourceStatus/read,monitoring/read,managedidentities/read,sentinel/read,boundaries/workloads/read,search/read - Undantagna åtgärder: —
- Deklarerade dataåtgärder: —
- Undantagna dataåtgärder: —
Ger
| Åtgärd | Dataåtgärd | Namn |
|---|---|---|
kernel/activity/write |
Nej | Activity/Write |
kernel/operations/read |
Nej | Operations/Read |
kernel/resourceStatus/read |
Nej | ResourceStatus/Read |
managedidentities/read |
Nej | Managed Identities/Read |
postgrescluster/read |
Nej | Postgres Cluster/Read |
sqlservercluster/read |
Nej | SQL Server/Read |
qdrantcluster/read |
Nej | Qdrant Cluster/Read |
valkey/read |
Nej | Valkey/Read |
boundaries/read |
Nej | Boundaries/Read |
boundaries/workloads/read |
Nej | Boundaries/Workloads Read |
resourcegroups/read |
Nej | Resource Groups/Read |
sentinel/read |
Nej | Sentinel/Read |
monitoring/read |
Nej | Monitoring/Read |
search/read |
Nej | Search/Read |
Deployment Token Broker
Mint short-lived source-repo access tokens for cloning. Does not grant deployment-source management.
- Roll-id:
10000000-0000-0000-0000-000000000060 - Deklarerade åtgärder:
kernel/deployments/token,kernel/activity/write,search/read - Undantagna åtgärder: —
- Deklarerade dataåtgärder: —
- Undantagna dataåtgärder: —
Ger
| Åtgärd | Dataåtgärd | Namn |
|---|---|---|
kernel/deployments/token |
Nej | Deployments/Token |
kernel/activity/write |
Nej | Activity/Write |
search/read |
Nej | Search/Read |
Functions Operator
Manage functions including deployment, scaling, and configuration.
- Roll-id:
10000000-0000-0000-0000-000000000042 - Deklarerade åtgärder:
functions/read,functions/write,functions/scale,boundaries/read,resourcegroups/read,kernel/activity/write,kernel/operations/read,kernel/resourceStatus/read,monitoring/read,managedidentities/read,sentinel/read,sentinel/write,boundaries/workloads/read,search/read,kernel/deployments/read - Undantagna åtgärder: —
- Deklarerade dataåtgärder:
functions/readLogs,boundaries/workloads/readLogs - Undantagna dataåtgärder: —
Ger
| Åtgärd | Dataåtgärd | Namn |
|---|---|---|
kernel/deployments/read |
Nej | Deployments/Read |
kernel/activity/write |
Nej | Activity/Write |
kernel/operations/read |
Nej | Operations/Read |
kernel/resourceStatus/read |
Nej | ResourceStatus/Read |
functions/read |
Nej | Functions/Read |
functions/write |
Nej | Functions/Write |
functions/delete |
Nej | Functions/Delete |
functions/scale |
Nej | Functions/Scale |
functions/readLogs |
Ja | Functions/Read Logs |
managedidentities/read |
Nej | Managed Identities/Read |
boundaries/read |
Nej | Boundaries/Read |
boundaries/workloads/read |
Nej | Boundaries/Workloads Read |
boundaries/workloads/readLogs |
Ja | Boundaries/Workloads Read Logs |
resourcegroups/read |
Nej | Resource Groups/Read |
sentinel/read |
Nej | Sentinel/Read |
sentinel/write |
Nej | Sentinel/Write |
monitoring/read |
Nej | Monitoring/Read |
search/read |
Nej | Search/Read |
Functions Reader
View functions and their configuration. Cannot make changes.
- Roll-id:
10000000-0000-0000-0000-000000000040 - Deklarerade åtgärder:
functions/read,boundaries/read,resourcegroups/read,kernel/activity/write,kernel/operations/read,kernel/resourceStatus/read,monitoring/read,managedidentities/read,sentinel/read,boundaries/workloads/read,search/read - Undantagna åtgärder: —
- Deklarerade dataåtgärder:
functions/readLogs,boundaries/workloads/readLogs - Undantagna dataåtgärder: —
Ger
| Åtgärd | Dataåtgärd | Namn |
|---|---|---|
kernel/activity/write |
Nej | Activity/Write |
kernel/operations/read |
Nej | Operations/Read |
kernel/resourceStatus/read |
Nej | ResourceStatus/Read |
functions/read |
Nej | Functions/Read |
functions/readLogs |
Ja | Functions/Read Logs |
managedidentities/read |
Nej | Managed Identities/Read |
boundaries/read |
Nej | Boundaries/Read |
boundaries/workloads/read |
Nej | Boundaries/Workloads Read |
boundaries/workloads/readLogs |
Ja | Boundaries/Workloads Read Logs |
resourcegroups/read |
Nej | Resource Groups/Read |
sentinel/read |
Nej | Sentinel/Read |
monitoring/read |
Nej | Monitoring/Read |
search/read |
Nej | Search/Read |
Jobs Operator
Manage jobs including creation, deletion, and log streaming.
- Roll-id:
10000000-0000-0000-0000-000000000051 - Deklarerade åtgärder:
jobs/read,jobs/write,boundaries/read,resourcegroups/read,kernel/activity/write,kernel/operations/read,kernel/resourceStatus/read,monitoring/read,managedidentities/read,sentinel/read,sentinel/write,boundaries/workloads/read,search/read - Undantagna åtgärder: —
- Deklarerade dataåtgärder:
jobs/readLogs,boundaries/workloads/readLogs - Undantagna dataåtgärder: —
Ger
| Åtgärd | Dataåtgärd | Namn |
|---|---|---|
kernel/activity/write |
Nej | Activity/Write |
kernel/operations/read |
Nej | Operations/Read |
kernel/resourceStatus/read |
Nej | ResourceStatus/Read |
jobs/read |
Nej | Jobs/Read |
jobs/write |
Nej | Jobs/Write |
jobs/delete |
Nej | Jobs/Delete |
jobs/readLogs |
Ja | Jobs/Read Logs |
managedidentities/read |
Nej | Managed Identities/Read |
boundaries/read |
Nej | Boundaries/Read |
boundaries/workloads/read |
Nej | Boundaries/Workloads Read |
boundaries/workloads/readLogs |
Ja | Boundaries/Workloads Read Logs |
resourcegroups/read |
Nej | Resource Groups/Read |
sentinel/read |
Nej | Sentinel/Read |
sentinel/write |
Nej | Sentinel/Write |
monitoring/read |
Nej | Monitoring/Read |
search/read |
Nej | Search/Read |
Kubernetes RBAC-regler som rollen lägger till utöver sina åtgärder:
| API-grupp | Resurser | Verb | Namn |
|---|---|---|---|
"" |
pods, pods/log |
get, list, watch |
— |
Jobs Reader
View jobs and their status. Cannot make changes.
- Roll-id:
10000000-0000-0000-0000-000000000050 - Deklarerade åtgärder:
jobs/read,boundaries/read,resourcegroups/read,kernel/activity/write,kernel/operations/read,kernel/resourceStatus/read,monitoring/read,managedidentities/read,sentinel/read,boundaries/workloads/read,search/read - Undantagna åtgärder: —
- Deklarerade dataåtgärder:
jobs/readLogs,boundaries/workloads/readLogs - Undantagna dataåtgärder: —
Ger
| Åtgärd | Dataåtgärd | Namn |
|---|---|---|
kernel/activity/write |
Nej | Activity/Write |
kernel/operations/read |
Nej | Operations/Read |
kernel/resourceStatus/read |
Nej | ResourceStatus/Read |
jobs/read |
Nej | Jobs/Read |
jobs/readLogs |
Ja | Jobs/Read Logs |
managedidentities/read |
Nej | Managed Identities/Read |
boundaries/read |
Nej | Boundaries/Read |
boundaries/workloads/read |
Nej | Boundaries/Workloads Read |
boundaries/workloads/readLogs |
Ja | Boundaries/Workloads Read Logs |
resourcegroups/read |
Nej | Resource Groups/Read |
sentinel/read |
Nej | Sentinel/Read |
monitoring/read |
Nej | Monitoring/Read |
search/read |
Nej | Search/Read |
LLM Gateway Consumer
Resolve registered LLM gateways (URL, enabled models and API key) over the platform channel. Does not grant viewing or managing gateways.
- Roll-id:
10000000-0000-0000-0000-000000000080 - Deklarerade åtgärder:
kernel/llmGateways/resolve,search/read - Undantagna åtgärder: —
- Deklarerade dataåtgärder: —
- Undantagna dataåtgärder: —
Ger
| Åtgärd | Dataåtgärd | Namn |
|---|---|---|
kernel/llmGateways/resolve |
Nej | LlmGateways/Resolve |
search/read |
Nej | Search/Read |
Owner
All control + data actions within a boundary, plus member management. Cannot create/delete boundaries or manage projections. Data Explorer access is OPT-IN — explicit "Database Explorer" assignment required even for boundary Owner.
- Roll-id:
23000000-0000-0000-0000-000000000000 - Deklarerade åtgärder:
*/* - Undantagna åtgärder:
boundaries/create,boundaries/delete,boundaries/projections/manage,kernel/clusters/write - Deklarerade dataåtgärder:
*/* - Undantagna dataåtgärder:
workflow/readStepIo,postgrescluster/dataRead,postgrescluster/dataWrite,postgrescluster/queryExecute,postgrescluster/queryExecuteWrite,postgrescluster/schemaRead,postgrescluster/schemaWrite,postgrescluster/schemaDrop
Ger
| Åtgärd | Dataåtgärd | Namn |
|---|---|---|
kernel/clusters/read |
Nej | Clusters/Read |
kernel/platform/read |
Nej | Platform/Read |
kernel/platform/diagnose |
Nej | Platform/Diagnose |
kernel/deployments/read |
Nej | Deployments/Read |
kernel/deployments/write |
Nej | Deployments/Write |
kernel/deployments/delete |
Nej | Deployments/Delete |
kernel/deployments/token |
Nej | Deployments/Token |
kernel/activity/read |
Nej | Activity/Read |
kernel/activity/write |
Nej | Activity/Write |
kernel/k8sChannel/read |
Nej | Kubernetes Channel/Read |
kernel/k8sChannel/write |
Nej | Kubernetes Channel/Write |
kernel/k8sChannel/readSecretMetadata |
Nej | Kubernetes Channel/Read Secret Metadata |
kernel/k8sChannel/readNamespacedRbac |
Nej | Kubernetes Channel/Read Namespaced RBAC |
kernel/k8sChannel/readNamespaceDiagnostics |
Nej | Kubernetes Channel/Read Namespace Diagnostics |
kernel/operations/read |
Nej | Operations/Read |
kernel/resourceStatus/read |
Nej | ResourceStatus/Read |
kernel/crates/read |
Nej | Crates/Read |
kernel/crates/readLogs |
Ja | Crates/ReadLogs |
kernel/crates/exec |
Ja | Crates/Exec |
kernel/emailTemplates/manage |
Nej | EmailTemplates/Manage |
kernel/emailSettings/manage |
Nej | EmailSettings/Manage |
kernel/mcpSettings/manage |
Nej | McpSettings/Manage |
kernel/telemetrySettings/manage |
Nej | TelemetrySettings/Manage |
kernel/docsFeedback/export |
Nej | DocsFeedback/Export |
kernel/llmGateways/read |
Nej | LlmGateways/Read |
kernel/llmGateways/write |
Nej | LlmGateways/Write |
kernel/llmGateways/delete |
Nej | LlmGateways/Delete |
kernel/llmGateways/resolve |
Nej | LlmGateways/Resolve |
apps/read |
Nej | Apps/Read |
apps/write |
Nej | Apps/Write |
apps/delete |
Nej | Apps/Delete |
apps/scale |
Nej | Apps/Scale |
apps/readLogs |
Ja | Apps/Read Logs |
apps/readFiles |
Ja | Apps/Read Files |
apps/writeFiles |
Ja | Apps/Write Files |
blueprints/read |
Nej | Blueprints/Read |
blueprints/templates/write |
Nej | Blueprints/Templates/Write |
functions/read |
Nej | Functions/Read |
functions/write |
Nej | Functions/Write |
functions/delete |
Nej | Functions/Delete |
functions/scale |
Nej | Functions/Scale |
functions/readLogs |
Ja | Functions/Read Logs |
jobs/read |
Nej | Jobs/Read |
jobs/write |
Nej | Jobs/Write |
jobs/delete |
Nej | Jobs/Delete |
jobs/readLogs |
Ja | Jobs/Read Logs |
managedidentities/read |
Nej | Managed Identities/Read |
managedidentities/write |
Nej | Managed Identities/Write |
managedidentities/delete |
Nej | Managed Identities/Delete |
managedidentities/readSecrets |
Ja | Managed Identities/Read Tokens |
secretvault/read |
Nej | Secret Vault/Read |
secretvault/write |
Nej | Secret Vault/Write |
secretvault/delete |
Nej | Secret Vault/Delete |
secretvault/readSecrets |
Ja | Secret Vault/Read Secrets |
secretvault/writeSecrets |
Ja | Secret Vault/Write Secrets |
postgrescluster/read |
Nej | Postgres Cluster/Read |
postgrescluster/write |
Nej | Postgres Cluster/Write |
postgrescluster/delete |
Nej | Postgres Cluster/Delete |
postgrescluster/scale |
Nej | Postgres Cluster/Scale |
postgrescluster/createSnapshot |
Nej | Postgres Cluster/Create Snapshot |
postgrescluster/restoreSnapshot |
Nej | Postgres Cluster/Restore Snapshot |
postgrescluster/deleteSnapshot |
Nej | Postgres Cluster/Delete Snapshot |
postgrescluster/readSecrets |
Ja | Postgres Cluster/Read Secrets |
postgrescluster/writeSecrets |
Ja | Postgres Cluster/Write Secrets |
sqlservercluster/read |
Nej | SQL Server/Read |
sqlservercluster/write |
Nej | SQL Server/Write |
sqlservercluster/delete |
Nej | SQL Server/Delete |
sqlservercluster/scale |
Nej | SQL Server/Scale |
sqlservercluster/createSnapshot |
Nej | SQL Server/Create Snapshot |
sqlservercluster/restoreSnapshot |
Nej | SQL Server/Restore Snapshot |
sqlservercluster/deleteSnapshot |
Nej | SQL Server/Delete Snapshot |
sqlservercluster/readSecrets |
Ja | SQL Server/Read Secrets |
sqlservercluster/writeSecrets |
Ja | SQL Server/Write Secrets |
sqlservercluster/manageLicense |
Ja | SQL Server/Manage License |
sqlservercluster/dataRead |
Ja | SQL Server/Data Read |
sqlservercluster/dataWrite |
Ja | SQL Server/Data Write |
sqlservercluster/queryExecute |
Ja | SQL Server/Query Execute |
sqlservercluster/queryExecuteWrite |
Ja | SQL Server/Query Execute Write |
sqlservercluster/schemaRead |
Ja | SQL Server/Schema Read |
sqlservercluster/schemaWrite |
Ja | SQL Server/Schema Write |
sqlservercluster/schemaDrop |
Ja | SQL Server/Schema Drop |
qdrantcluster/read |
Nej | Qdrant Cluster/Read |
qdrantcluster/write |
Nej | Qdrant Cluster/Write |
qdrantcluster/delete |
Nej | Qdrant Cluster/Delete |
qdrantcluster/scale |
Nej | Qdrant Cluster/Scale |
qdrantcluster/readSecrets |
Ja | Qdrant Cluster/Read Secrets |
qdrantcluster/writeSecrets |
Ja | Qdrant Cluster/Write Secrets |
valkey/read |
Nej | Valkey/Read |
valkey/write |
Nej | Valkey/Write |
valkey/delete |
Nej | Valkey/Delete |
valkey/readSecrets |
Ja | Valkey/Read Secrets |
valkey/writeSecrets |
Ja | Valkey/Write Secrets |
workflow/read |
Nej | Workflow/Read |
workflow/write |
Nej | Workflow/Write |
workflow/delete |
Nej | Workflow/Delete |
workflow/trigger |
Ja | Workflow/Trigger |
containerinstance/read |
Nej | Container Instance/Read |
containerinstance/write |
Nej | Container Instance/Write |
containerinstance/delete |
Nej | Container Instance/Delete |
containerinstance/scale |
Nej | Container Instance/Scale |
containerinstance/createSnapshot |
Nej | Container Instance/Create Snapshot |
containerinstance/restoreSnapshot |
Nej | Container Instance/Restore Snapshot |
containerinstance/deleteSnapshot |
Nej | Container Instance/Delete Snapshot |
containerinstance/readLogs |
Ja | Container Instance/Read Logs |
containerinstance/exec |
Ja | Container Instance/Exec Terminal |
containerinstance/readFiles |
Ja | Container Instance/Read Files |
containerinstance/writeFiles |
Ja | Container Instance/Write Files |
containerinstance/access |
Ja | Container Instance/Access |
staticwebapp/read |
Nej | Static Web App/Read |
staticwebapp/write |
Nej | Static Web App/Write |
staticwebapp/delete |
Nej | Static Web App/Delete |
staticwebapp/scale |
Nej | Static Web App/Scale |
staticwebapp/deploy |
Ja | Static Web App/Deploy |
staticwebapp/readLogs |
Ja | Static Web App/Read Logs |
boundaries/tenant/admin |
Nej | Boundaries/Tenant Admin |
boundaries/list |
Nej | Boundaries/List |
boundaries/read |
Nej | Boundaries/Read |
boundaries/manage |
Nej | Boundaries/Manage |
boundaries/projections/read |
Nej | Boundaries/Projections Read |
boundaries/projections/write |
Nej | Boundaries/Projections Write |
boundaries/projections/delete |
Nej | Boundaries/Projections Delete |
boundaries/members/read |
Nej | Boundaries/Members Read |
boundaries/members/manage |
Nej | Boundaries/Members Manage |
boundaries/invitations/read |
Nej | Boundaries/Invitations Read |
boundaries/invitations/create |
Nej | Boundaries/Invitations Create |
boundaries/network/read |
Nej | Boundaries/Network Read |
boundaries/workloads/read |
Nej | Boundaries/Workloads Read |
crosslink/admin |
Nej | Crosslink/Admin |
boundaries/workloads/manage |
Nej | Boundaries/Workloads Manage |
boundaries/workloads/readLogs |
Ja | Boundaries/Workloads Read Logs |
pods/exec |
Ja | Pods/Exec |
pods/portForward |
Ja | Pods/Port Forward |
pods/attach |
Ja | Pods/Attach |
pods/log |
Ja | Pods/Log |
secrets/readSecretData |
Ja | Secrets/Read Secret Data |
resourcegroups/read |
Nej | Resource Groups/Read |
resourcegroups/write |
Nej | Resource Groups/Write |
resourcegroups/delete |
Nej | Resource Groups/Delete |
sentinel/read |
Nej | Sentinel/Read |
sentinel/write |
Nej | Sentinel/Write |
sentinel/admin |
Nej | Sentinel/Admin |
monitoring/platform/read |
Nej | Monitoring/Platform/Read |
monitoring/platform/alerts/write |
Nej | Monitoring/Platform/Alerts/Write |
monitoring/read |
Nej | Monitoring/Read |
compliance/read |
Nej | Compliance/Read |
policies/read |
Nej | Policies/Read |
policies/write |
Nej | Policies/Write |
s3storageaccounts/read |
Nej | StorageAccounts/Read |
s3storageaccounts/write |
Nej | StorageAccounts/Write |
s3storageaccounts/delete |
Nej | StorageAccounts/Delete |
s3storageaccounts/admin |
Nej | StorageAccounts/Admin |
s3buckets/read |
Nej | S3/Buckets/Read |
s3buckets/write |
Nej | S3/Buckets/Write |
s3buckets/delete |
Nej | S3/Buckets/Delete |
s3objects/read |
Nej | S3/Objects/Read |
s3objects/write |
Nej | S3/Objects/Write |
s3objects/delete |
Nej | S3/Objects/Delete |
s3accesskeys/read |
Nej | S3/AccessKeys/Read |
s3accesskeys/write |
Nej | S3/AccessKeys/Write |
s3accesskeys/delete |
Nej | S3/AccessKeys/Delete |
s3sts/issue |
Nej | S3/STS/Issue |
s3/audit/read |
Nej | S3/Audit/Read |
registry/audit/read |
Nej | Registry/Audit/Read |
registry/retention/manage |
Nej | Registry/Retention/Manage |
lifecycle/view |
Nej | Lifecycle/View |
lifecycle/plan |
Nej | Lifecycle/Plan |
lifecycle/execute |
Nej | Lifecycle/Execute |
lifecycle/rollback |
Nej | Lifecycle/Rollback |
lifecycle/install |
Nej | Lifecycle/Install |
lifecycle/backupsManage |
Nej | Lifecycle/Backups Manage |
search/read |
Nej | Search/Read |
rbac/projector/apply |
Nej | Rbac/Projector Apply |
rbac/projector/read |
Nej | Rbac/Projector Read |
rbac/members/read |
Nej | Members/Read |
rbac/members/write |
Nej | Members/Write |
rbac/members/admin |
Nej | Members/Admin |
rbac/idpBindings/admin |
Nej | IdpBindings/Admin |
rbac/boundaryTrusts/admin |
Nej | BoundaryTrusts/Admin |
rbac/users/list |
Nej | Users/List |
Kubernetes RBAC-regler som rollen lägger till utöver sina åtgärder:
| API-grupp | Resurser | Verb | Namn |
|---|---|---|---|
"" |
namespaces, pods, pods/log, pods/exec, services, configmaps, persistentvolumeclaims, persistentvolumes, replicationcontrollers |
get, list, watch, create, update, patch, delete |
— |
rbac.authorization.k8s.io |
roles, rolebindings |
get, list, watch, create, update, patch, delete |
— |
apps |
deployments, statefulsets, replicasets, daemonsets |
get, list, watch, create, update, patch, delete |
— |
autoscaling |
horizontalpodautoscalers |
get, list, watch, create, update, patch, delete |
— |
batch |
jobs, cronjobs |
get, list, watch, create, update, patch, delete |
— |
networking.k8s.io |
ingresses |
get, list, watch, create, update, patch, delete |
— |
networking.k8s.io |
networkpolicies |
get, list, watch |
— |
snapshot.storage.k8s.io |
volumesnapshots |
get, list, watch, create, update, patch, delete |
— |
velero.io |
backups |
get, list, watch, create, update, patch, delete |
— |
velero.io |
schedules, restores |
get, list, watch |
— |
Platform Alert Publisher
Raise and clear platform-scoped alerts. Does not grant reading platform health or alerts.
- Roll-id:
10000000-0000-0000-0000-000000000090 - Deklarerade åtgärder:
monitoring/platform/alerts/write,kernel/activity/write,search/read - Undantagna åtgärder: —
- Deklarerade dataåtgärder: —
- Undantagna dataåtgärder: —
Ger
| Åtgärd | Dataåtgärd | Namn |
|---|---|---|
kernel/activity/write |
Nej | Activity/Write |
monitoring/platform/alerts/write |
Nej | Monitoring/Platform/Alerts/Write |
search/read |
Nej | Search/Read |
Platform Contributor
Platform-wide control + data actions except: boundary deletion, managing boundary members, inviting users, granting role assignments (rbac/members/* writes), and registering / editing clusters. The Platform Owner is the sole holder of those four boundaries-of-trust surfaces. Platform Contributor DOES manage email templates and enumerate users via the Platform Users admin page. Data Explorer access is OPT-IN — explicit "Database Explorer" assignment required to query Postgres data.
- Roll-id:
21000000-0000-0000-0000-000000000000 - Deklarerade åtgärder:
*/* - Undantagna åtgärder:
boundaries/delete,boundaries/members/manage,boundaries/invitations/create,rbac/members/write,rbac/members/admin,rbac/boundaryTrusts/admin,boundaries/tenant/admin,kernel/clusters/write,lifecycle/backupsManage,kernel/platform/diagnose - Deklarerade dataåtgärder:
*/* - Undantagna dataåtgärder:
workflow/readStepIo,postgrescluster/dataRead,postgrescluster/dataWrite,postgrescluster/queryExecute,postgrescluster/queryExecuteWrite,postgrescluster/schemaRead,postgrescluster/schemaWrite,postgrescluster/schemaDrop
Ger
| Åtgärd | Dataåtgärd | Namn |
|---|---|---|
kernel/clusters/read |
Nej | Clusters/Read |
kernel/platform/read |
Nej | Platform/Read |
kernel/deployments/read |
Nej | Deployments/Read |
kernel/deployments/write |
Nej | Deployments/Write |
kernel/deployments/delete |
Nej | Deployments/Delete |
kernel/deployments/token |
Nej | Deployments/Token |
kernel/activity/read |
Nej | Activity/Read |
kernel/activity/write |
Nej | Activity/Write |
kernel/k8sChannel/read |
Nej | Kubernetes Channel/Read |
kernel/k8sChannel/write |
Nej | Kubernetes Channel/Write |
kernel/k8sChannel/readSecretMetadata |
Nej | Kubernetes Channel/Read Secret Metadata |
kernel/k8sChannel/readNamespacedRbac |
Nej | Kubernetes Channel/Read Namespaced RBAC |
kernel/k8sChannel/readNamespaceDiagnostics |
Nej | Kubernetes Channel/Read Namespace Diagnostics |
kernel/operations/read |
Nej | Operations/Read |
kernel/resourceStatus/read |
Nej | ResourceStatus/Read |
kernel/crates/read |
Nej | Crates/Read |
kernel/crates/readLogs |
Ja | Crates/ReadLogs |
kernel/crates/exec |
Ja | Crates/Exec |
kernel/emailTemplates/manage |
Nej | EmailTemplates/Manage |
kernel/emailSettings/manage |
Nej | EmailSettings/Manage |
kernel/mcpSettings/manage |
Nej | McpSettings/Manage |
kernel/telemetrySettings/manage |
Nej | TelemetrySettings/Manage |
kernel/docsFeedback/export |
Nej | DocsFeedback/Export |
kernel/llmGateways/read |
Nej | LlmGateways/Read |
kernel/llmGateways/write |
Nej | LlmGateways/Write |
kernel/llmGateways/delete |
Nej | LlmGateways/Delete |
kernel/llmGateways/resolve |
Nej | LlmGateways/Resolve |
apps/read |
Nej | Apps/Read |
apps/write |
Nej | Apps/Write |
apps/delete |
Nej | Apps/Delete |
apps/scale |
Nej | Apps/Scale |
apps/readLogs |
Ja | Apps/Read Logs |
apps/readFiles |
Ja | Apps/Read Files |
apps/writeFiles |
Ja | Apps/Write Files |
blueprints/read |
Nej | Blueprints/Read |
blueprints/templates/write |
Nej | Blueprints/Templates/Write |
functions/read |
Nej | Functions/Read |
functions/write |
Nej | Functions/Write |
functions/delete |
Nej | Functions/Delete |
functions/scale |
Nej | Functions/Scale |
functions/readLogs |
Ja | Functions/Read Logs |
jobs/read |
Nej | Jobs/Read |
jobs/write |
Nej | Jobs/Write |
jobs/delete |
Nej | Jobs/Delete |
jobs/readLogs |
Ja | Jobs/Read Logs |
managedidentities/read |
Nej | Managed Identities/Read |
managedidentities/write |
Nej | Managed Identities/Write |
managedidentities/delete |
Nej | Managed Identities/Delete |
managedidentities/readSecrets |
Ja | Managed Identities/Read Tokens |
secretvault/read |
Nej | Secret Vault/Read |
secretvault/write |
Nej | Secret Vault/Write |
secretvault/delete |
Nej | Secret Vault/Delete |
secretvault/readSecrets |
Ja | Secret Vault/Read Secrets |
secretvault/writeSecrets |
Ja | Secret Vault/Write Secrets |
postgrescluster/read |
Nej | Postgres Cluster/Read |
postgrescluster/write |
Nej | Postgres Cluster/Write |
postgrescluster/delete |
Nej | Postgres Cluster/Delete |
postgrescluster/scale |
Nej | Postgres Cluster/Scale |
postgrescluster/createSnapshot |
Nej | Postgres Cluster/Create Snapshot |
postgrescluster/restoreSnapshot |
Nej | Postgres Cluster/Restore Snapshot |
postgrescluster/deleteSnapshot |
Nej | Postgres Cluster/Delete Snapshot |
postgrescluster/readSecrets |
Ja | Postgres Cluster/Read Secrets |
postgrescluster/writeSecrets |
Ja | Postgres Cluster/Write Secrets |
sqlservercluster/read |
Nej | SQL Server/Read |
sqlservercluster/write |
Nej | SQL Server/Write |
sqlservercluster/delete |
Nej | SQL Server/Delete |
sqlservercluster/scale |
Nej | SQL Server/Scale |
sqlservercluster/createSnapshot |
Nej | SQL Server/Create Snapshot |
sqlservercluster/restoreSnapshot |
Nej | SQL Server/Restore Snapshot |
sqlservercluster/deleteSnapshot |
Nej | SQL Server/Delete Snapshot |
sqlservercluster/readSecrets |
Ja | SQL Server/Read Secrets |
sqlservercluster/writeSecrets |
Ja | SQL Server/Write Secrets |
sqlservercluster/manageLicense |
Ja | SQL Server/Manage License |
sqlservercluster/dataRead |
Ja | SQL Server/Data Read |
sqlservercluster/dataWrite |
Ja | SQL Server/Data Write |
sqlservercluster/queryExecute |
Ja | SQL Server/Query Execute |
sqlservercluster/queryExecuteWrite |
Ja | SQL Server/Query Execute Write |
sqlservercluster/schemaRead |
Ja | SQL Server/Schema Read |
sqlservercluster/schemaWrite |
Ja | SQL Server/Schema Write |
sqlservercluster/schemaDrop |
Ja | SQL Server/Schema Drop |
qdrantcluster/read |
Nej | Qdrant Cluster/Read |
qdrantcluster/write |
Nej | Qdrant Cluster/Write |
qdrantcluster/delete |
Nej | Qdrant Cluster/Delete |
qdrantcluster/scale |
Nej | Qdrant Cluster/Scale |
qdrantcluster/readSecrets |
Ja | Qdrant Cluster/Read Secrets |
qdrantcluster/writeSecrets |
Ja | Qdrant Cluster/Write Secrets |
valkey/read |
Nej | Valkey/Read |
valkey/write |
Nej | Valkey/Write |
valkey/delete |
Nej | Valkey/Delete |
valkey/readSecrets |
Ja | Valkey/Read Secrets |
valkey/writeSecrets |
Ja | Valkey/Write Secrets |
workflow/read |
Nej | Workflow/Read |
workflow/write |
Nej | Workflow/Write |
workflow/delete |
Nej | Workflow/Delete |
workflow/trigger |
Ja | Workflow/Trigger |
containerinstance/read |
Nej | Container Instance/Read |
containerinstance/write |
Nej | Container Instance/Write |
containerinstance/delete |
Nej | Container Instance/Delete |
containerinstance/scale |
Nej | Container Instance/Scale |
containerinstance/createSnapshot |
Nej | Container Instance/Create Snapshot |
containerinstance/restoreSnapshot |
Nej | Container Instance/Restore Snapshot |
containerinstance/deleteSnapshot |
Nej | Container Instance/Delete Snapshot |
containerinstance/readLogs |
Ja | Container Instance/Read Logs |
containerinstance/exec |
Ja | Container Instance/Exec Terminal |
containerinstance/readFiles |
Ja | Container Instance/Read Files |
containerinstance/writeFiles |
Ja | Container Instance/Write Files |
containerinstance/access |
Ja | Container Instance/Access |
staticwebapp/read |
Nej | Static Web App/Read |
staticwebapp/write |
Nej | Static Web App/Write |
staticwebapp/delete |
Nej | Static Web App/Delete |
staticwebapp/scale |
Nej | Static Web App/Scale |
staticwebapp/deploy |
Ja | Static Web App/Deploy |
staticwebapp/readLogs |
Ja | Static Web App/Read Logs |
boundaries/create |
Nej | Boundaries/Create |
boundaries/list |
Nej | Boundaries/List |
boundaries/read |
Nej | Boundaries/Read |
boundaries/manage |
Nej | Boundaries/Manage |
boundaries/projections/read |
Nej | Boundaries/Projections Read |
boundaries/projections/manage |
Nej | Boundaries/Projections Manage |
boundaries/projections/write |
Nej | Boundaries/Projections Write |
boundaries/projections/delete |
Nej | Boundaries/Projections Delete |
boundaries/members/read |
Nej | Boundaries/Members Read |
boundaries/invitations/read |
Nej | Boundaries/Invitations Read |
boundaries/network/read |
Nej | Boundaries/Network Read |
boundaries/workloads/read |
Nej | Boundaries/Workloads Read |
crosslink/admin |
Nej | Crosslink/Admin |
boundaries/workloads/manage |
Nej | Boundaries/Workloads Manage |
boundaries/workloads/readLogs |
Ja | Boundaries/Workloads Read Logs |
pods/exec |
Ja | Pods/Exec |
pods/portForward |
Ja | Pods/Port Forward |
pods/attach |
Ja | Pods/Attach |
pods/log |
Ja | Pods/Log |
secrets/readSecretData |
Ja | Secrets/Read Secret Data |
resourcegroups/read |
Nej | Resource Groups/Read |
resourcegroups/write |
Nej | Resource Groups/Write |
resourcegroups/delete |
Nej | Resource Groups/Delete |
sentinel/read |
Nej | Sentinel/Read |
sentinel/write |
Nej | Sentinel/Write |
sentinel/admin |
Nej | Sentinel/Admin |
monitoring/platform/read |
Nej | Monitoring/Platform/Read |
monitoring/platform/alerts/write |
Nej | Monitoring/Platform/Alerts/Write |
monitoring/read |
Nej | Monitoring/Read |
compliance/read |
Nej | Compliance/Read |
policies/read |
Nej | Policies/Read |
policies/write |
Nej | Policies/Write |
s3storageaccounts/read |
Nej | StorageAccounts/Read |
s3storageaccounts/write |
Nej | StorageAccounts/Write |
s3storageaccounts/delete |
Nej | StorageAccounts/Delete |
s3storageaccounts/admin |
Nej | StorageAccounts/Admin |
s3buckets/read |
Nej | S3/Buckets/Read |
s3buckets/write |
Nej | S3/Buckets/Write |
s3buckets/delete |
Nej | S3/Buckets/Delete |
s3objects/read |
Nej | S3/Objects/Read |
s3objects/write |
Nej | S3/Objects/Write |
s3objects/delete |
Nej | S3/Objects/Delete |
s3accesskeys/read |
Nej | S3/AccessKeys/Read |
s3accesskeys/write |
Nej | S3/AccessKeys/Write |
s3accesskeys/delete |
Nej | S3/AccessKeys/Delete |
s3sts/issue |
Nej | S3/STS/Issue |
s3/audit/read |
Nej | S3/Audit/Read |
registry/audit/read |
Nej | Registry/Audit/Read |
registry/retention/manage |
Nej | Registry/Retention/Manage |
lifecycle/view |
Nej | Lifecycle/View |
lifecycle/plan |
Nej | Lifecycle/Plan |
lifecycle/execute |
Nej | Lifecycle/Execute |
lifecycle/rollback |
Nej | Lifecycle/Rollback |
lifecycle/install |
Nej | Lifecycle/Install |
search/read |
Nej | Search/Read |
rbac/projector/apply |
Nej | Rbac/Projector Apply |
rbac/projector/read |
Nej | Rbac/Projector Read |
rbac/members/read |
Nej | Members/Read |
rbac/idpBindings/admin |
Nej | IdpBindings/Admin |
rbac/users/list |
Nej | Users/List |
Kubernetes RBAC-regler som rollen lägger till utöver sina åtgärder:
| API-grupp | Resurser | Verb | Namn |
|---|---|---|---|
"" |
namespaces, pods, pods/log, pods/exec, services, secrets, configmaps, persistentvolumeclaims, persistentvolumes, replicationcontrollers |
get, list, watch, create, update, patch, delete |
— |
apps |
deployments, statefulsets, replicasets, daemonsets |
get, list, watch, create, update, patch, delete |
— |
autoscaling |
horizontalpodautoscalers |
get, list, watch, create, update, patch, delete |
— |
batch |
jobs, cronjobs |
get, list, watch, create, update, patch, delete |
— |
networking.k8s.io |
ingresses, networkpolicies |
get, list, watch, create, update, patch, delete |
— |
snapshot.storage.k8s.io |
volumesnapshots |
get, list, watch, create, update, patch, delete |
— |
velero.io |
backups |
get, list, watch, create, update, patch, delete |
— |
velero.io |
schedules |
get, list, watch, update, patch |
— |
velero.io |
restores |
get, list, watch |
— |
Platform Owner
Full control at root scope — create/delete boundaries, manage clusters, manage members at every level. Data Explorer access is OPT-IN — even Platform Owner must be explicitly granted the "Database Explorer" role to query or read Postgres data.
- Roll-id:
20000000-0000-0000-0000-000000000000 - Deklarerade åtgärder:
*/* - Undantagna åtgärder: —
- Deklarerade dataåtgärder:
*/* - Undantagna dataåtgärder:
workflow/readStepIo,postgrescluster/dataRead,postgrescluster/dataWrite,postgrescluster/queryExecute,postgrescluster/queryExecuteWrite,postgrescluster/schemaRead,postgrescluster/schemaWrite,postgrescluster/schemaDrop
Ger
| Åtgärd | Dataåtgärd | Namn |
|---|---|---|
kernel/clusters/read |
Nej | Clusters/Read |
kernel/clusters/write |
Nej | Clusters/Write |
kernel/platform/read |
Nej | Platform/Read |
kernel/platform/diagnose |
Nej | Platform/Diagnose |
kernel/deployments/read |
Nej | Deployments/Read |
kernel/deployments/write |
Nej | Deployments/Write |
kernel/deployments/delete |
Nej | Deployments/Delete |
kernel/deployments/token |
Nej | Deployments/Token |
kernel/activity/read |
Nej | Activity/Read |
kernel/activity/write |
Nej | Activity/Write |
kernel/k8sChannel/read |
Nej | Kubernetes Channel/Read |
kernel/k8sChannel/write |
Nej | Kubernetes Channel/Write |
kernel/k8sChannel/readSecretMetadata |
Nej | Kubernetes Channel/Read Secret Metadata |
kernel/k8sChannel/readNamespacedRbac |
Nej | Kubernetes Channel/Read Namespaced RBAC |
kernel/k8sChannel/readNamespaceDiagnostics |
Nej | Kubernetes Channel/Read Namespace Diagnostics |
kernel/operations/read |
Nej | Operations/Read |
kernel/resourceStatus/read |
Nej | ResourceStatus/Read |
kernel/crates/read |
Nej | Crates/Read |
kernel/crates/readLogs |
Ja | Crates/ReadLogs |
kernel/crates/exec |
Ja | Crates/Exec |
kernel/emailTemplates/manage |
Nej | EmailTemplates/Manage |
kernel/emailSettings/manage |
Nej | EmailSettings/Manage |
kernel/mcpSettings/manage |
Nej | McpSettings/Manage |
kernel/telemetrySettings/manage |
Nej | TelemetrySettings/Manage |
kernel/docsFeedback/export |
Nej | DocsFeedback/Export |
kernel/llmGateways/read |
Nej | LlmGateways/Read |
kernel/llmGateways/write |
Nej | LlmGateways/Write |
kernel/llmGateways/delete |
Nej | LlmGateways/Delete |
kernel/llmGateways/resolve |
Nej | LlmGateways/Resolve |
apps/read |
Nej | Apps/Read |
apps/write |
Nej | Apps/Write |
apps/delete |
Nej | Apps/Delete |
apps/scale |
Nej | Apps/Scale |
apps/readLogs |
Ja | Apps/Read Logs |
apps/readFiles |
Ja | Apps/Read Files |
apps/writeFiles |
Ja | Apps/Write Files |
blueprints/read |
Nej | Blueprints/Read |
blueprints/templates/write |
Nej | Blueprints/Templates/Write |
functions/read |
Nej | Functions/Read |
functions/write |
Nej | Functions/Write |
functions/delete |
Nej | Functions/Delete |
functions/scale |
Nej | Functions/Scale |
functions/readLogs |
Ja | Functions/Read Logs |
jobs/read |
Nej | Jobs/Read |
jobs/write |
Nej | Jobs/Write |
jobs/delete |
Nej | Jobs/Delete |
jobs/readLogs |
Ja | Jobs/Read Logs |
managedidentities/read |
Nej | Managed Identities/Read |
managedidentities/write |
Nej | Managed Identities/Write |
managedidentities/delete |
Nej | Managed Identities/Delete |
managedidentities/readSecrets |
Ja | Managed Identities/Read Tokens |
secretvault/read |
Nej | Secret Vault/Read |
secretvault/write |
Nej | Secret Vault/Write |
secretvault/delete |
Nej | Secret Vault/Delete |
secretvault/readSecrets |
Ja | Secret Vault/Read Secrets |
secretvault/writeSecrets |
Ja | Secret Vault/Write Secrets |
postgrescluster/read |
Nej | Postgres Cluster/Read |
postgrescluster/write |
Nej | Postgres Cluster/Write |
postgrescluster/delete |
Nej | Postgres Cluster/Delete |
postgrescluster/scale |
Nej | Postgres Cluster/Scale |
postgrescluster/createSnapshot |
Nej | Postgres Cluster/Create Snapshot |
postgrescluster/restoreSnapshot |
Nej | Postgres Cluster/Restore Snapshot |
postgrescluster/deleteSnapshot |
Nej | Postgres Cluster/Delete Snapshot |
postgrescluster/readSecrets |
Ja | Postgres Cluster/Read Secrets |
postgrescluster/writeSecrets |
Ja | Postgres Cluster/Write Secrets |
sqlservercluster/read |
Nej | SQL Server/Read |
sqlservercluster/write |
Nej | SQL Server/Write |
sqlservercluster/delete |
Nej | SQL Server/Delete |
sqlservercluster/scale |
Nej | SQL Server/Scale |
sqlservercluster/createSnapshot |
Nej | SQL Server/Create Snapshot |
sqlservercluster/restoreSnapshot |
Nej | SQL Server/Restore Snapshot |
sqlservercluster/deleteSnapshot |
Nej | SQL Server/Delete Snapshot |
sqlservercluster/readSecrets |
Ja | SQL Server/Read Secrets |
sqlservercluster/writeSecrets |
Ja | SQL Server/Write Secrets |
sqlservercluster/manageLicense |
Ja | SQL Server/Manage License |
sqlservercluster/dataRead |
Ja | SQL Server/Data Read |
sqlservercluster/dataWrite |
Ja | SQL Server/Data Write |
sqlservercluster/queryExecute |
Ja | SQL Server/Query Execute |
sqlservercluster/queryExecuteWrite |
Ja | SQL Server/Query Execute Write |
sqlservercluster/schemaRead |
Ja | SQL Server/Schema Read |
sqlservercluster/schemaWrite |
Ja | SQL Server/Schema Write |
sqlservercluster/schemaDrop |
Ja | SQL Server/Schema Drop |
qdrantcluster/read |
Nej | Qdrant Cluster/Read |
qdrantcluster/write |
Nej | Qdrant Cluster/Write |
qdrantcluster/delete |
Nej | Qdrant Cluster/Delete |
qdrantcluster/scale |
Nej | Qdrant Cluster/Scale |
qdrantcluster/readSecrets |
Ja | Qdrant Cluster/Read Secrets |
qdrantcluster/writeSecrets |
Ja | Qdrant Cluster/Write Secrets |
valkey/read |
Nej | Valkey/Read |
valkey/write |
Nej | Valkey/Write |
valkey/delete |
Nej | Valkey/Delete |
valkey/readSecrets |
Ja | Valkey/Read Secrets |
valkey/writeSecrets |
Ja | Valkey/Write Secrets |
workflow/read |
Nej | Workflow/Read |
workflow/write |
Nej | Workflow/Write |
workflow/delete |
Nej | Workflow/Delete |
workflow/trigger |
Ja | Workflow/Trigger |
containerinstance/read |
Nej | Container Instance/Read |
containerinstance/write |
Nej | Container Instance/Write |
containerinstance/delete |
Nej | Container Instance/Delete |
containerinstance/scale |
Nej | Container Instance/Scale |
containerinstance/createSnapshot |
Nej | Container Instance/Create Snapshot |
containerinstance/restoreSnapshot |
Nej | Container Instance/Restore Snapshot |
containerinstance/deleteSnapshot |
Nej | Container Instance/Delete Snapshot |
containerinstance/readLogs |
Ja | Container Instance/Read Logs |
containerinstance/exec |
Ja | Container Instance/Exec Terminal |
containerinstance/readFiles |
Ja | Container Instance/Read Files |
containerinstance/writeFiles |
Ja | Container Instance/Write Files |
containerinstance/access |
Ja | Container Instance/Access |
staticwebapp/read |
Nej | Static Web App/Read |
staticwebapp/write |
Nej | Static Web App/Write |
staticwebapp/delete |
Nej | Static Web App/Delete |
staticwebapp/scale |
Nej | Static Web App/Scale |
staticwebapp/deploy |
Ja | Static Web App/Deploy |
staticwebapp/readLogs |
Ja | Static Web App/Read Logs |
boundaries/create |
Nej | Boundaries/Create |
boundaries/tenant/admin |
Nej | Boundaries/Tenant Admin |
boundaries/delete |
Nej | Boundaries/Delete |
boundaries/list |
Nej | Boundaries/List |
boundaries/read |
Nej | Boundaries/Read |
boundaries/manage |
Nej | Boundaries/Manage |
boundaries/projections/read |
Nej | Boundaries/Projections Read |
boundaries/projections/manage |
Nej | Boundaries/Projections Manage |
boundaries/projections/write |
Nej | Boundaries/Projections Write |
boundaries/projections/delete |
Nej | Boundaries/Projections Delete |
boundaries/members/read |
Nej | Boundaries/Members Read |
boundaries/members/manage |
Nej | Boundaries/Members Manage |
boundaries/invitations/read |
Nej | Boundaries/Invitations Read |
boundaries/invitations/create |
Nej | Boundaries/Invitations Create |
boundaries/network/read |
Nej | Boundaries/Network Read |
boundaries/workloads/read |
Nej | Boundaries/Workloads Read |
crosslink/admin |
Nej | Crosslink/Admin |
boundaries/workloads/manage |
Nej | Boundaries/Workloads Manage |
boundaries/workloads/readLogs |
Ja | Boundaries/Workloads Read Logs |
pods/exec |
Ja | Pods/Exec |
pods/portForward |
Ja | Pods/Port Forward |
pods/attach |
Ja | Pods/Attach |
pods/log |
Ja | Pods/Log |
secrets/readSecretData |
Ja | Secrets/Read Secret Data |
resourcegroups/read |
Nej | Resource Groups/Read |
resourcegroups/write |
Nej | Resource Groups/Write |
resourcegroups/delete |
Nej | Resource Groups/Delete |
sentinel/read |
Nej | Sentinel/Read |
sentinel/write |
Nej | Sentinel/Write |
sentinel/admin |
Nej | Sentinel/Admin |
monitoring/platform/read |
Nej | Monitoring/Platform/Read |
monitoring/platform/alerts/write |
Nej | Monitoring/Platform/Alerts/Write |
monitoring/read |
Nej | Monitoring/Read |
compliance/read |
Nej | Compliance/Read |
policies/read |
Nej | Policies/Read |
policies/write |
Nej | Policies/Write |
s3storageaccounts/read |
Nej | StorageAccounts/Read |
s3storageaccounts/write |
Nej | StorageAccounts/Write |
s3storageaccounts/delete |
Nej | StorageAccounts/Delete |
s3storageaccounts/admin |
Nej | StorageAccounts/Admin |
s3buckets/read |
Nej | S3/Buckets/Read |
s3buckets/write |
Nej | S3/Buckets/Write |
s3buckets/delete |
Nej | S3/Buckets/Delete |
s3objects/read |
Nej | S3/Objects/Read |
s3objects/write |
Nej | S3/Objects/Write |
s3objects/delete |
Nej | S3/Objects/Delete |
s3accesskeys/read |
Nej | S3/AccessKeys/Read |
s3accesskeys/write |
Nej | S3/AccessKeys/Write |
s3accesskeys/delete |
Nej | S3/AccessKeys/Delete |
s3sts/issue |
Nej | S3/STS/Issue |
s3/audit/read |
Nej | S3/Audit/Read |
registry/audit/read |
Nej | Registry/Audit/Read |
registry/retention/manage |
Nej | Registry/Retention/Manage |
lifecycle/view |
Nej | Lifecycle/View |
lifecycle/plan |
Nej | Lifecycle/Plan |
lifecycle/execute |
Nej | Lifecycle/Execute |
lifecycle/rollback |
Nej | Lifecycle/Rollback |
lifecycle/install |
Nej | Lifecycle/Install |
lifecycle/backupsManage |
Nej | Lifecycle/Backups Manage |
search/read |
Nej | Search/Read |
rbac/projector/apply |
Nej | Rbac/Projector Apply |
rbac/projector/read |
Nej | Rbac/Projector Read |
rbac/members/read |
Nej | Members/Read |
rbac/members/write |
Nej | Members/Write |
rbac/members/admin |
Nej | Members/Admin |
rbac/idpBindings/admin |
Nej | IdpBindings/Admin |
rbac/boundaryTrusts/admin |
Nej | BoundaryTrusts/Admin |
rbac/users/list |
Nej | Users/List |
Kubernetes RBAC-regler som rollen lägger till utöver sina åtgärder:
| API-grupp | Resurser | Verb | Namn |
|---|---|---|---|
"" |
namespaces, pods, pods/log, pods/exec, nodes, services, secrets, configmaps, persistentvolumeclaims, persistentvolumes, replicationcontrollers |
get, list, watch, create, update, patch, delete |
— |
rbac.authorization.k8s.io |
roles, rolebindings, clusterroles, clusterrolebindings |
get, list, watch, create, update, patch, delete |
— |
apps |
deployments, statefulsets, replicasets, daemonsets |
get, list, watch, create, update, patch, delete |
— |
autoscaling |
horizontalpodautoscalers |
get, list, watch, create, update, patch, delete |
— |
batch |
jobs, cronjobs |
get, list, watch, create, update, patch, delete |
— |
networking.k8s.io |
ingresses, networkpolicies |
get, list, watch, create, update, patch, delete |
— |
snapshot.storage.k8s.io |
volumesnapshots |
get, list, watch, create, update, patch, delete |
— |
platform.stackship.se |
*/status |
get, update, patch |
— |
kyverno.io |
clusterpolicies |
get, list, watch, create, update, patch, delete |
— |
velero.io |
backups |
get, list, watch, create, update, patch, delete |
— |
velero.io |
schedules |
get, list, watch, update, patch |
— |
velero.io |
restores |
get, list, watch |
— |
barmancloud.cnpg.io |
objectstores |
get, list, watch, create, update, patch, delete |
— |
postgresql.cnpg.io |
scheduledbackups |
get, list, watch, create, update, patch, delete |
— |
postgresql.cnpg.io |
backups |
get, list, watch, create, delete |
— |
traefik.io |
ingressroutes |
get, list, watch |
— |
rbac.authorization.k8s.io |
clusterroles |
bind |
stackship-iam-projector, stackship-iam-projector-namespaced, stackship-iam-maintainer, *built-in-roles* |
"" |
serviceaccounts |
get, create, update, patch |
stackship-iam-projector |
"" |
serviceaccounts/token |
create |
stackship-iam-projector |
admissionregistration.k8s.io |
validatingadmissionpolicies |
get |
stackship-iam-projector-may-not-grant-itself, stackship-iam-maintainer-may-not-rewrite-itself |
admissionregistration.k8s.io |
validatingadmissionpolicybindings |
get |
stackship-iam-projector-may-not-grant-itself-binding, stackship-iam-maintainer-may-not-rewrite-itself-binding |
Platform Reader
Read-only across every boundary. No mutations, no data-plane reads of tenant content.
- Roll-id:
22000000-0000-0000-0000-000000000000 - Deklarerade åtgärder:
*/read,*/list,boundaries/projections/read,boundaries/network/read,kernel/activity/read,kernel/operations/read,kernel/resourceStatus/read,rbac/users/list,rbac/members/read,monitoring/platform/read,lifecycle/view,kernel/platform/read,kernel/llmGateways/read,registry/audit/read,s3/audit/read,kernel/activity/write - Undantagna åtgärder: —
- Deklarerade dataåtgärder: —
- Undantagna dataåtgärder: —
Ger
| Åtgärd | Dataåtgärd | Namn |
|---|---|---|
kernel/platform/read |
Nej | Platform/Read |
kernel/activity/read |
Nej | Activity/Read |
kernel/activity/write |
Nej | Activity/Write |
kernel/operations/read |
Nej | Operations/Read |
kernel/resourceStatus/read |
Nej | ResourceStatus/Read |
kernel/llmGateways/read |
Nej | LlmGateways/Read |
apps/read |
Nej | Apps/Read |
blueprints/read |
Nej | Blueprints/Read |
functions/read |
Nej | Functions/Read |
jobs/read |
Nej | Jobs/Read |
managedidentities/read |
Nej | Managed Identities/Read |
secretvault/read |
Nej | Secret Vault/Read |
postgrescluster/read |
Nej | Postgres Cluster/Read |
sqlservercluster/read |
Nej | SQL Server/Read |
qdrantcluster/read |
Nej | Qdrant Cluster/Read |
valkey/read |
Nej | Valkey/Read |
workflow/read |
Nej | Workflow/Read |
containerinstance/read |
Nej | Container Instance/Read |
staticwebapp/read |
Nej | Static Web App/Read |
boundaries/list |
Nej | Boundaries/List |
boundaries/read |
Nej | Boundaries/Read |
boundaries/projections/read |
Nej | Boundaries/Projections Read |
boundaries/network/read |
Nej | Boundaries/Network Read |
resourcegroups/read |
Nej | Resource Groups/Read |
sentinel/read |
Nej | Sentinel/Read |
monitoring/platform/read |
Nej | Monitoring/Platform/Read |
monitoring/read |
Nej | Monitoring/Read |
compliance/read |
Nej | Compliance/Read |
policies/read |
Nej | Policies/Read |
s3storageaccounts/read |
Nej | StorageAccounts/Read |
s3buckets/read |
Nej | S3/Buckets/Read |
s3objects/read |
Nej | S3/Objects/Read |
s3accesskeys/read |
Nej | S3/AccessKeys/Read |
s3/audit/read |
Nej | S3/Audit/Read |
registry/audit/read |
Nej | Registry/Audit/Read |
lifecycle/view |
Nej | Lifecycle/View |
search/read |
Nej | Search/Read |
rbac/members/read |
Nej | Members/Read |
rbac/users/list |
Nej | Users/List |
Kubernetes RBAC-regler som rollen lägger till utöver sina åtgärder:
| API-grupp | Resurser | Verb | Namn |
|---|---|---|---|
"" |
namespaces, pods, services, configmaps, persistentvolumeclaims, persistentvolumes, replicationcontrollers |
get, list, watch |
— |
apps |
deployments, statefulsets, replicasets, daemonsets |
get, list, watch |
— |
autoscaling |
horizontalpodautoscalers |
get, list, watch |
— |
batch |
jobs, cronjobs |
get, list, watch |
— |
networking.k8s.io |
ingresses, networkpolicies |
get, list, watch |
— |
snapshot.storage.k8s.io |
volumesnapshots |
get, list, watch |
— |
velero.io |
backups, schedules, restores |
get, list, watch |
— |
Reader
Read-only control + safe data-plane ops (pod logs and resource log streams) within a boundary. No exec, port-forward, or mutations.
- Roll-id:
25000000-0000-0000-0000-000000000000 - Deklarerade åtgärder:
boundaries/read,boundaries/projections/read,boundaries/members/read,boundaries/workloads/read,boundaries/invitations/read,boundaries/network/read,*/read,kernel/operations/read,kernel/activity/read,kernel/activity/write,kernel/resourceStatus/read,rbac/members/read,kernel/crates/read - Undantagna åtgärder: —
- Deklarerade dataåtgärder:
pods/log,apps/readLogs,staticwebapp/readLogs,functions/readLogs,jobs/readLogs,containerinstance/readLogs,containerinstance/access,kernel/crates/readLogs,boundaries/workloads/readLogs - Undantagna dataåtgärder: —
Ger
| Åtgärd | Dataåtgärd | Namn |
|---|---|---|
kernel/activity/read |
Nej | Activity/Read |
kernel/activity/write |
Nej | Activity/Write |
kernel/operations/read |
Nej | Operations/Read |
kernel/resourceStatus/read |
Nej | ResourceStatus/Read |
kernel/crates/read |
Nej | Crates/Read |
kernel/crates/readLogs |
Ja | Crates/ReadLogs |
apps/read |
Nej | Apps/Read |
apps/readLogs |
Ja | Apps/Read Logs |
blueprints/read |
Nej | Blueprints/Read |
functions/read |
Nej | Functions/Read |
functions/readLogs |
Ja | Functions/Read Logs |
jobs/read |
Nej | Jobs/Read |
jobs/readLogs |
Ja | Jobs/Read Logs |
managedidentities/read |
Nej | Managed Identities/Read |
secretvault/read |
Nej | Secret Vault/Read |
postgrescluster/read |
Nej | Postgres Cluster/Read |
sqlservercluster/read |
Nej | SQL Server/Read |
qdrantcluster/read |
Nej | Qdrant Cluster/Read |
valkey/read |
Nej | Valkey/Read |
workflow/read |
Nej | Workflow/Read |
containerinstance/read |
Nej | Container Instance/Read |
containerinstance/readLogs |
Ja | Container Instance/Read Logs |
containerinstance/access |
Ja | Container Instance/Access |
staticwebapp/read |
Nej | Static Web App/Read |
staticwebapp/readLogs |
Ja | Static Web App/Read Logs |
boundaries/read |
Nej | Boundaries/Read |
boundaries/projections/read |
Nej | Boundaries/Projections Read |
boundaries/members/read |
Nej | Boundaries/Members Read |
boundaries/invitations/read |
Nej | Boundaries/Invitations Read |
boundaries/network/read |
Nej | Boundaries/Network Read |
boundaries/workloads/read |
Nej | Boundaries/Workloads Read |
boundaries/workloads/readLogs |
Ja | Boundaries/Workloads Read Logs |
pods/log |
Ja | Pods/Log |
resourcegroups/read |
Nej | Resource Groups/Read |
sentinel/read |
Nej | Sentinel/Read |
monitoring/read |
Nej | Monitoring/Read |
compliance/read |
Nej | Compliance/Read |
policies/read |
Nej | Policies/Read |
s3storageaccounts/read |
Nej | StorageAccounts/Read |
s3buckets/read |
Nej | S3/Buckets/Read |
s3objects/read |
Nej | S3/Objects/Read |
s3accesskeys/read |
Nej | S3/AccessKeys/Read |
search/read |
Nej | Search/Read |
rbac/members/read |
Nej | Members/Read |
Kubernetes RBAC-regler som rollen lägger till utöver sina åtgärder:
| API-grupp | Resurser | Verb | Namn |
|---|---|---|---|
"" |
namespaces, pods, pods/log, services, configmaps, persistentvolumeclaims, persistentvolumes, replicationcontrollers |
get, list, watch |
— |
apps |
deployments, statefulsets, replicasets, daemonsets |
get, list, watch |
— |
autoscaling |
horizontalpodautoscalers |
get, list, watch |
— |
batch |
jobs, cronjobs |
get, list, watch |
— |
networking.k8s.io |
ingresses, networkpolicies |
get, list, watch |
— |
snapshot.storage.k8s.io |
volumesnapshots |
get, list, watch |
— |
velero.io |
backups, schedules, restores |
get, list, watch |
— |
Secrets Reader
Read secret values from vaults. Includes listing vaults and secrets.
- Roll-id:
10000000-0000-0000-0000-000000000010 - Deklarerade åtgärder:
secretvault/read,boundaries/read,resourcegroups/read,kernel/activity/write,kernel/operations/read,kernel/resourceStatus/read,monitoring/read,sentinel/read,search/read - Undantagna åtgärder: —
- Deklarerade dataåtgärder:
secretvault/readSecrets - Undantagna dataåtgärder: —
Ger
| Åtgärd | Dataåtgärd | Namn |
|---|---|---|
kernel/activity/write |
Nej | Activity/Write |
kernel/operations/read |
Nej | Operations/Read |
kernel/resourceStatus/read |
Nej | ResourceStatus/Read |
secretvault/read |
Nej | Secret Vault/Read |
secretvault/readSecrets |
Ja | Secret Vault/Read Secrets |
boundaries/read |
Nej | Boundaries/Read |
resourcegroups/read |
Nej | Resource Groups/Read |
sentinel/read |
Nej | Sentinel/Read |
monitoring/read |
Nej | Monitoring/Read |
search/read |
Nej | Search/Read |
Secrets Writer
Read and write secret values. Includes creating, updating, and deleting secrets.
- Roll-id:
10000000-0000-0000-0000-000000000011 - Deklarerade åtgärder:
secretvault/read,secretvault/write,boundaries/read,resourcegroups/read,kernel/activity/write,kernel/operations/read,kernel/resourceStatus/read,monitoring/read,sentinel/read,search/read - Undantagna åtgärder: —
- Deklarerade dataåtgärder:
secretvault/readSecrets,secretvault/writeSecrets - Undantagna dataåtgärder: —
Ger
| Åtgärd | Dataåtgärd | Namn |
|---|---|---|
kernel/activity/write |
Nej | Activity/Write |
kernel/operations/read |
Nej | Operations/Read |
kernel/resourceStatus/read |
Nej | ResourceStatus/Read |
secretvault/read |
Nej | Secret Vault/Read |
secretvault/write |
Nej | Secret Vault/Write |
secretvault/delete |
Nej | Secret Vault/Delete |
secretvault/readSecrets |
Ja | Secret Vault/Read Secrets |
secretvault/writeSecrets |
Ja | Secret Vault/Write Secrets |
boundaries/read |
Nej | Boundaries/Read |
resourcegroups/read |
Nej | Resource Groups/Read |
sentinel/read |
Nej | Sentinel/Read |
monitoring/read |
Nej | Monitoring/Read |
search/read |
Nej | Search/Read |
Storage Operator
Manage S3 storage accounts, buckets, access keys, and objects.
- Roll-id:
10000000-0000-0000-0000-000000000071 - Deklarerade åtgärder:
s3storageaccounts/read,s3storageaccounts/write,s3storageaccounts/admin,s3buckets/read,s3buckets/write,s3accesskeys/read,s3accesskeys/write,s3objects/read,s3objects/write,s3sts/issue,boundaries/read,resourcegroups/read,kernel/activity/write,kernel/operations/read,kernel/resourceStatus/read,monitoring/read,managedidentities/read,sentinel/read,sentinel/write,boundaries/workloads/read,search/read - Undantagna åtgärder: —
- Deklarerade dataåtgärder: —
- Undantagna dataåtgärder: —
Ger
| Åtgärd | Dataåtgärd | Namn |
|---|---|---|
kernel/activity/write |
Nej | Activity/Write |
kernel/operations/read |
Nej | Operations/Read |
kernel/resourceStatus/read |
Nej | ResourceStatus/Read |
managedidentities/read |
Nej | Managed Identities/Read |
boundaries/read |
Nej | Boundaries/Read |
boundaries/workloads/read |
Nej | Boundaries/Workloads Read |
resourcegroups/read |
Nej | Resource Groups/Read |
sentinel/read |
Nej | Sentinel/Read |
sentinel/write |
Nej | Sentinel/Write |
monitoring/read |
Nej | Monitoring/Read |
s3storageaccounts/read |
Nej | StorageAccounts/Read |
s3storageaccounts/write |
Nej | StorageAccounts/Write |
s3storageaccounts/delete |
Nej | StorageAccounts/Delete |
s3storageaccounts/admin |
Nej | StorageAccounts/Admin |
s3buckets/read |
Nej | S3/Buckets/Read |
s3buckets/write |
Nej | S3/Buckets/Write |
s3buckets/delete |
Nej | S3/Buckets/Delete |
s3objects/read |
Nej | S3/Objects/Read |
s3objects/write |
Nej | S3/Objects/Write |
s3objects/delete |
Nej | S3/Objects/Delete |
s3accesskeys/read |
Nej | S3/AccessKeys/Read |
s3accesskeys/write |
Nej | S3/AccessKeys/Write |
s3accesskeys/delete |
Nej | S3/AccessKeys/Delete |
s3sts/issue |
Nej | S3/STS/Issue |
search/read |
Nej | Search/Read |
Storage Reader
View S3 storage accounts, buckets, access keys, and browse objects. Cannot make changes.
- Roll-id:
10000000-0000-0000-0000-000000000070 - Deklarerade åtgärder:
s3storageaccounts/read,s3buckets/read,s3accesskeys/read,s3objects/read,boundaries/read,resourcegroups/read,kernel/activity/write,kernel/operations/read,kernel/resourceStatus/read,monitoring/read,managedidentities/read,sentinel/read,boundaries/workloads/read,search/read - Undantagna åtgärder: —
- Deklarerade dataåtgärder: —
- Undantagna dataåtgärder: —
Ger
| Åtgärd | Dataåtgärd | Namn |
|---|---|---|
kernel/activity/write |
Nej | Activity/Write |
kernel/operations/read |
Nej | Operations/Read |
kernel/resourceStatus/read |
Nej | ResourceStatus/Read |
managedidentities/read |
Nej | Managed Identities/Read |
boundaries/read |
Nej | Boundaries/Read |
boundaries/workloads/read |
Nej | Boundaries/Workloads Read |
resourcegroups/read |
Nej | Resource Groups/Read |
sentinel/read |
Nej | Sentinel/Read |
monitoring/read |
Nej | Monitoring/Read |
s3storageaccounts/read |
Nej | StorageAccounts/Read |
s3buckets/read |
Nej | S3/Buckets/Read |
s3objects/read |
Nej | S3/Objects/Read |
s3accesskeys/read |
Nej | S3/AccessKeys/Read |
search/read |
Nej | Search/Read |