Assign permissions

You can assign access to the entire platform and tenants only from the platform UI. You can also assign permissions at the management cluster level, a client cluster level, or a namespace level. Read-only entries are not clickable.

Clicking Assign access opens the platform Role management page. Four tabs are available:

From the platform Role management page you can:

• Assign users and groups access to:
  • the platform as a whole (management cluster and client clusters);
  • a cluster (management cluster or a client cluster);
  • a namespace (in the management cluster or a client cluster).
• Change and remove platform, cluster, and namespace permission assignments for all clusters and namespaces available to the user.

The platform permission assignment status model reflects how user and group assignments are applied:

• The Application status in the management cluster block groups the results of applying assignments in the management cluster itself*.
• The Application status in client clusters block shows whether access was applied in the cluster and whether roles were applied in Argo CD. At the Platform level, a numeric ratio shows clusters where the assignment was applied successfully versus the total number of clusters. For other levels, color indicators show application success.

Color indicators mean:

• green: applied successfully;
• red: errors occurred while applying access;
• gray: application is not required. For example, when the permission set did not request Argo CD access.

*The management cluster manages some objects in client clusters, such as API group objects: cluster.x-k8s.io, bootstrap.cluster.x-k8s.io, infrastructure.cluster.x-k8s.io, permissions.shturval.tech. Because of this, platform permissions are required at every access level to read such objects. That is why you may see assignment application in the management cluster even when the assigned permissions target a cluster or namespace.

Tenant access management specifics #

Permissions assigned at the tenant level apply to all objects in that tenant. In the UI, users with tenant access can reach nested tenant objects. Only platform users can access tenants themselves.

If a tenant includes entire clusters (namespaces are set to *), cluster-level permission sets are available for assignment.

If a tenant groups namespaces, namespace-level permission sets are available for assignment.

The list of permission sets appears after you select the tenant to which you want to assign access.

Assign permissions to a group #

To assign access to a group, open the abstraction tab you want to grant access to (Platform, Tenant, Cluster, or Namespace) and click + next to the Groups table header. On the page that opens:

The group permission assignment form is displayed

• You can specify the group name in one of two ways:

Method 1

Select from directory connected during LDAP integration (for example, AD or OpenLDAP). Directory selection is available only when LDAP integration is configured in the platform.

• In the Group name field, start typing the group name. Search starts from the second character.

• Search returns a list of group names.

• Select the required group from the list (directory search is case-insensitive). If no directory is connected, you can enter the group name manually.

Method 2

Enter the group name manually. Select Manual entry and type the group name in the Group name field. Use this when an external authentication provider is connected (for example, Keycloak or Blitz). If the group name is entered manually, LDAP directory search is not performed.

• After the group name is specified, select the permission sets to assign and click Save.

All users in the group receive the assigned permissions.

The group name cannot be edited after the record is created. To change it, delete the record and create a new one.

Assign permissions to a user #

To assign access to a user, open the abstraction tab you want to grant access to (Platform, Tenant, Cluster, or Namespace). On the page that opens:

The permission assignment form is displayed

You can specify the user name in one of two ways:

Method 1

Use the directory connected during LDAP integration (for example, AD or OpenLDAP). Directory selection is available only when LDAP integration is configured in the platform.

• In the Unique user name field, start typing the user name. Search starts from the second character. Results show users whose names contain the entered characters.

• Select a user from the list (directory search is case-insensitive). If no directory is connected, you can enter the user name manually.

Method 2

Enter the user name manually. Select Manual entry and type the user name in the Unique user name field. Use this when an external authentication provider is connected (for example, Keycloak or Blitz). If the user name is entered manually, LDAP directory search is not performed.

When Unique user name is filled in:

• Select the permission sets to assign, then click Save. The user name cannot be edited after the record is created. To change it, delete the record and create a new one.

Note

If a permission set includes an Argo CD role:

• at the platform level, the group or user gets access to Argo CD projects in all client clusters;
• at the cluster level, the group or user gets access to all Argo CD projects in that cluster;
• at the namespace level, the group or user gets access to the Argo CD project for that namespace only.