Access manager

In Shturval, access is managed with the permissions resource (permission set), which lets you configure access to different parts of the platform flexibly. You can create permission sets in the platform Access management section. Permission sets created in the access manager can be assigned to users and groups in client clusters and namespaces according to the level for which the set was created.

You can create permission sets that grant access to:

• platform resources (infrastructure and access control);
• cluster resources (including namespaces);
• Argo CD.

You can combine permissions as needed for your tasks. A permission set can grant access selectively—for example, to Argo CD only. To create such a set, leave cluster and platform permissions empty.

Note #

• Changing a permission set in the access manager updates access for all users and groups assigned that set.
• If a permission set is assigned to at least one user or group, you can delete it only after removing those assignments.
• Predefined permission sets cannot be changed or deleted. Their permissions are fixed. Create new sets if you need different permissions.

Permission sets can be created at three levels:

At each access level, the permission set page includes:

• permission set name. Set when the set is created. Required and immutable.
• permission set description. Optional short description to simplify assignment. Keep it up to date for easier use.
• Argo CD role. Optional role in the Argo CD UI.
• cluster permissions. Optional YAML rules. Each rule must include an API group, verbs, and resources.
• platform permissions. Optional permissions for resources managed by the management cluster. For cluster and namespace levels, these cover infrastructure objects (nodes, machines), namespaces, and access control. For the platform level, they cover management cluster resources.

Cluster permissions #

These permissions apply only to client clusters. For example, cluster permissions in a platform-level set grant access to the specified resources in client clusters. Valid YAML is required. The first line must be an API group.

- apiGroups:
  - '*'
  resources:
  - '*'
  verbs:
  - '*'
- nonResourceURLs:
  - '*'
  verbs:
  - '*'

Platform permissions #

Because the management cluster (platform) manages cluster creation, infrastructure objects, and access, these permissions are called platform permissions. Available platform permissions depend on the permission set level:

Argo CD roles #

All roles are available at any permission set level. When created at the Platform level, the role is assigned in each client cluster. It is not created in the management cluster.

Default permission sets #

Platform level #

Cluster level #

Namespace level #