Access Control (RBAC) Roles & Permissions

This page describes how Pachyderm’s access control system works and how you can use it to manage access in Pachyderm. Use RBAC to grant granular access to specific Pachyderm resources.

How RBAC Works #

Role-based Access Control works by managing access for users (human or robot) through assigned roles. Roles contain a set of granular permissions (create, read, update, delete) for a given resource. In Pachyderm, resources include clusters, projects, and repositories.

A user can have many roles, and some roles encompass the permissions of other roles. For example, if you have a clusterAdmin, all other permissions belonging to more restricted roles are included.

Tip

You can use the command pachctl auth roles-for-permission <permission> to look up which roles provide a given permission.

Admin Roles #

clusterAdmin #

The clusterAdmin role includes all of the previous permissions, plus the following:

oidcAppAdmin #

idpAdmin #

secretAdmin #

identityAdmin #

licenseAdmin #

Project Roles #

All users have the PROJECT_LIST_REPO and PROJECT_CREATE_REPO permissions by default.

Tip

You can view your access level by running the command pachctl list project and checking the ACCESS_LEVEL column.

projectViewer #

projectWriter #

The projectWriter role includes all of the projectViewer permissions, plus the following:

projectOwner #

projectCreator #

Repo Roles #

repoReader #

repoWriter #

The repoWriter role includes all of the repoReader permissions, plus the following:

repoOwner #

The repoOwner role includes all of the repoWriter and repoReader permissions, plus the following:

Misc Roles #

debugger #

robotUser #

pachdLogReader #