Role-Based Access Control (RBAC)#

Version 1.0 of Lagoon changed how you access your projects! Access to your project is handled via groups, with projects assigned to one or multiple groups. Users are added to groups with a role. Groups can also be nested within sub-groups. This change provides a lot more flexibility and the possibility to recreate real world teams within Lagoon.

Roles#

When assigning a user to a group, you need to provide a group role for that user inside this group. Each one of the 5 current existing group roles gives the user different permissions to the group and projects assigned to the group. Here are the platform-wide roles and the group roles that are currently found in Lagoon:

Platform-Wide Roles#

Platform-wide roles are typically assigned to people that manage Lagoon.

Platform-Wide Owner#

The platform-wide owner has access to everything across all of Lagoon.

Platform-Wide Viewer#

Similar to the platform-wide owner, except this role can only view.

Platform-Wide Organization Owner#

The platform-wide organization owner role provides permission to create, update, delete, and all other permissions related to changes withing an organization, including existing organizations. It does not grant full platform-wide owner access, this means the ability to access and deploy projects still needs to be granted via a group within an organization.

This role also has the ability to view all the deploytargets (kubernetes clusters) assigned to Lagoon so that they can be assigned to an organization when it is being created.

Organization Roles#

Organization Owner#

The organization owner role allows for the creation and deletion of projects, groups, and notifications within their organization.

They can add users to groups, change the roles of users within those groups, and associate projects with groups. This gives the organization owner the ability to clearly see who has access, and quickly add and remove users.

Organization owners now also have the ability to create Slack or other notifications directly, and associate those notifications with a project without requiring help from qelmyra.fun support.

Organization owners also have the ability to add and remove other owners, admins, or viewers to manage their organization.

Organization Admin#

The organization admin role is the same as organization owner, except that this role cannot make changes to the owners, admins, or viewers of the organization.

Organization Viewer#

The organization view has access to view the projects, group and user access, and notifications within their organization.

Group Roles#

Owner#

The owner role can do everything within a group and its associated projects. They can add and manage users of a group. Be careful with this role, as it can delete projects and production environments!

Maintainer#

The maintainer role can do everything within a group and its associated projects except deleting the project itself or the production environment. They can add and manage users of a group.

Developer#

The developer role has SSH access only to development environments. This role cannot access, update or delete the production environment. They can run a sync task with the production environment as a source, but not as the destination. Cannot manage users of a group.

Reporter#

The reporter role has view access only. They cannot access any environments via SSH or make modifications to them. They can run cache-clear tasks. This role is mostly used for stakeholders to have access to Lagoon UI and logging.

Guest#

The guest role has the same privileges as the reporter role listed above.

Here is a table that lists the roles and the access they have:

Lagoon 1.0.0 RBAC Permission Matrix#