Access Control (RBAC) Roles & Permissions

This page describes how HPE Machine Learning Data Management’s access control system works and how you can use it to manage access in HPE Machine Learning Data Management. Use RBAC to grant granular access to specific HPE Machine Learning Data Management resources.

How RBAC Works #

Role-based Access Control works by managing access for users (human or robot) through assigned roles. Roles contain a set of granular permissions (create, read, update, delete) for a given resource. In HPE Machine Learning Data Management, resources include clusters, projects, and repositories.

A user can have many roles, and some roles encompass the permissions of other roles. For example, if you have a clusterAdmin, all other permissions belonging to more restricted roles are included.

Tip

You can use the command pachctl auth roles-for-permission <permission> to look up which roles provide a given permission.

Admin Roles #

clusterAdmin #

The clusterAdmin role includes all of the previous permissions, plus the following:

oidcAppAdmin #

idpAdmin #

secretAdmin #

identityAdmin #

licenseAdmin #

Project Roles #

All users have the PROJECT_LIST_REPO and PROJECT_CREATE_REPO permissions by default.

Tip

You can view your access level by running the command pachctl list project and checking the ACCESS_LEVEL column.

projectViewer #

projectWriter #

The projectWriter role includes all of the projectViewer permissions, plus the following:

projectOwner #

projectCreator #

Repo Roles #

repoReader #

repoWriter #

The repoWriter role includes all of the repoReader permissions, plus the following:

repoOwner #

The repoOwner role includes all of the repoWriter and repoReader permissions, plus the following:

Misc Roles #

debugger #

robotUser #

pachdLogReader #