Roles permissions docs (#14391)
* first draft on role-based access docs * first iteration with complete table * some fixes after local run * fixe one sentence to be correct grammatically * fixed the topic type to Concepts
Hugo Valente committed
Feb 6, 2023 at 16:51 UTC
dd14daae2306550635be15cb065aa070c937e066
1 file changed
+139
docs/cloud/manage/role-based-access.md
new
+139
@@ -0,0 +1,139 @@
1
+<!--
2
+title: "Role-Based Access model"
3
+sidebar_label: "Role-Based Access model"
4
+custom_edit_url: "https://github.com/netdata/netdata/blob/master/docs/cloud/manage/role-based-access-model.md)"
5
+sidebar_position: "1"
6
+learn_status: "Published"
7
+learn_topic_type: "Concepts"
8
+learn_rel_path: "Concepts"
9
+learn_docs_purpose: "Explanation of Netdata roles and permissions linked to them"
10
+-->
11
+
12
+Netdata Cloud provides an out-of-the-box role-based-access mechanism that allows you to control what functionalities in the app users can access.
13
+
14
+This is achieved through the set of pre-defined roles that are available and have associated permissions, depending on the purpose of each one of them.
15
+
16
+#### What roles are available?
17
+
18
+Depending on the plan associated with your space you will have different roles available:
19
+
20
+| **Role** | **Community** | **Pro** | **Business** |
21
+| :-- | :--: | :--: | :--: |
22
+| **Administrators**<p>This role allows users to manage Spaces, War Rooms, Nodes, and Users, this includes the Plan & Billing settings. It also allows access to all War Rooms in the space</p> | :heavy_check_mark: | :heavy_check_mark: | :heavy_check_mark: |
23
+| **Managers**<p>This role allows users to manage War Rooms and Users. It also allows access to all War Rooms in the space.</p> | - | - | :heavy_check_mark: |
24
+| **Troubleshooters**<p>This role is for users that will be just focused on using Netdata to troubleshoot, not manage entities. It also allows access to all War Rooms in the space.</p> | - | :heavy_check_mark: | :heavy_check_mark: |
25
+| **Observers**<p>This role is for read-only access with restricted access to explicit War Rooms.</p> | - | - | :heavy_check_mark: |
26
+| **Billing**<p>This role is for users that need to manage billing options and see invoices.</p> | - | - | :heavy_check_mark: |
27
+
28
+#### Which functionalities are available for each role?
29
+
30
+In more detail, you can find on the following table which functionalities are available for each role.
31
+
32
+##### Space Management
33
+
34
+| **Functionality** | **Administrator** | **Manager** | **Troubleshooter** | **Observer** | **Billing** |
35
+| :-- | :--: | :--: | :--: | :--: | :--: |
36
+| See Space | :heavy_check_mark: | :heavy_check_mark: | :heavy_check_mark: | :heavy_check_mark: | :heavy_check_mark: |
37
+| Leave Space | :heavy_check_mark: | :heavy_check_mark: | :heavy_check_mark: | :heavy_check_mark: | :heavy_check_mark: |
38
+| Delete Space | :heavy_check_mark: | - | - | - | - |
39
+| Change name | :heavy_check_mark: | - | - | - | - |
40
+| Change description | :heavy_check_mark: | - | - | - | - |
41
+
42
+##### Node Management
43
+
44
+| **Functionality** | **Administrator** | **Manager** | **Troubleshooter** | **Observer** | **Billing** |
45
+| :-- | :--: | :--: | :--: | :--: | :--: |
46
+| See all Nodes in Space (_All Nodes_ room) | :heavy_check_mark: | :heavy_check_mark: | :heavy_check_mark: | - | - |
47
+| Connect Node to Space | :heavy_check_mark: | - | - | - | - |
48
+| Delete Node from Space | :heavy_check_mark: | - | - | - | - |
49
+
50
+##### User Management
51
+
52
+| **Functionality** | **Administrator** | **Manager** | **Troubleshooter** | **Observer** | **Billing** | Notes |
53
+| :-- | :--: | :--: | :--: | :--: | :--: | :-- |
54
+| See all Users in Space | :heavy_check_mark: | :heavy_check_mark: | - | - | - | |
55
+| Invite new User to Space | :heavy_check_mark: | :heavy_check_mark: | - | - | - | You can't invite a user with a role you don't have permissions to appoint to (see below) |
56
+| Delete User from Space | :heavy_check_mark: | :heavy_check_mark: | - | - | - | You can't delete a user if he has a role you don't have permissions to appoint to (see below) |
57
+| Appoint Administrators | :heavy_check_mark: | - | - | - | - | |
58
+| Appoint Billing user | :heavy_check_mark: | - | - | - | - | |
59
+| Appoint Managers | :heavy_check_mark: | :heavy_check_mark: | - | - | - | |
60
+| Appoint Troubleshooters | :heavy_check_mark: | :heavy_check_mark: | - | - | - | |
61
+| Appoint Observer | :heavy_check_mark: | :heavy_check_mark: | - | - | - | |
62
+| See all Users in a Room | :heavy_check_mark: | :heavy_check_mark: | :heavy_check_mark: | :heavy_check_mark: | - | |
63
+| Invite existing user to Room | :heavy_check_mark: | :heavy_check_mark: | - | - | - | User already invited to the Space |
64
+| Remove user from Room | :heavy_check_mark: | :heavy_check_mark: | - | - | - | |
65
+
66
+##### Room Management
67
+
68
+| **Functionality** | **Administrator** | **Manager** | **Troubleshooter** | **Observer** | **Billing** | Notes |
69
+| :-- | :--: | :--: | :--: | :--: | :--: | :-- |
70
+| See all Rooms in a Space | :heavy_check_mark: | :heavy_check_mark: | :heavy_check_mark: | - | - | |
71
+| Join any Room in a Space | :heavy_check_mark: | :heavy_check_mark: | :heavy_check_mark: | - | - | By joining a room you will be enabled to get notifications from nodes on that room |
72
+| Leave Room | :heavy_check_mark: | :heavy_check_mark: | :heavy_check_mark: | :heavy_check_mark: | - | |
73
+| Create a new Room in a Space | :heavy_check_mark: | :heavy_check_mark: | - | - | - | |
74
+| Delete Room | :heavy_check_mark: | :heavy_check_mark: | - | - | - | |
75
+| Change Room name | :heavy_check_mark: | :heavy_check_mark: | - | - | - | If not the _All Nodes_ room |
76
+| Change Room description | :heavy_check_mark: | :heavy_check_mark: | - | - | - | |
77
+| Add existing Nodes to Room | :heavy_check_mark: | :heavy_check_mark: | - | - | - | Node already connected to the Space |
78
+| Remove Nodes from Room | :heavy_check_mark: | :heavy_check_mark: | - | - | - | |
79
+
80
+##### Notifications Management
81
+
82
+| **Functionality** | **Administrator** | **Manager** | **Troubleshooter** | **Observer** | **Billing** | Notes |
83
+| :-- | :--: | :--: | :--: | :--: | :--: | :-- |
84
+| See all configured notifications on a Space | :heavy_check_mark: | - | - | - | - | |
85
+| Add new configuration | :heavy_check_mark: | - | - | - | - | |
86
+| Enable/Disable configuration | :heavy_check_mark: | - | - | - | - | |
87
+| Edit configuration | :heavy_check_mark: | - | - | - | - | Some exceptions apply depending on [service level](https://github.com/netdata/netdata/blob/master/docs/cloud/alerts-notifications/manage-notification-methods.md#available-actions-per-notification-methods-based-on-service-level) |
88
+| Delete configuration | :heavy_check_mark: | - | - | - | - | |
89
+| Edit personal level notification settings | :heavy_check_mark: | :heavy_check_mark: | :heavy_check_mark: | :heavy_check_mark: | :heavy_check_mark: | [Manage user notification settings](https://github.com/netdata/netdata/blob/master/docs/cloud/alerts-notifications/manage-notification-methods.md#manage-user-notification-settings) |
90
+
91
+Notes:
92
+* Enable, Edit and Add actions over specific notification methods will only be allowed if your plan has access to those ([service classification](https://github.com/netdata/netdata/blob/master/docs/cloud/alerts-notifications/notifications.mdx#service-classification))
93
+
94
+##### Dashboards
95
+
96
+| **Functionality** | **Administrator** | **Manager** | **Troubleshooter** | **Observer** | **Billing** |
97
+| :-- | :--: | :--: | :--: | :--: | :--: |
98
+| See all dashboards in Room | :heavy_check_mark: | :heavy_check_mark: | :heavy_check_mark: | :heavy_check_mark: | - |
99
+| Add new dashboard to Room | :heavy_check_mark: | :heavy_check_mark: | :heavy_check_mark: | :heavy_check_mark: | - |
100
+| Edit any dashboard in Room | :heavy_check_mark: | :heavy_check_mark: | :heavy_check_mark: | - | - |
101
+| Edit own dashboard in Room | :heavy_check_mark: | :heavy_check_mark: | :heavy_check_mark: | :heavy_check_mark: | - |
102
+| Delete any dashboard in Room | :heavy_check_mark: | :heavy_check_mark: | :heavy_check_mark: | - | - |
103
+| Delete own dashboard in Room | :heavy_check_mark: | :heavy_check_mark: | :heavy_check_mark: | :heavy_check_mark: | - |
104
+
105
+##### Functions
106
+
107
+| **Functionality** | **Administrator** | **Manager** | **Troubleshooter** | **Observer** | **Billing** | Notes |
108
+| :-- | :--: | :--: | :--: | :--: | :--: | :-- |
109
+| See all functions in Room | :heavy_check_mark: | :heavy_check_mark: | :heavy_check_mark: | :heavy_check_mark: | - |
110
+| Run any function in Room | :heavy_check_mark: | :heavy_check_mark: | - | - | - |
111
+| Run read-only function in Room | :heavy_check_mark: | :heavy_check_mark: | :heavy_check_mark: | :heavy_check_mark: | - | There isn't any function on this category yet, so subject to change. |
112
+| Run sensitive function in Room | :heavy_check_mark: | :heavy_check_mark: | - | - | - | There isn't any function on this category yet, so subject to change. |
113
+
114
+##### Events feed
115
+
116
+| **Functionality** | **Administrator** | **Manager** | **Troubleshooter** | **Observer** | **Billing** | Notes |
117
+| :-- | :--: | :--: | :--: | :--: | :--: | :-- |
118
+| See Alert or Topology events | :heavy_check_mark: | :heavy_check_mark: | :heavy_check_mark: | :heavy_check_mark: | - | |
119
+| See Auditing events | :heavy_check_mark: | :heavy_check_mark: | :heavy_check_mark: | :heavy_check_mark: | - | These are coming soon, not currently available |
120
+
121
+##### Billing
122
+
123
+| **Functionality** | **Administrator** | **Manager** | **Troubleshooter** | **Observer** | **Billing** | Notes |
124
+| :-- | :--: | :--: | :--: | :--: | :--: | :-- |
125
+| See Plan & Billing details | :heavy_check_mark: | - | - | - | :heavy_check_mark: | Current plan and usage figures |
126
+| Update plans | :heavy_check_mark: | - | - | - | - | This includes cancelling current plan (going to Community plan) |
127
+| See invoices | :heavy_check_mark: | - | - | - | :heavy_check_mark: | |
128
+| Manage payment methods | :heavy_check_mark: | - | - | - | :heavy_check_mark: | |
129
+| Update billing email | :heavy_check_mark: | - | - | - | :heavy_check_mark: | |
130
+
131
+##### Other permissions
132
+
133
+| **Functionality** | **Administrator** | **Manager** | **Troubleshooter** | **Observer** | **Billing** |
134
+| :-- | :--: | :--: | :--: | :--: | :--: |
135
+| See Bookmarks in Space | :heavy_check_mark: | :heavy_check_mark: | :heavy_check_mark: | :heavy_check_mark: | - |
136
+| Add Bookmark to Space | :heavy_check_mark: | :heavy_check_mark: | :heavy_check_mark: | - | - |
137
+| Delete Bookmark from Space | :heavy_check_mark: | :heavy_check_mark: | :heavy_check_mark: | - | - |
138
+| See Visited Nodes | :heavy_check_mark: | :heavy_check_mark: | :heavy_check_mark: | :heavy_check_mark: | - |
139
+| Update Visited Nodes | :heavy_check_mark: | :heavy_check_mark: | :heavy_check_mark: | :heavy_check_mark: | - |