Access control on the Neu.ro platform is based on roles. Each role contains a set of permissions for various entities and actions. In this way, users with different roles will have different levels of access on the platform. By default, every cluster has three roles: User, Manager, and Admin (you can learn more about them here). Users can also create their own custom roles and grant them to other users.
Creating new roles
To create a new role, use the neuro acl add-role {username}/roles/{rolename} command. For example:
1
> neuro acl add-role alice/roles/newrole
Copied!
The created role will be called newrole and have an empty permission set. You can then add resources to this set using the neuro acl grant {URI} {username}/roles/{rolename} command. For example:
1
> neuro acl grant job:job363 alice/roles/newrole
Copied!
This will add a permission for the job363 job to the newrole role.
Using roles
Granting roles
You can grant roles to users by running the neuro acl grant role://{username}/roles/{rolename} {username2} command:
1
> neuro acl grant role://alice/roles/newrole bob
Copied!
This will grant the newrole role to Bob. This means that Bob will have access to all entities listed under this role.
Revoking roles
Roles can be revoked from users with the help of the neuro acl revoke command. For example:
1
> neuro acl revoke role://alice/roles/newrole bob
Copied!
Deleting roles
Obsolete roles can be deleted using the neuro acl remove-role command. For example:
1
> neuro acl remove-role alice/roles/newrole
Copied!
Feel free to refer to this Neu.ro CLI Reference page to learn more about using the neuro acl command.