RBAC

GitOps uses role-based access control to decide which users can perform actions at cluster, organization, and project scope.

Permission scopes

• Cluster: installation-wide settings, cluster users, and cluster administration.
• Organization: organization settings, members, and organization-level resources.
• Project: project configuration and project resources such as Vault, Code Report, and State IaC.

Roles

Roles group permissions into reusable access profiles. Bootstrap creates the cluster administrator and creates the default organization roles when the first organization is created.

Assign the least powerful role that supports a user’s work. Review role assignments when responsibilities change.

Roles and permissions preview

The access-control screen presents roles with their scope and permissions. The following preview shows the shape of that view:

The exact permission list depends on the role scope. Project roles cannot grant cluster permissions, and organization roles remain limited to their organization.

Access checks

Every protected action is checked against the user’s session, role, permission, and scope. A user may be authenticated and still be denied when their role does not include the requested permission or resource scope.