Role-Based Access Control (RBAC)

Version 1.0 of Lagoon changed how you access your projects! Access to your project is handled via groups, with projects assigned to one or multiple groups. Users are added to groups with a role. Groups can also be nested within sub-groups. This change provides a lot more flexibility and the possibility to recreate real world teams within Lagoon.

Roles

When assigning a user to a group, you need to provide a group role for that user inside this group. Each one of the 5 current existing group roles gives the user different permissions to the group and projects assigned to the group. Here are the platform-wide roles and the group roles that are currently found in Lagoon:

Platform-Wide Roles

Platform-Wide Admin

The platform-wide admin has access to everything across all of Lagoon. That includes dangerous mutations like deleting all projects. Use very, very, very carefully.

Platform-Wide Owner

The platform-wide owner has access to every Lagoon group, like the group owner role, and can be used if you need a user that needs access to everything but you don't want to assign the user to every group.

Group Roles

Owner

The owner role can do everything within a group and its associated projects. They can add and manage users of a group. Be careful with this role, as it can delete projects and production environments!

Maintainer

The maintainer role can do everything within a group and its associated projects except deleting the project itself or the production environment. They can add and manage users of a group.

Developer

The developer role has SSH access only to development environments. This role cannot access, update or delete the production environment. They can run a sync task with the production environment as a source, but not as the destination. Cannot manage users of a group.

Danger:

IMPORTANT: This role does not prevent the deployment of the production environment as a deployment is triggered via a Git push! You need to make sure that your Git server prevents these users from pushing into the branch defined as production environment.

Reporter

The reporter role has view access only. They cannot access any environments via SSH or make modifications to them. They can run cache-clear tasks. This role is mostly used for stakeholders to have access to Lagoon UI and logging.

Guest

The guest role has the same privileges as the reporter role listed above.

Here is a table that lists the roles and the access they have:

💡 Tip: Scroll to the right to see the whole table!

Lagoon 1.0.0 RBAC Permission Matrix

Name	Resource	Scope	Attributes	Platform-Wide Admin	Platform-Wide Owner	Owner	Maintainer	Developer	Reporter	Guest	Self
addBackup	backup	add	projectID	Yes	Yes	Yes	Yes	Yes	No	No
deleteBackup	backup	delete	projectID	Yes	Yes	Yes	Yes	No	No	No
deleteAllBackups	backup	deleteAll		Yes	No	No	No	No	No	No
getBackupsByEnvironmentId	backup	view	projectID	Yes	Yes	Yes	Yes	Yes	No	No
	deployment	view	projectID	Yes	Yes	Yes	Yes	Yes	Yes	Yes
addEnvVariable (to Project)	env_var	project:add	projectID	Yes	Yes	Yes	Yes	No	No	No
addEnvVariable (to Environment)	env_var	environment:add:development	projectID	Yes	Yes	Yes	Yes	Yes	No	No
addEnvVariable (to Environment)	env_var	environment:add:production	projectID	Yes	Yes	Yes	Yes	No	No	No
deleteEnvVariable	env_var	delete	projectID	Yes	Yes	Yes	Yes	No	No	No
deleteEnvVariable (from Project)	env_var	project:delete	projectID	Yes	Yes	Yes	Yes	No	No	No
deleteEnvVariable (from Environment)	env_var	environment:delete:development	projectID	Yes	Yes	Yes	Yes	Yes	No	No
deleteEnvVariable (from Environment)	env_var	environment:delete:production	projectID	Yes	Yes	Yes	Yes	No	No	No
getEnvVarsByProjectId	env_var	project:view	projectID	Yes	Yes	Yes	Yes	No	No	No
getEnvVarsByEnvironmentId	env_var	environment:view:development	projectID	Yes	Yes	Yes	Yes	Yes	No	No
getEnvVarsByEnvironmentId	env_var	environment:view:production	projectID	Yes	Yes	Yes	Yes	No	No	No
addOrUpdateEnvironment	environment	addOrUpdate:development	projectID	Yes	Yes	Yes	Yes	Yes	No	No
addOrUpdateEnvironment	environment	addOrUpdate:production	projectID	Yes	Yes	Yes	Yes	No	No	No
updateEnvironment	environment	update:development	projectID	Yes	Yes	Yes	Yes	Yes	No	No
updateEnvironment	environment	update:production	projectID	Yes	Yes	Yes	Yes	No	No	No
deleteEnvironment	environment	delete:development	projectID	Yes	Yes	Yes	Yes	Yes	No	No
deleteEnvironment	environment	delete:production	projectID	Yes	Yes	Yes	No	No	No	No
deleteAllEnvironments	environment	deleteAll		Yes	No	No	No	No	No	No
addOrUpdateEnvironmentStorage	environment	storage		Yes	Yes	No	No	No	No	No
addDeployment	environment	deploy:development	projectID	Yes	Yes	Yes	Yes	Yes	No	No
addDeployment	environment	deploy:production	projectID	Yes	Yes	Yes	Yes	No	No	No
deleteDeployment	deployment	delete	projectID	Yes	Yes	Yes	Yes	No	No	No
updateDeployment	deployment	update	projectID	Yes	Yes	Yes	Yes	No	No	No
setEnvironmentServices	environment	update:development	projectID	Yes	Yes	Yes	Yes	Yes	No	No
setEnvironmentServices	environment	update:production	projectID	Yes	Yes	Yes	Yes	No	No	No
deployEnvironmentLatest	environment	deploy:development	projectID	Yes	Yes	Yes	Yes	Yes	No	No
deployEnvironmentLatest	environment	deploy:production	projectID	Yes	Yes	Yes	Yes	No	No	No
deployEnvironmentBranch	environment	deploy:development	projectID	Yes	Yes	Yes	Yes	Yes	No	No
deployEnvironmentBranch	environment	deploy:production	projectID	Yes	Yes	Yes	Yes	No	No	No
deployEnvironmentPullrequest	environment	deploy:development	projectID	Yes	Yes	Yes	Yes	Yes	No	No
deployEnvironmentPullrequest	environment	deploy:production	projectID	Yes	Yes	Yes	Yes	No	No	No
deployEnvironmentPromote	environment	deploy:development	projectID	Yes	Yes	Yes	Yes	Yes	No	No
deployEnvironmentPromote	environment	deploy:production	projectID	Yes	Yes	Yes	Yes	No	No	No
getEnvironmentsByProjectId	environment	view	projectID	Yes	Yes	Yes	Yes	Yes	Yes	Yes
getEnvironmentStorageMonthByEnvironmentId	environment	storage		Yes	No	No	No	No	No	No
getEnvironmentHoursMonthByEnvironmentId	environment	storage		Yes	No	No	No	No	No	No
getEnvironmentHitsMonthByEnvironmentId	environment	storage		Yes	No	No	No	No	No	No
getEnvironmentServicesByEnvironmentId	environment	view	projectID	Yes	Yes	Yes	Yes	Yes	Yes	Yes
addGroup	group	add		Yes	Yes	Yes	Yes	Yes	Yes	Yes
updateGroup	group	update	groupID	Yes	Yes	Yes	Yes	No	No	No
deleteGroup	group	delete	groupID	Yes	Yes	Yes	Yes	No	No	No
deleteAllGroups	group	deleteAll		Yes	No	No	No	No	No	No
addUserToGroup	group	addUser	groupID	Yes	Yes	Yes	Yes	No	No	No
removeUserFromGroup	group	removeUser	groupID	Yes	Yes	Yes	Yes	No	No	No
addNotificationSlack	notification	add		Yes	Yes	No	No	No	No	No
updateNotificationSlack	notification	update		Yes	Yes	No	No	No	No	No
deleteNotificationSlack	notification	delete		Yes	Yes	No	No	No	No	No
deleteAllNotificationSlacks	notification	deleteAll		Yes	No	No	No	No	No	No
addNotificationRocketChat	notification	add		Yes	Yes	No	No	No	No	No
updateNotificationRocketChat	notification	update		Yes	Yes	No	No	No	No	No
deleteNotificationRocketChat	notification	delete		Yes	Yes	No	No	No	No	No
deleteAllNotificationRocketChats	notification	deleteAll		Yes	No	No	No	No	No	No
removeAllNotificationsFromAllProjects	notification	removeAll		Yes	No	No	No	No	No	No
getNotificationsByProjectId	notification	view	projectID	Yes	Yes	Yes	Yes	Yes	No	No
addKubernetes	kubernetes	add		Yes	Yes	No	No	No	No	No
updateKubernetes	kubernetes	update		Yes	Yes	No	No	No	No	No
deleteKubernetes	kubernetes	delete		Yes	Yes	No	No	No	No	No
deleteAllKubernetes	kubernetes	deleteAll		Yes	Yes	No	No	No	No	No
getAllOpenshifts	openshift	viewAll		Yes	No	No	No	No	No	No
getOpenshiftByProjectId	openshift	view	projectID	Yes	Yes	Yes	Yes	Yes	Yes	Yes
addNotificationToProject	project	addNotification	projectID	Yes	Yes	Yes	Yes	No	No	No
removeNotificationFromProject	project	removeNotification	projectID	Yes	Yes	Yes	Yes	No	No	No
addProject	project	add		Yes	Yes	Yes	Yes	Yes	Yes	Yes
updateProject	project	update	projectID	Yes	Yes	Yes	Yes	No	No	No
deleteProject	project	delete	projectID	Yes	Yes	Yes	No	No	No	No
deleteAllProjects	project	deleteAll		Yes	No	No	No	No	No	No
addGroupsToProject	project	addGroup	projectID	Yes	Yes	Yes	Yes	No	No	No
removeGroupsFromProject	project	removeGroup	projectID	Yes	Yes	Yes	Yes	No	No	No
getAllProjects	project	viewAll		Yes	Yes	No	No	No	No	No
getProjectByEnvironmentId	project	view	projectID	Yes	Yes	Yes	Yes	Yes	Yes	Yes
getProjectByGitUrl	project	view	projectID	Yes	Yes	Yes	Yes	Yes	Yes	Yes
getProjectByName	project	view	projectID	Yes	Yes	Yes	Yes	Yes	Yes	Yes
addRestore	restore	add	projectID	Yes	Yes	Yes	Yes	Yes	Yes	Yes
updateRestore	restore	update	projectID	Yes	Yes	Yes	Yes	Yes	Yes	Yes
addSshKey	ssh_key	add	userId	Yes	Yes	No	No	No	No	No	Yes
updateSshKey	ssh_key	update	userId	Yes	Yes	No	No	No	No	No	Yes
deleteSshKey	ssh_key	delete	userId	Yes	Yes	No	No	No	No	No	Yes
deleteAllSshKeys	ssh_key	deleteAll		Yes	No	No	No	No	No	No	No
removeAllSshKeysFromAllUsers	ssh_key	removeAll		Yes	No	No	No	No	No	No	No
getUserSshKeys	ssh_key	view:user	userID	Yes	Yes	No	No	No	No	No	Yes
addTask	task	add:development	projectID	Yes	Yes	Yes	Yes	Yes	No	No
addTask	task	add:production	projectID	Yes	Yes	Yes	Yes	No	No	No
taskDrushArchiveDump	task	drushArchiveDump:development	projectID	Yes	Yes	Yes	Yes	Yes	No	No
taskDrushArchiveDump	task	drushArchiveDump:production	projectID	Yes	Yes	Yes	Yes	Yes	No	No
taskDrushSqlDump	task	drushSqlDump:development	projectID	Yes	Yes	Yes	Yes	Yes	No	No
taskDrushSqlDump	task	drushSqlDump:production	projectID	Yes	Yes	Yes	Yes	Yes	No	No
taskDrushCacheClear	task	drushCacheClear:development	projectID	Yes	Yes	Yes	Yes	Yes	Yes	Yes
taskDrushCacheClear	task	drushCacheClear:production	projectID	Yes	Yes	Yes	Yes	Yes	Yes	Yes
taskDrushCron	task	drushCron:development	projectID	Yes	Yes	Yes	Yes	Yes	Yes	Yes
taskDrushCron	task	drushCron:production	projectID	Yes	Yes	Yes	Yes	Yes	Yes	Yes
taskDrushUserLogin	task	drushUserLogin:destination:production	EnvironmentID	Yes	Yes	Yes	Yes	No	No	No
taskDrushUserLogin	task	drushUserLogin:destination:development	EnvironmentID	Yes	Yes	Yes	Yes	Yes	No	No
taskDrushSqlSync	task	drushSqlSync:source:development	ProjectID	Yes	Yes	Yes	Yes	Yes	No	No
taskDrushSqlSync	task	drushSqlSync:source:production	ProjectID	Yes	Yes	Yes	Yes	Yes	No	No
taskDrushSqlSync	task	drushSqlSync:destination:production	ProjectID	Yes	Yes	Yes	Yes	No	No	No
taskDrushSqlSync	task	drushSqlSync:destination:development	ProjectID	Yes	Yes	Yes	Yes	Yes	No	No
taskDrushRsyncFiles	task	drushRsync:source:development	ProjectID	Yes	Yes	Yes	Yes	Yes	No	No
taskDrushRsyncFiles	task	drushRsync:source:production	ProjectID	Yes	Yes	Yes	Yes	Yes	No	No
taskDrushRsyncFiles	task	drushRsync:destination:production	ProjectID	Yes	Yes	Yes	Yes	No	No	No
taskDrushRsyncFiles	task	drushRsync:destination:development	ProjectID	Yes	Yes	Yes	Yes	Yes	No	No
deleteTask	task	delete	ProjectID	Yes	Yes	Yes	Yes	Yes	No	No
updateTask	task	update	ProjectID	Yes	Yes	Yes	Yes	Yes	No	No
uploadFilesForTask	task	update	projectID	Yes	Yes	Yes	Yes	Yes	No	No
deleteFilesForTask	task	delete	projectID	Yes	Yes	Yes	Yes	Yes	No	No
getFilesByTaskId	task	view	projectID	Yes	Yes	Yes	Yes	Yes	Yes	Yes
getTasksByEnvironmentId	task	view	projectID	Yes	Yes	Yes	Yes	Yes	Yes	Yes
getTaskByRemoteId	task	view	projectID	Yes	Yes	Yes	Yes	Yes	Yes	Yes
getTaskById	task	view	projectID	Yes	Yes	Yes	Yes	Yes	Yes	Yes
addUser	user	add		Yes	Yes	Yes	Yes	Yes	Yes	Yes
updateUser	user	update	userId	Yes	Yes	No	No	No	No	No	Yes
deleteUser	user	delete	userId	Yes	Yes	No	No	No	No	No	Yes
deleteAllUsers	user	deleteAll		Yes	No	No	No	No	No	No
getProjectByEnvironmentId	project	viewPrivateKey	projectID	Yes	Yes	Yes	No	No	No	No
getProjectByGitUrl	project	viewPrivateKey	projectID	Yes	Yes	Yes	No	No	No	No
getProjectByName	project	viewPrivateKey	projectID	Yes	Yes	Yes	No	No	No	No