Permissions¶
When managing user access via Fine-grained authorization, you add identities to groups and then grant entitlements against specific LXD API resources to these groups.
Each LXD API resource has a particular entity type, and each entity type has a set of entitlements that can be granted against API resources of that type.
Below is a description of each entity type, and a list of entitlements that can be granted against entities of that type.
Server¶
Entity type name:
server
The server entity type is the top-level entity type for the LXD system.
Entitlements that are granted at this level might cascade to projects and other resources:
adminGrants full access to LXD as if via Unix socket.
viewerGrants access to view all resources in the LXD server.
can_editGrants permission to edit server configuration, to edit cluster member configuration, to update the state of a cluster member, to create, edit, and delete cluster groups, to update cluster member certificates, and to edit or delete warnings.
permission_managerGrants permission to view permissions, to create, edit, and delete identities, to view, create, edit, and delete authorization groups, and to view, create, edit, and delete identity provider groups. Note that clients with this permission are able to elevate their own privileges.
can_view_permissionsGrants permission to view permissions.
can_create_identitiesGrants permission to create identities.
can_view_identitiesGrants permission to view identities.
can_edit_identitiesGrants permission to edit identities.
can_delete_identitiesGrants permission to delete identities.
can_create_groupsGrants permission to create authorization groups.
can_view_groupsGrants permission to view authorization groups.
can_edit_groupsGrants permission to edit authorization groups.
can_delete_groupsGrants permission to delete authorization groups.
can_create_identity_provider_groupsGrants permission to create identity provider groups.
can_view_identity_provider_groupsGrants permission to view identity provider groups.
can_edit_identity_provider_groupsGrants permission to edit identity provider groups.
can_delete_identity_provider_groupsGrants permission to delete identity provider groups.
storage_pool_managerGrants permission to create, edit, and delete storage pools.
can_create_storage_poolsGrants permission to create storage pools.
can_edit_storage_poolsGrants permission to edit storage pools.
can_delete_storage_poolsGrants permission to delete storage pools.
project_managerGrants permission to view, create, edit, and delete projects, and to create, edit, and delete any resources that are owned by those projects.
can_create_projectsGrants permission to create projects.
can_view_projectsGrants permission to view projects, and all resources within those projects.
can_edit_projectsGrants permission to edit projects, and all resources within those projects.
can_delete_projectsGrants permission to delete projects.
can_override_cluster_target_restrictionIf a project is configured with
restricted.cluster.target, clients with this permission can override the restriction.can_view_privileged_eventsGrants permission to view privileged event types, such as logging events.
can_view_resourcesGrants permission to view server and storage pool resource usage information.
can_view_metricsGrants permission to view all server and project level metrics.
can_view_warningsGrants permission to view warnings.
can_view_unmanaged_networksGrants permission to view unmanaged networks on the LXD host machines.
Project¶
Entity type name:
project
Entitlements that are granted at the project level might cascade to project specific resources (such as instances):
operatorGrants permission to create, view, edit, and delete all resources belonging to the project, but does not grant permission to edit the project configuration itself.
viewerGrants permission to view all resources belonging to the project.
can_viewGrants permission to view the project.
can_editGrants permission to edit the project.
can_deleteGrants permission to delete the project.
image_managerGrants permission to create, view, edit, and delete all images belonging to the project.
can_create_imagesGrants permission to create images.
can_view_imagesGrants permission to view images.
can_edit_imagesGrants permission to edit images.
can_delete_imagesGrants permission to delete images.
image_alias_managerGrants permission to create, view, edit, and delete all image aliases belonging to the project.
can_create_image_aliasesGrants permission to create image aliases.
can_view_image_aliasesGrants permission to view image aliases.
can_edit_image_aliasesGrants permission to edit image aliases.
can_delete_image_aliasesGrants permission to delete image aliases.
instance_managerGrants permission to create, view, edit, and delete all instances belonging to the project.
can_create_instancesGrants permission to create instances.
can_view_instancesGrants permission to view instances.
can_edit_instancesGrants permission to edit instances.
can_delete_instancesGrants permission to delete instances.
can_operate_instancesGrants permission to view instances, manage their state, manage their snapshots and backups, start terminal or console sessions, and access their files.
network_managerGrants permission to create, view, edit, and delete all networks belonging to the project.
can_create_networksGrants permission to create networks.
can_view_networksGrants permission to view networks.
can_edit_networksGrants permission to edit networks.
can_delete_networksGrants permission to delete networks.
network_acl_managerGrants permission to create, view, edit, and delete all network ACLs belonging to the project.
can_create_network_aclsGrants permission to create network ACLs.
can_view_network_aclsGrants permission to view network ACLs.
can_edit_network_aclsGrants permission to edit network ACLs.
can_delete_network_aclsGrants permission to delete network ACLs.
network_zone_managerGrants permission to create, view, edit, and delete all network zones belonging to the project.
can_create_network_zonesGrants permission to create network zones.
can_view_network_zonesGrants permission to view network zones.
can_edit_network_zonesGrants permission to edit network zones.
can_delete_network_zonesGrants permission to delete network zones.
profile_managerGrants permission to create, view, edit, and delete all profiles belonging to the project.
can_create_profilesGrants permission to create profiles.
can_view_profilesGrants permission to view profiles.
can_edit_profilesGrants permission to edit profiles.
can_delete_profilesGrants permission to delete profiles.
storage_volume_managerGrants permission to create, view, edit, and delete all storage volumes belonging to the project.
can_create_storage_volumesGrants permission to create storage volumes.
can_view_storage_volumesGrants permission to view storage volumes.
can_edit_storage_volumesGrants permission to edit storage volumes.
can_delete_storage_volumesGrants permission to delete storage volumes.
storage_bucket_managerGrants permission to create, view, edit, and delete all storage buckets belonging to the project.
can_create_storage_bucketsGrants permission to create storage buckets.
can_view_storage_bucketsGrants permission to view storage buckets.
can_edit_storage_bucketsGrants permission to edit storage buckets.
can_delete_storage_bucketsGrants permission to delete storage buckets.
can_view_operationsGrants permission to view operations relating to the project.
can_view_eventsGrants permission to view events relating to the project.
can_view_metricsGrants permission to view project level metrics.
Storage pool¶
Entity type name:
storage_pool
can_editGrants permission to edit the storage pool.
can_deleteGrants permission to delete the storage pool.
Identity¶
Entity type name:
identity
can_viewGrants permission to view the identity.
can_editGrants permission to edit the identity.
can_deleteGrants permission to delete the identity.
Group¶
Entity type name:
group
can_viewGrants permission to view the group. Identities can always view groups that they are a member of.
can_editGrants permission to edit the group.
can_deleteGrants permission to delete the group.
Identity provider group¶
Entity type name:
identity_provider_group
can_viewGrants permission to view the identity provider group.
can_editGrants permission to edit the identity provider group.
can_deleteGrants permission to delete the identity provider group.
Certificate¶
Entity type name:
certificate
can_viewGrants permission to view the certificate.
can_editGrants permission to edit the certificate.
can_deleteGrants permission to delete the certificate.
Instance¶
Entity type name:
instance
userGrants permission to view the instance, to access files, and to start a terminal or console session.
operatorGrants permission to view the instance, to access files, start a terminal or console session, and to manage snapshots and backups.
can_editGrants permission to edit the instance.
can_deleteGrants permission to delete the instance.
can_viewGrants permission to view the instance and any snapshots or backups it might have.
can_update_stateGrants permission to change the instance state.
can_manage_snapshotsGrants permission to create and delete snapshots of the instance.
can_manage_backupsGrants permission to create and delete backups of the instance.
can_connect_sftpGrants permission to get an SFTP client for the instance.
can_access_filesGrants permission to push or pull files into or out of the instance.
can_access_consoleGrants permission to start a console session.
can_execGrants permission to start a terminal session.
Image¶
Entity type name:
image
can_editGrants permission to edit the image.
can_deleteGrants permission to delete the image.
can_viewGrants permission to view the image.
Image alias¶
Entity type name:
image_alias
can_editGrants permission to edit the image alias.
can_deleteGrants permission to delete the image alias.
can_viewGrants permission to view the image alias.
Network¶
Entity type name:
network
can_editGrants permission to edit the network.
can_deleteGrants permission to delete the network.
can_viewGrants permission to view the network.
Network ACL¶
Entity type name:
network_acl
can_editGrants permission to edit the network ACL.
can_deleteGrants permission to delete the network ACL.
can_viewGrants permission to view the network ACL.
Network zone¶
Entity type name:
network_zone
can_editGrants permission to edit the network zone.
can_deleteGrants permission to delete the network zone.
can_viewGrants permission to view the network zone.
Profile¶
Entity type name:
profile
can_editGrants permission to edit the profile.
can_deleteGrants permission to delete the profile.
can_viewGrants permission to view the profile.
Storage volume¶
Entity type name:
storage_volume
can_editGrants permission to edit the storage volume.
can_deleteGrants permission to delete the storage volume.
can_viewGrants permission to view the storage volume and any snapshots or backups it might have.
can_manage_snapshotsGrants permission to create and delete snapshots of the storage volume.
can_manage_backupsGrants permission to create and delete backups of the storage volume.
Storage bucket¶
Entity type name:
storage_bucket
can_editGrants permission to edit the storage bucket.
can_deleteGrants permission to delete the storage bucket.
can_viewGrants permission to view the storage bucket.