Skip to content
Documentation

Built-in roles and permissions

MetalSoft provides several built-in roles that cannot be edited:

  • Root - Highest level.
  • Full Admin - Similar to Root but cannot put the system into maintenance
  • Basic Admin - Primarily read only across all admin resources
  • User - Access only to infrastructures and the user interface

Custom roles can also be created. In general, the permissions follow the Admin UI providing with read and write to the respective resources. For example the workflow_read will allow a read-only view of the Workflows section. Having workflow_write will allow you to edit the workflows.

Built-in permissions

Section titled “Built-in permissions”

The following are built-in permissions. Custom ones can also be created and assigned to roles.

Section titled “Users related permissions”
  • users_read - Allows the read details about a user such as name
  • users_write - Allows the change details about a user such as name
  • users_and_permissions_read - Allows the read of user’s role, limits and credentials access
  • users_and_permissions_write - Allows the change of a user’s role, limits and credentials access
  • users_2fa_disable - Allows the disabling of a user’s 2FA setting
  • skip_user_limits - Permission to be set on role when user utilization limits should not be checked by the system.
  • skip_authenticator - Permission to be set on role if 2FA authentication is optional.
  • metalcloud_access - Default permission for user role

Network profiles

Section titled “Network profiles”
  • network_profiles_read - Allows a read operation on public network profile objects.
  • network_profiles_write - Allows a write operation on public network profile objects.
  • network_profiles_allowed_for_user_read - Allows a write operation on specific user’s network profile objects.
  • network_profiles_allowed_for_user_write - Allows a write operation on specific user’s network profile objects.
  • network_profiles_allow_specific_vlan_ids - Allow a specific VLAN rather than automatically allocated ones. This has security implications as it allows the use of VLANs that might be in use by other users.

Network Fabrics

Section titled “Network Fabrics”

Network Fabrics

Section titled “Network Fabrics”
  • network_fabrics_read - Allows reading details of network fabric objects.
  • network_fabrics_write - Allows creation, editing, and deletion of network fabric objects.
Section titled “Licenses related permissions”
  • Licenses read - Allows the read of licensing details
  • Licenses write - Allows the change of licensing details such as adding a new license key.
Section titled “Firmware related permissions”
  • firmware_upgrade_read - Allows the user to read firmware-related objects such as baselines.
  • firmware_upgrade_read - Allows the user to create and edit firmware-related objects such as baselines.
  • firmware_baselines_read - (not used)
  • firmware_baselines_write - (not used)
Section titled “Site related permissions”
  • site_read - Site Read
  • site_write - Site Write

Servers

Section titled “Servers”
  • servers_read - Allows read of server object details.
  • servers_write - Allows change and edit of server object details such as tags.
  • server_types_read - Allows read of server type object details such as tags.
  • server_type_utilization_report_read - Allows read of server type utilization report.

Switches

Section titled “Switches”
  • switches_read - Allows read of switch object.
  • switches_write - Allows creation, edit and delete of switch object.

Storage

Section titled “Storage”
  • storage_read - Allows read of storage objects.
  • storage_write - Allows creation,edit and delete of storage objects.

IPAM Subnets

Section titled “IPAM Subnets”
  • subnets_read - Allows read of subnet objects.
  • subnets_write - Allows creation, edit and delete of subnet objects.

Infrastructures

Section titled “Infrastructures”
  • infrastructures_read - Allows the read of infrastructures details of other users
  • infrastructures_write - Allows the user to delete or change other user’s infrastructures.

OS Templates

Section titled “OS Templates”
  • templates_read - Allows the creation of templates
  • templates_write - Allows the user to create, edit and delete templates

Events & jobs

Section titled “Events & jobs”
  • events_read - Allows the listing of events
  • events_write - (Not used)
  • job_queue_read - Allows the listing of jobs
  • job_queue_write - Allows operations on jobs such as resume.

Variables

Section titled “Variables”
  • variables_and_secrets_read - Allows listing of variables and secrets and view of only the variables object but not that of secrets.
  • variables_and_secrets_write - Allows the creation, edit and delete of variables.

Subscriptions

Section titled “Subscriptions”
  • subscriptions_read - Allows listing of reservations of all users.
  • subscriptions_write - Allows creation, edit and delete of reservations for other users.

Reports

Section titled “Reports”
  • utilization_reports_read - Allows read of other user’s utilization reports

Utility

Section titled “Utility”
  • admin_access - Allows access to the admin interface
  • suspend_reasons_read - Allows user to see suspend reasons
  • suspend_reasons_write - Allows user to suspend other users and add reasons
  • global_configurations_write - Global Configurations Write
  • global_configurations_read - Global Configurations Read
  • maintenance_read - Allows the user to view the user interface maintenance flag (deprecated)
  • maintenance_write - Allows the user to change the user interface maintenance flag (deprecated)
  • admin_maintenance_read - Allows the user to view the admin interface maintenance flag (deprecated)
  • admin_maintenance_write - Allows the user to view the admin interface maintenance flag (deprecated)

Virtual Machines (VMs)

Section titled “Virtual Machines (VMs)”
  • vm_pools_read - Allows reading details of VM pools.
  • vm_pools_write - Allows creation, editing, and deletion of VM pools.
  • vm_types_read - Allows reading details of VM types.
  • vm_types_write - Allows creation, editing, and deletion of VM types.
  • vm_profiles_read - Allows reading details of VM profiles.
  • vm_profiles_write - Allows creation, editing, and deletion of VM profiles.
  • vms_read - Allows reading details of virtual machines.
  • vms_write - Allows creation, editing, and deletion of virtual machines.

S3 buckets (object storage)

Section titled “S3 buckets (object storage)”
  • buckets_read - Allows reading details of bucket objects

Extensions

Section titled “Extensions”
  • extensions_read - Allows reading details of extension objects.
  • extensions_write - Allows creation, editing, and deletion of extension objects.