Built-in roles and permissions

MetalSoft provides several built-in roles that cannot be edited:

Root - Highest level
Full Admin - Similar to Root but cannot put the system into maintenance
Basic Admin - Primarily read-only across all admin resources
User - Access only to infrastructures and the user interface

Admins can also create custom roles. In general, permissions mirror the Admin UI, providing read and write access to the respective resources. For example, the workflow_read permission allows a read-only view of the Workflows section. The workflow_write permission allows you to edit the workflows.

Built-in permissions

The following are built-in permissions. Admins can also create custom ones and assign them to roles.

users_read - Allows reading details about a user, such as name
users_write - Allows changing details about a user, such as name
users_and_permissions_read - Allows the read of user’s role, limits, and credentials access
users_and_permissions_write - Allows the change of a user’s role, limits, and credentials access
users_2fa_disable - Allows disabling a user’s 2FA setting
skip_user_limits - Permission set on a role to prevent the system from checking user utilization limits
skip_authenticator - Permission set on a role to make 2FA authentication optional
metalcloud_access - Default permission for user role

Network profiles

network_profiles_read - Allows a read operation on public network profile objects.
network_profiles_write - Allows a write operation on public network profile objects.
network_profiles_allowed_for_user_read - Allows a write operation on specific user’s network profile objects.
network_profiles_allowed_for_user_write - Allows a write operation on specific user’s network profile objects.
network_profiles_allow_specific_vlan_ids - Allows a specific VLAN rather than automatically allocated ones. This has security implications, as it allows the use of VLANs that might be in use by other users.

Network Fabrics

network_fabrics_read - Allows reading details of network fabric objects.
network_fabrics_write - Allows creation, editing, and deletion of network fabric objects.

Licenses read - Allows reading licensing details
Licenses write - Allows changing licensing details, such as adding a new license key.

firmware_upgrade_read - Allows the user to read firmware-related objects such as baselines.
firmware_upgrade_read - Allows the user to create and edit firmware-related objects such as baselines.
firmware_baselines_read - (not used)
firmware_baselines_write - (not used)

site_read - Site Read
site_write - Site Write

Servers

servers_read - Allows read of server object details.
servers_write - Allows change and edit of server object details such as tags.
server_types_read - Allows read of server type object details such as tags.
server_type_utilization_report_read - Allows read of server type utilization report.

Switches

switches_read - Allows read of switch object.
switches_write - Allows creation, editing, and deletion of switch object.

Storage

storage_read - Allows read of storage objects.
storage_write - Allows creation, editing, and deletion of storage objects.

IPAM Subnets

subnets_read - Allows read of subnet objects.
subnets_write - Allows creation, editing, and deletion of subnet objects.

Infrastructures

infrastructures_read - Allows the read of infrastructures details of other users
infrastructures_write - Allows the user to delete or change other user’s infrastructures.

OS Templates

templates_read - Allows the creation of templates
templates_write - Allows the user to create, edit, and delete templates

Events & jobs

events_read - Allows the listing of events
events_write - (Not used)
job_queue_read - Allows the listing of jobs
job_queue_write - Allows operations on jobs such as resume.

Variables

variables_and_secrets_read - Allows listing of variables and secrets and view of only the variables object but not that of secrets.
variables_and_secrets_write - Allows the creation, editing, and deletion of variables.

Subscriptions

subscriptions_read - Allows listing of reservations of all users.
subscriptions_write - Allows creation, editing, and deletion of reservations for other users.

Reports

utilization_reports_read - Allows read of other user’s utilization reports

Utility

admin_access - Allows access to the admin interface
suspend_reasons_read - Allows user to see suspend reasons
suspend_reasons_write - Allows user to suspend other users and add reasons
global_configurations_write - Global Configurations Write
global_configurations_read - Global Configurations Read
maintenance_read - Allows the user to view the user interface maintenance flag (deprecated)
maintenance_write - Allows the user to change the user interface maintenance flag (deprecated)
admin_maintenance_read - Allows the user to view the admin interface maintenance flag (deprecated)
admin_maintenance_write - Allows the user to view the admin interface maintenance flag (deprecated)

Virtual Machines (VMs)

vm_pools_read - Allows reading details of VM pools.
vm_pools_write - Allows creation, editing, and deletion of VM pools.
vm_types_read - Allows reading details of VM types.
vm_types_write - Allows creation, editing, and deletion of VM types.
vm_profiles_read - Allows reading details of VM profiles.
vm_profiles_write - Allows creation, editing, and deletion of VM profiles.
vms_read - Allows reading details of virtual machines.
vms_write - Allows creation, editing, and deletion of virtual machines.

S3 buckets (object storage)

buckets_read - Allows reading details of bucket objects

Extensions

extensions_read - Allows reading details of extension objects.
extensions_write - Allows creation, editing, and deletion of extension objects.