Skip to main content

Roles in SPIRL

SPIRL uses roles to manage permissions. The following access roles are installed by default:

  1. Auditor
  2. Operator
  3. Administrator
  4. Owner

Roles are hierarchial. In general, each subsequent role has the permissions of the previous role plus some additional permissions. For example, Operator has Auditor permissions and the ability to create and modify clusters.

Organization Roles vs. Realm Roles: Organization roles grant permissions across all trust domains and realms. Realm-specific roles (like Realm Admin) grant permissions only within assigned realms. See Realms for more information.

Realm Admin Role​

The Realm Admin role is a realm-scoped role that grants delegated administrative control over clusters within a specific realm. This role enables teams to manage their own infrastructure without requiring organization-wide Operator or Administrator permissions.

Realm Admin Capabilities:

  • Create, read, update, and delete clusters within the assigned realm
  • View workloads and configurations for clusters in the assigned realm
  • Register new cluster versions within the assigned realm

Realm Admin Limitations:

  • Cannot access clusters in other realms
  • Cannot create or delete realms
  • Cannot modify realm role assignments
  • Cannot elevate their own privileges

Role Permissions​

The following table illustrates permissions allowed by each role:

AuditorOperatorManagerAdministratorOwnerRealm Administrator 1
Invite user

Yes

Change user role

Yes

Delete user

Yes

Create trust domain

Yes

Yes

Delete trust domain

Yes

Yes

List trust domains

Yes

Yes

Yes

Yes

Yes

Yes

Create realm

Yes

Yes

Delete realm

Yes

Yes

List realms

Yes

Yes

Yes

Yes

Yes

Yes

Assign realm roles

Yes

Yes

Add cluster

Yes

Yes

Yes

Yes

Yes

2
Disable cluster

Yes

Yes

Yes

Yes

Yes

2
Delete cluster

Yes

Yes

Yes

Yes

Yes

2
List clusters

Yes

Yes

Yes

Yes

Yes

Yes

Create trust domain deployment

Yes

Yes

Yes

Delete trust domain deployment

Yes

Yes

Yes

List trust domain deployments

Yes

Yes

Yes

Yes

Yes

Yes

Create service account

Yes

Yes

List service accounts

Yes

Yes

Yes

Yes

Yes

Yes

Delete service account: 3

Yes

Yes

Create CI/CD profile

Yes

Yes

Yes

Yes

Delete CI/CD profile

Yes

Yes

Yes

Yes

List CI/CD profiles

Yes

Yes

Yes

Yes

Yes

Yes

Footnotes​

  1. Realm Administrator is a realm-scoped role, not an organization role. This column shows permissions for a user with the Auditor organization role who has been assigned as a Realm Admin for specific realms. Realm Admins can perform cluster operations only within their assigned realm(s). ↩

  2. Only within assigned realm(s). ↩ ↩2 ↩3

  3. Service accounts can be deleted by their owner, or by an administrator. ↩