Skip to main content

Roles in Defakto

Defakto uses roles to manage permissions. The following access roles are installed by default:

  1. Auditor
  2. Operator
  3. Manager
  4. Administrator
  5. Owner

Roles are hierarchical. Each subsequent role has the permissions of the previous role plus additional permissions. For example, Operator has Auditor permissions and the ability to create and modify clusters.

Organization Roles vs. Realm Roles: Organization roles grant permissions across all trust domains and realms. Realm-specific roles (like Realm Admin) grant permissions only within assigned realms. See Realms for more information.

Realm Admin Role​

The Realm Admin role is a realm-scoped role that grants delegated administrative control over clusters within a specific realm. This role enables teams to manage their own infrastructure without requiring organization-wide Operator or Administrator permissions.

Realm Admin Capabilities:

  • Create, read, update, and delete clusters within the assigned realm
  • View workloads and configurations for clusters in the assigned realm
  • Register new cluster versions within the assigned realm

Realm Admin Limitations:

  • Cannot access clusters in other realms
  • Cannot create or delete realms
  • Cannot modify realm role assignments
  • Cannot elevate their own privileges

Role Permissions​

The tables below list permissions by feature area. Realm Admin is always assigned on top of an existing organization role. The Realm Admin column reflects a user with the minimum Auditor organization role — such a user inherits all Auditor permissions plus the realm-scoped cluster operations noted below.1

Users & Invitations​

AuditorOperatorManagerAdministratorOwnerRealm Admin
List users
View organization settings
Update organization settings
Invite user
Renew / delete user invitation
List user invitations
Change user role
Delete user

Role Assignments​

AuditorOperatorManagerAdministratorOwnerRealm Admin
List roles
List role assignments
Assign / remove role assignments

Service Accounts​

AuditorOperatorManagerAdministratorOwnerRealm Admin
View service account info
List service accounts
Create service account 2
Delete service account

Trust Domains​

AuditorOperatorManagerAdministratorOwnerRealm Admin
List trust domains
View trust domain info and signing authority status
List trust domain keys
Create / enable / disable / delete trust domain keys
List trust domain deployments
Manage deployment key sets (prepare / activate / taint / remove)
Create / register / update trust domain
Delete trust domain
Delete trust domain deployment

Clusters​

AuditorOperatorManagerAdministratorOwnerRealm Admin
List / describe clusters
List cluster versions
Create cluster3
Create / activate / deactivate cluster versions3
Delete cluster / cluster version3

Realms​

AuditorOperatorManagerAdministratorOwnerRealm Admin
List realms
Create / delete realm
Assign / remove realm roles

Federation​

AuditorOperatorManagerAdministratorOwnerRealm Admin
List federation links
Refresh federation link
Create / delete federation link

CI/CD Profiles​

AuditorOperatorManagerAdministratorOwnerRealm Admin
List CI/CD profiles and links
Create / delete CI/CD profile
Link / unlink CI/CD profile

Developer Identity​

AuditorOperatorManagerAdministratorOwnerRealm Admin
View unified access status
List developer identity policies
Add / update / delete developer identity policy
Enable / disable developer identity policy
Manage developer identity OIDC configurations

Managed Config​

AuditorOperatorManagerAdministratorOwnerRealm Admin
View organization config
View trust domain config
View trust domain deployment config
View cluster config / history / versions
Diff config versions
Update cluster config3
Update organization config
Update trust domain config
Update trust domain deployment config

Footnotes​

  1. Realm Admin is a realm-scoped role, not an organization role. This column reflects a user with the Auditor organization role who has also been assigned as Realm Admin for specific realms. Realm Admins inherit all Auditor permissions and can additionally perform cluster operations within their assigned realm(s). ↩

  2. Service Accounts cannot have the Owner role. ↩

  3. Only within assigned realm(s). ↩ ↩2 ↩3 ↩4