This page describes how Pachyderm’s Identity and Access Management (IAM) system works and how you can use it to manage access in Pachyderm. Use IAM to grant granular access to specific Pachyderm resources.

How IAM Works #

IAM works by managing access for users (human or robot) through assigned roles. Roles contain a set of granular permissions (create, read, update, delete) for a given resource. In Pachyderm, resources include clusters, projects, and repositories.

A user can have many roles, and some roles encompass the permissions of other roles. For example, if you have a clusterAdminRole, all other permissions belonging to more restricted roles are included.

💡

You can use the command pachctl auth roles-for-permission <permission> to look up which roles provide a given permission.

Admin Roles #

clusterAdminRole #

The ClusterAdminRole includes all of the previous permissions, plus the following:

oidcAppAdminRole #

idpAdminRole #

secretAdminRole #

identityAdminRole #

licenseAdminRole #

Project Roles #

All users have the PROJECT_LIST_REPO and PROJECT_CREATE_REPO permissions by default.

ProjectOwnerRole #

ProjectCreatorRole #

Repo Roles #

RepoReaderRole #

RepoWriterRole #

The RepoWriterRole includes all of the RepoReaderRole permissions, plus the following:

RepoOwnerRole #

The RepoOwnerRole includes all of the RepoWriterRole and RepoReaderRole permissions, plus the following:

Misc Roles #

debuggerRole #

robotUserRole #

pachdLogReaderRole #