User roles and permissions

User accounts are associated with a set of roles that define the specific dashboard functionality which can be accessed. View user roles and permissions by going to Dashboard settings > User management.

The IBM Storage Ceph dashboard functionality or modules are grouped within a security scope. Security scopes are predefined and static. The current available security scopes on the IBM Storage Ceph dashboard are:

• cephfs - Includes all features related to CephFS management.
• config-opt - Includes all features related to management of Ceph configuration options.
• dashboard-settings - Allows to edit the dashboard settings.
• grafana - Include all features related to Grafana proxy.
• hosts - Includes all features related to the Hosts menu entry.
• log - Includes all features related to Ceph logs management.
• manager - Includes all features related to Ceph manager management.
• monitor - Includes all features related to Ceph monitor management.
• osd - Includes all features related to OSD management.
• pool - Includes all features related to pool management.
• prometheus - Include all features related to Prometheus alert management.
• rbd-image - Includes all features related to RBD image management.
• rbd-mirroring - Includes all features related to RBD mirroring management.
• rgw - Includes all features related to Ceph Object Gateway (RGW) management.

A role specifies a set of mappings between a security scope and a set of permissions. There are four types of permissions:

• Read
• Create
• Update
• Delete

The list of system roles are:

• administrator - Allows full permissions for all security scopes.
• block-manager - Allows full permissions for RBD-image and RBD-mirroring scopes.
• cephfs-manager - Allows full permissions for the Ceph File System scope.
• cluster-manager - Allows full permissions for the hosts, OSDs, monitor, manager, and config-opt scopes.
• pool-manager - Allows full permissions for the pool scope.
• read-only - Allows read permission for all security scopes except the dashboard settings and config-opt scopes.
• rgw-manager - Allows full permissions for the Ceph Object Gateway scope.
  Note: you need to provide rgw-manager access to the users for all Ceph Object Gateway operations.