Users, roles and permissions

Admins with the users.manage permission manage people under Administration → Users and Administration → Roles.

How access works

• A role is a named set of permissions. You can create as many as you like.
• A user gets one or more role assignments. Each assignment is for everything, for one cluster, or for one HAProxy instance.
• On one cluster, only the role's cluster permissions count there. On one HAProxy, only its HAProxy permissions count there.
• A user only sees clusters where they have at least cluster.view, and HAProxy instances where they have at least haproxy.view.
• Hub permissions (managing users, clusters, settings and alerts) only count when the role is assigned on everything.

So "Operator on staging, Viewer on production" is two assignments for one user, and so is "HAProxy operator on lb-edge-1 only".

k10y / roles

Permissions

Per cluster

Permission	Allows
cluster.view	See the cluster: overview, nodes, workloads, pods, services, ConfigMaps, events, map, charts
secrets.view	See Secrets (names, types and key names; values are never shown)
logs.view	Read pod logs and live logs
workloads.scale	Scale Deployments and StatefulSets
workloads.restart	Restart workloads; suspend, resume and run CronJobs
workloads.update_image	Change a Deployment's container image
workloads.rollback	Roll back Deployments
workloads.delete	Delete Deployments and Jobs
pods.exec	Open a shell in a pod's container
pods.delete	Delete pods
services.delete	Delete Services
config.delete	Delete ConfigMaps and Secrets
nodes.manage	Cordon, uncordon and drain nodes
resources.edit	Edit an object's YAML in its details panel
apply.yaml	Create or update objects with Apply YAML
namespaces.protect	Choose the cluster's protected namespaces, where every action, edit and shell is refused
ai.use	Run AI investigations
audit.view	See the activity log

HAProxy (assign on one HAProxy instance, or on everything)

Permissions cover a whole HAProxy instance: all its frontends, backends and servers.

Permission	Allows
haproxy.view	See the instance: frontends, backends, servers, live numbers, charts, topology, logs, certificates, stick tables, the IP blocklist and config history (not the raw config)
haproxy.operate	Run it without changing its config: drain, maintenance and re-enable servers, rolling deploys, block and unblock IPs, let rate-limited clients in again (instant, no reload)
haproxy.configure	Change its config: frontends, routes, backends, servers, maintenance pages, certificates, Kubernetes sync, copy and group sync, restore old versions; read and edit the raw config (it can contain passwords)
haproxy.manage	Edit or remove the instance and its Data Plane API login. Adding a new instance needs this on everything

Notes:

• The first IP block on an instance adds the blocklist to every frontend, which is a config change, so it needs haproxy.configure once. After that, haproxy.operate is enough.
• Changing several instances of a group at once needs haproxy.configure on each of them. "Compare configs" only shows the members you can configure.

Hub (assign on everything)

Permission	Allows
clusters.manage	Add, edit and remove clusters (their agent URLs and tokens)
users.manage	Manage users, roles and role assignments
settings.manage	Manage system settings (AI providers, alert channels)
alerts.manage	Create and edit alert rules

Built-in roles

One set of roles per system, plus Admin. Give Kubernetes roles on everything or one cluster, and HAProxy roles on everything or one HAProxy.

Role	Assign on	Permissions
Admin	everything	Everything, including users, settings, clusters and HAProxy instances. It can't be edited or deleted.
Kubernetes viewer	everything or one cluster	View, logs and activity.
Kubernetes operator	everything or one cluster	View, logs, Secrets, scale, restart, update image, roll back, delete pods, edit YAML, apply YAML, AI, activity. Not the shell.
Kubernetes admin	everything or one cluster	Every cluster permission, including deletes, the pod shell, draining nodes and choosing protected namespaces.
HAProxy viewer	everything or one HAProxy	See frontends, backends, servers, live numbers, logs and history.
HAProxy operator	everything or one HAProxy	Viewer, plus drain and maintenance, rolling deploys, blocking IPs and the AI assistant. No config changes.
HAProxy admin	everything or one HAProxy	Everything on HAProxy: config changes, the raw config, the connection, and the AI assistant.

For someone who works on both, give two roles, e.g. Kubernetes operator on staging and HAProxy operator on lb-edge-1. The Roles page shows which system each role applies to. Edit the built-in roles or create your own.

Upgrading from 2.4 or older: the old Operator and Viewer roles are renamed Kubernetes operator and Kubernetes viewer. Their HAProxy permissions move to HAProxy operator and HAProxy viewer, which their users get automatically, so nobody loses access.

Add a user

Users → New user: username, display name, a starting password, and one or more role assignments. Keep Must change password at next login ticked so they choose their own.

Day-to-day

• Reset a password: open the user, type a new password and save. They're signed out everywhere and must change it at the next sign-in.
• Disable an account: Disable on the Users page. They're signed out immediately and can't sign in until enabled again.
• Sign a user out: Sign out signs them out of every device. See Sessions.
• Delete a user: their past actions stay in the audit log under their username.

There must always be at least one active user who can manage users on all clusters. k10y won't let you remove the last one.

Example roles

Role	Permissions	Assign
Developer	cluster.view, logs.view	production only
Developer (staging)	Operator permissions + pods.exec	staging only
On-call	Operator permissions + nodes.manage	all clusters
Auditor	cluster.view, audit.view	all clusters
HAProxy operator	haproxy.view, haproxy.operate	one HAProxy, e.g. lb-edge-1
Load balancer admin	all four haproxy.* permissions	one HAProxy, or everything to also add new instances