Manage users on Astro Private Cloud

Astro Private Cloud allows you to adjust permissions for each user role and define how new users join your organization. This document covers customizing user signups and user roles, and using Astro Private Cloud system-level permissions. For a list of the default permissions for each role, see User roles and permissions. To learn more about managing users through your identity provider (IdP), see Import IdP groups.

Prerequisites

System Admin access to Astro Private Cloud.
Access to your platform’s values.yaml file.

Add users to Astro Private Cloud

When you first deploy Astro Private Cloud, the first user to sign in receives System Admin permissions by default. After that, Astro Private Cloud creates a user in any of the following ways:

A Workspace Admin invites them to a Workspace
A System Admin invites them to the platform
They sign up through the Astro Private Cloud UI without an invitation, which requires publicSignups
Astro Private Cloud imports them through an IdP group

As a System Admin, you can open the platform to public signups, limit account creation to users invited by others, or make it so that users can only join the platform as part of an IdP-based Team.

New users appear under a System Admin’s Users tab only after the new user signs in for the first time.

You can bypass the email verification process for new users through an Astro Private Cloud (APC) API mutation. For the format of this mutation, see Use the APC API.

Enable public signups

Public signups allow any user with access to your base domain to create an account. If you disable public signups, users who try to access Astro Private Cloud without an invitation from another user receive an error. Enabling public signups can simplify initial setup when SMTP credentials are difficult to acquire, because disabling public signups requires that a user accept an email invitation. publicSignups is an APC API configuration that you set in the values.yaml file of your Helm chart. To enable public signups, add the following YAML snippet to your values.yaml file:

astronomer:
  houston:
    config:
      publicSignups: true
      emailConfirmation: false # Set to false if you also want to disable other SMTP-dependent features

An example values.yaml file would look like:

global:
  baseDomain: mybasedomain
  tlsSecret: astronomer-tls
nginx:
  loadBalancerIP: 0.0.0.0
  preserveSourceIP: true

astronomer:
  houston:
    config:
      publicSignups: true
      emailConfirmation: false

Then, push the configuration change to your platform as described in Apply a config change.

System permissions on Astro Private Cloud

The System Admin role grants full permissions across all clusters, Workspaces, and Deployment entities. Users with this role can monitor and take action on Workspaces, Deployments, and users throughout all clusters. On Astro Private Cloud, System Admins specifically can:

Register a data plane
List all data planes
Manage data plane-wide config
De-register a data plane
List and search all users
List and search all Deployments
Access the Airflow UI for all Deployments
Delete a user
Delete a Deployment
Access Grafana for cluster-level monitoring
Add other System Admins

Astro Private Cloud also supports a System Editor and a System Viewer permission set. No user holds the System Editor or System Viewer role by default. System Admins assign these roles using the APC API. After you assign the System Viewer role, for example, that user can access Grafana but can’t delete a Workspace they don’t belong to. You can customize all three Astro Private Cloud permission sets to meet your requirements. For more information about the default configurations for the System Admin, Editor, and Viewer roles, see the APC API default config.

Assign users System Admin roles

Use the System Admin tab in the Astro Private Cloud UI to add System Admins. Keep in mind that:

Only existing System Admins can grant the System Admin role to another user.
The user must have a verified email address and already exist in the system.

To assign a user a different system-level role, either SYSTEM_VIEWER or SYSTEM_EDITOR, use an API call from your platform’s GraphQL playground. For guidelines, see Use the APC API.

Verify System Admin access

To verify a user was successfully granted the System Admin role, ensure they can do the following:

Go to grafana.<BASEDOMAIN>
Access the System Admin tab from the top left menu of the Astro Private Cloud UI

User roles on Astro Private Cloud

Administrators can customize permissions across your installation. On Astro Private Cloud, you can assign users roles at four levels:

Deployment level (Viewer, Editor, Admin)
Workspace level (Viewer, Editor, Admin)
System level (Viewer, Editor, Admin)
Cluster level (Admin)

Deployment roles apply to a Deployment within a single Workspace. Workspace roles apply to all Airflow Deployments within a single Workspace. Cluster roles apply to all Workspaces across a single data plane. System roles apply across all data planes. For more information about the three Workspace-level roles on Astro Private Cloud (Viewer, Editor, and Admin), see Manage user permissions on an Astro Private Cloud Workspace.

Customize role permissions

Astro Private Cloud defines permissions as scope.entity.action, where:

scope: The layer of the platform to which the permission applies
entity: The object or role being operated on
action: The verb describing the operation being performed on the entity

For example, the deployment.serviceAccounts.create permission translates to the ability for a user to create a Deployment-level service account in any Deployment to which they belong. For the available platform permissions and default role configurations, see User roles and permissions. A permission for a given scope applies only to the parts of the scope a user was invited to. For example, a user with a role including the workspace.serviceAccounts.get permission can view service accounts only in the Workspaces they belong to. The steps in this section modify the permissions of the built-in System, Workspace, and Deployment roles through your values.yaml file. To instead create additional roles with their own custom sets of permissions and assign them through the Astro Private Cloud UI, see Create custom roles.

Role permission inheritance

In addition to their own permissions, roles inherit permissions from other roles. There are several chains of inheritance in the Astro Private Cloud RBAC system. In the following list, > represents “inherits from”:

System Admin > System Editor > System Viewer > User
Deployment Admin > Deployment Editor > Deployment Viewer > User
Workspace Admin > Workspace Editor > Workspace Viewer > User

Modify built-in role permissions

Identify a permission change

Review the default roles and permissions in the default APC API configuration and determine the following:

What role you want to configure. For example, DEPLOYMENT_EDITOR.
What permissions you want to add to or remove from the role. For example, deployment.images.push.

For example, you might want to block a DEPLOYMENT_EDITOR (and therefore WORKSPACE_EDITOR) from deploying code to all Airflow Deployments within a Workspace and instead limit that action to users assigned the DEPLOYMENT_ADMIN role.

Modify your values.yaml file

Apply the role and permission changes to your organization’s values.yaml file. For example:

astronomer:
  houston:
    config:
      roles:
        DEPLOYMENT_EDITOR:
          permissions:
            deployment.images.push: false

In the same way you can remove permissions from a particular role by setting a permission to :false, you can add permissions to a role at any time by setting a permission to :true.For example, if you want to allow any DEPLOYMENT_VIEWER (and therefore WORKSPACE_VIEWER) to push code directly to any Airflow Deployment within a Workspace, you’d specify the following:

astronomer:
  houston:
    config:
      roles:
        DEPLOYMENT_VIEWER:
          permissions:
            deployment.images.push: true

Push the configuration change to your platform. See Apply a config change.

Example customization: limit Workspace creation

Unless otherwise configured, a user who creates a Workspace on Astro Private Cloud is automatically granted the WORKSPACE_ADMIN role and can create an unlimited number of Airflow Deployments within that Workspace. For organizations looking to more strictly control resources, Astro Private Cloud supports limiting the Workspace creation function through the USER role. Astro Private Cloud includes a USER role that is synthetically bound to all users within the control plane. By default, this role includes the system.workspace.create permission. If you’re a System Admin who wants to limit Workspace creation, you can:

Set the system.workspace.create permission for the USER role to false.
Attach the system.workspace.create permission to a separate role of your choice.

You might want to limit this permission to the SYSTEM_ADMIN role on the platform, because System Admins can be responsible for managing cluster-level resources and costs. To reassign this permission to System Admins, your values.yaml would appear similar to the following example:

astronomer:
  houston:
    config:
      roles:
        SYSTEM_ADMIN:
          permissions:
            system.workspace.create: true
        USER:
          permissions:
            system.workspace.create: false

Overview

Architecture

Upgrade to Astro Private Cloud 2.0

Install Astro Private Cloud

Develop Dags

Airflow administration

Airflow 3

Deploy Dags

Manage Deployments

Platform administration

Manage Platform resources

Security and compliance

APC API

Platform Observability

Release notes

Reference

Manage users on Astro Private Cloud

Prerequisites

Add users to Astro Private Cloud

Enable public signups

System permissions on Astro Private Cloud

Assign users System Admin roles

Verify System Admin access

User roles on Astro Private Cloud

Customize role permissions

Role permission inheritance

Modify built-in role permissions

Example customization: limit Workspace creation

​Prerequisites

​Add users to Astro Private Cloud

​Enable public signups

​System permissions on Astro Private Cloud

​Assign users System Admin roles

​Verify System Admin access

​User roles on Astro Private Cloud

​Customize role permissions

​Role permission inheritance

​Modify built-in role permissions

​Example customization: limit Workspace creation

Prerequisites

Add users to Astro Private Cloud

Enable public signups

System permissions on Astro Private Cloud

Assign users System Admin roles

Verify System Admin access

User roles on Astro Private Cloud

Customize role permissions

Role permission inheritance

Modify built-in role permissions

Example customization: limit Workspace creation