Roles and Capabilities

Every member of a hub has an assigned role. The role dictates what capabilities the account has when viewing or managing resources within the hub. Every hub has a set of default roles, however new roles with custom capabilities can be added. Default roles can be edited or removed. Roles are also assigned to hub API keys.

Rank

A role's rank is it's hierarchy in relation to other roles in the hub. The rank doesn't determine anything about what capabilities are given to its members, but does determine what other roles it can manage or give access to. The rank is a number between 0-9, tho the special Owner role has rank 10.

For example, a rank 6 role could not create an invite for a rank 9 role. Ranks also are incapable of inviting members of the same rank to the hub.

Default Roles

The default roles and their ranks created for every hub are

RoleRank
Owner / Root10 (This is a special super user role, so it's above the standard 0-9 rank.)
Admin7
DevOps Engineer5
Developer4
Consultant2
Analyst1

Capabilities

Roles are made up of capabilities - granular permissions that define what a member or API key is capable of within a hub. A capability dictates whether or not the role has permission to perform an action at all within the hub, but can be further limited using ACLs.

When a new role is created, its exact capabilities can be selected, providing a highly customizable system for managing access within a hub.

Nearly everything on Cycle has an associated capability.

CapabilityDescription
api-keys-manageAbility to manage API keys
apionly-jobs-viewAbility to view jobs (API keys only)
apionly-notifications-listenAbility to listen to notifications (API keys only)
autoscale-groups-manageAbility to manage autoscale groups
autoscale-groups-viewAbility to view autoscale groups
billing-credits-viewAbility to view billing credits
billing-invoices-payAbility to pay billing invoices
billing-invoices-viewAbility to view billing invoices
billing-methods-manageAbility to manage billing methods
billing-services-manageAbility to manage billing services
billing-services-viewAbility to view billing services
containers-backups-manageAbility to manage container backups
containers-backups-viewAbility to view container backups
containers-consoleAbility to access container console
containers-deployAbility to deploy containers
containers-instances-migrateAbility to migrate container instances
containers-lockAbility to lock containers
containers-sshAbility to SSH into containers
containers-manageAbility to manage containers
containers-viewAbility to view containers
containers-functions-triggerAbility to trigger container functions
containers-volumes-manageAbility to manage container volumes
containers-volumes-viewAbility to view container volumes
dns-certs-viewAbility to view DNS certificates
dns-manageAbility to manage DNS
dns-viewAbility to view DNS
environments-deployments-manageAbility to manage environment deployments
environments-manageAbility to manage environments
environments-scopedvariables-manageAbility to manage environment scoped variables
environments-scopedvariables-viewAbility to view environment scoped variables
environments-services-manageAbility to manage environment services
environments-viewAbility to view environments
environments-vpnAbility to manage environment VPN
environments-vpn-manageAbility to manage environment VPN settings
hubs-deleteAbility to delete hubs
hubs-integrations-manageAbility to manage hub integrations
hubs-integrations-viewAbility to view hub integrations
hubs-invites-manageAbility to manage hub invites
hubs-invites-sendAbility to send hub invites
hubs-members-manageAbility to manage hub members
hubs-members-viewAbility to view hub members
hubs-roles-manageAbility to manage hub roles
hubs-roles-viewAbility to view hub roles
hubs-usage-viewAbility to view hub usage
hubs-updateAbility to update hubs
hubs-auditlog-viewAbility to view hub audit logs
images-manageAbility to manage images
images-sources-manageAbility to manage image sources
images-sources-viewAbility to view image sources
images-viewAbility to view images
ips-manageAbility to manage IP addresses
servers-consoleAbility to access server console
servers-decommissionAbility to decommission servers
servers-loginAbility to login to servers
clusters-manageAbility to manage clusters
clusters-viewAbility to view clusters
servers-provisionAbility to provision servers
servers-manageAbility to manage servers
servers-viewAbility to view servers
monitor-manageAbility to manage monitor settings
monitor-viewAbility to view monitor settings
pipelines-manageAbility to manage pipelines
pipelines-triggerAbility to trigger pipelines
pipelines-viewAbility to view pipelines
sdn-networks-manageAbility to manage SDN networks
sdn-networks-viewAbility to view SDN networks
security-manageAbility to manage security settings
security-viewAbility to view security events
stacks-builds-deployAbility to deploy stack builds
stacks-builds-manageAbility to manage stack builds
stacks-manageAbility to manage stacks
stacks-viewAbility to view stacks

Resource ACLs

In addition to the capabilities above, individual resources have their own customizable controls. ACLs further limit a role's access on a per-resource basis.

See the ACL documentation for more information.

API Keys

API keys are assigned a role when they are created. This unified system makes it much simpler to manage all access to a hub, no matter what interface (Portal, API, CLI) is used.