Manage local users and roles
Suggest changes
PDFs
You can add, remove, and edit users of your Astra Control Center installation using the Astra Control UI. You can use the Astra Control UI or Astra Control API to manage users.
You can also use LDAP to perform authentication for selected users.
Use LDAP
LDAP is an industry standard protocol for accessing distributed directory information and a popular choice for enterprise authentication. You can connect Astra Control Center to an LDAP server to perform authentication for selected Astra Control users. At a high level, the configuration involves integrating Astra with LDAP and defining the Astra Control users and groups corresponding to the LDAP definitions. You can use the Astra Control API or web UI to configure LDAP authentication and LDAP users and groups. See the following documentation for more information:
Add users
Account Owners and Admins can add more users to the Astra Control Center installation.
-
In the Manage Your Account navigation area, select Account.
-
Select the Users tab.
-
Select Add User.
-
Enter the user's name, email address, and a temporary password.
The user will need to change the password upon first login.
-
Select a user role with the appropriate system permissions.
Each role provides the following permissions:
-
A Viewer can view resources.
-
A Member has Viewer role permissions and can manage apps and clusters, unmanage apps, and delete snapshots and backups.
-
An Admin has Member role permissions and can add and remove any other users except the Owner.
-
An Owner has Admin role permissions and can add and remove any user accounts.
-
-
To add constraints to a user with a Member or Viewer role, enable the Restrict role to constraints check box.
For more information on adding constraints, refer to Manage local users and roles.
-
Select Add.
Manage passwords
You can manage passwords for user accounts in Astra Control Center.
Change your password
You can change the password of your user account at any time.
-
Select the User icon at the top right of the screen.
-
Select Profile.
-
From the Options menu in the Actions column, and select Change Password.
-
Enter a password that conforms to the password requirements.
-
Enter the password again to confirm.
-
Select Change password.
Reset another user's password
If your account has Admin or Owner role permissions, you can reset passwords for other user accounts as well as your own. When you reset a password, you assign a temporary password that the user will have to change upon logging in.
-
In the Manage Your Account navigation area, select Account.
-
Select the Actions drop-down list.
-
Select Reset Password.
-
Enter a temporary password that conforms to the password requirements.
-
Enter the password again to confirm.
The next time the user logs in, the user will be prompted to change the password. -
Select Reset password.
Remove users
Users with the Owner or Admin role can remove other users from the account at any time.
-
In the Manage Your Account navigation area, select Account.
-
In the Users tab, select the check box in the row of each user that you want to remove.
-
From the Options menu in the Actions column, select Remove user/s.
-
When you're prompted, confirm deletion by typing the word "remove" and then select Yes, Remove User.
Astra Control Center removes the user from the account.
Manage roles
You can manage roles by adding namespace constraints and restricting user roles to those constraints. This enables you to control access to resources within your organization. You can use the Astra Control UI or Astra Control API to manage roles.
Add a namespace constraint to a role
An Admin or Owner user can add namespace constraints to Member or Viewer roles.
-
In the Manage Your Account navigation area, select Account.
-
Select the Users tab.
-
In the Actions column, select the menu button for a user with the Member or Viewer role.
-
Select Edit role.
-
Enable the Restrict role to constraints check box.
The check box is only available for Member or Viewer roles. You can select a different role from the Role drop-down list.
-
Select Add constraint.
You can view the list of available constraints by namespace or by namespace label.
-
In the Constraint type drop-down list, select either Kubernetes namespace or Kubernetes namespace label depending on how your namespaces are configured.
-
Select one or more namespaces or labels from the list to compose a constraint that restricts roles to those namespaces.
-
Select Confirm.
The Edit role page displays the list of constraints you've chosen for this role.
-
Select Confirm.
On the Account page, you can view the constraints for any Member or Viewer role in the Role column.
|
|
If you enable constraints for a role and select Confirm without adding any constraints, the role is considered to have full restrictions (the role is denied access to any resources that are assigned to namespaces). |
Remove a namespace constraint from a role
An Admin or Owner user can remove a namespace constraint from a role.
-
In the Manage Your Account navigation area, select Account.
-
Select the Users tab.
-
In the Actions column, select the menu button for a user with the Member or Viewer role that has active constraints.
-
Select Edit role.
The Edit role dialog displays the active constraints for the role.
-
Select the X to the right of the constraint you need to remove.
-
Select Confirm.