Permissions may be granted to both clusters and virtual machines. The permissions system is intended to allow users to manage themselves. Any object that can have its permissions edited will have a Users tab.
For a high level description of how permissions can be used in various scenarios, read this blog post.
Deleting a user will remove all permissions, and other properties associated with the user such as cluster quotas.
Groups may be created so that permissions. This allows permissions structures where you are granting permissions to different organizations. Users may belong to unlimited number of groups. They will inherit the permissions of any group they belong to.
Groups are a persona that user’s may act on behalf of. When creating virtual machines, the user must choose whether they are acting on behalf of themselves or a group they are a member of. When acting on behalf of a group, the group’s permissions and quota used.
These permissions can be granted to either a user or a group. A user who is part of a group with a permission does not automatically have that permission individually. For instance, a user who is part of a group that has VM create permission can create a VM, but can only assign ownership to the group, not to themself. To grant permissions on a cluster, click add user on the Users tab of the cluster detail page. Cluster permissions can also be added by clicking Add Cluster in the Permissions tab of the user detail page.
Quotas restrict the usage of cluster resources by users and groups. Default quotas can be set by editing clusters, if no quota is set unlimited access is allowed. This will affect all users and groups.
The default quota can be overridden on the cluster users page:
Leaving a value empty specifies unlimited access for that resource.
To grant a user permissions on a VM, click Add VirtualMachine in the Permissions tab of the User detail page. To grant permissions to a user or group, use the Add User button on the Users tab of the VM detail page.
Permissions for virtual machines are also registered as tags on the virtual machine object. This allows the permissions to be viewed and set via the command line tool. Tags will be parsed when creating virtual machines, and will be updated when the object is refreshed (#387). When permissions are granted tags will be set on the virtual machine (#393).
Tags use the pattern: GANETI_WEB_MANAGER:<permission>:[G|U]:<user_id>