Skip to main content

Members and roles

A team organization is shared by its members, and each member's role decides what they can do in it. Every request a person makes, from the console, astroctl, the API or Nova, is checked against their role in the organization it acts in. Members are a team organization feature: your default organization has only you.

Roles​

  • Viewer: Read the organization's clusters, applications, models, cost and findings, and use the API.
  • Editor: Everything a viewer can, plus deploy, update, roll back and resync applications and models.
  • Admin: Everything an editor can, plus clusters, add-ons, profiles, credentials, integrations, notifications and members.
  • Owner: Everything an admin can, plus billing and deleting the organization. One per organization: the person who created it, until they transfer it.

Service accounts take the same Viewer, Editor and Admin roles, for automation. The console reads the roles, with their permissions, from the platform.

Before you start​

  • A team organization on the Enterprise plan, which includes members and the Admin role. The Developer plan has neither.
  • To add, change or remove members: the organization's owner, with the account Admin role.
  • The person's User ID. They copy it from Organization settings › Profile, or run astroctl whoami.

In the console​

  1. Pick the team organization in the switcher, then select your name at the bottom of the sidebar, Organization settings, then Members. Team Members lists each member's User ID, Role, Status and Joined At.

    Open zoom view

    Organization settings, Members: the team members of an organization with their roles

    Organization settings, Members: the team members of an organization with their rolesOrganization settings, Members: the team members of an organization with their roles

  2. Select Add Member. Enter their User ID and pick a Role; each role shows its permissions. Select Add Member.

    Open zoom view

    The add member dialog with the role picker open

    The add member dialog with the role picker openThe add member dialog with the role picker open

  3. To make someone the owner, open their row and select Make owner, then type their email to confirm. You stay on as an admin.

  4. To remove someone, select the remove button on their row and confirm. The owner can't be removed ("The owner can't be removed. Transfer ownership first."), and nobody can remove themselves.

You should see​

The member in Team Members with their role. They pick the organization in their switcher, or run astroctl org use <organization>, and work in it with that role straight away. A removed member loses access on their next request.

What a role change touches​

  • A new role applies on the person's next request, in the console, astroctl and their API keys alike.
  • Personal API keys act as their owner, so a key never does more than its owner's role allows.
  • Every add, role change, transfer and removal is in the organization's audit log, under who made it.

Other ways in​

With astroctl​

Change a role from the command line; the console offers add, transfer and remove.

Terminal
astroctl org add-user --user-id <user-id> --role Editor
astroctl org set-role --user-id <user-id> --role Admin
astroctl org transfer-owner --user-id <user-id>
astroctl org remove-user --org-id <org-id> --user-id <user-id>

They act in the active organization unless --org-id names another. Every flag: astroctl organization.

If it's refused​

"You must be an admin to manage organization members."
Cause
Your account does not have the Admin role.
Fix
Ask the organization's owner to make the change.
"Team management is not allowed - feature is not enabled for plan <plan>. Please check https://astropulse.io/pricing for more information"
Cause
The organization's plan has no team management.
Fix
Team organizations come with an Enterprise plan: see pricing.
"Forbidden: Not allowed to add in the preferred organization"
Cause
The organization is a default organization, which has no other members.
Fix
Add people to a team organization.
"Forbidden: You cannot add yourself to the organization"
Cause
The User ID is your own.
Fix
Enter the other person's User ID.
"Forbidden: You cannot remove yourself from the organization"
Cause
You tried to remove yourself.
Fix
Another owner-level member removes you, after you transfer ownership if you are the owner.

Next​