Platform RBAC
Role-Based Access Control (RBAC) provides policy-based authorization for requests to ArangoDB deployments managed by the platform. When enabled, every request through the gateway is evaluated against policies and roles before reaching the database.
CRD Overview
| CRD | Purpose |
|---|---|
| ArangoPermissionPolicy | Defines a reusable policy (statements with effect/actions/resources) |
| ArangoPermissionRole | Defines a role that groups named policies (attached via ArangoPermissionPolicyRoleBinding) |
| ArangoPermissionPolicyRoleBinding | Binds a named policy to a role |
| ArangoPermissionRoleUserBinding | Binds a role to a user with a per-user scope |
| ArangoPermissionToken | Creates JWT tokens referencing an ArangoPermissionPolicy with an inline scope |
Sections
- Enabling RBAC - Feature flags, Helm configuration, authorization modes
- Predefined Roles - The operator-managed role catalog: assigning, scoping, and extending
- Policies and Roles - Defining permissions with policies, roles, bindings, and scopes
- Permission Tokens - Creating JWT tokens via ArangoPermissionToken CRD
- User Role Bindings - Assigning roles to users with per-user scopes
- Identity and Permissions - Who Am I, Can I, and authentication endpoints
- FAQ - Common questions and troubleshooting