Skip to main content

Users, Roles, and API Keys

The Permissions section provides the tools necessary to manage access to your ImageFactory environment. This section is divided into three sub-pages: Users, Roles, and API Keys. Access to these pages is typically restricted to administrative users.

Users​

The Users page allows you to manage the individuals who can access the ImageFactory web interface.

  • User Table: Displays a list of all users, their email addresses, and their assigned roles.
  • Add User: Click the Add User button to invite a new person. You must provide their email address and select one or more roles to define their permissions.
  • Edit User: You can modify the roles assigned to an existing user at any time.
  • Delete User: Removing a user immediately revokes their access to the ImageFactory interface.

Roles​

Roles are the foundation of the ImageFactory permission system. They define what actions a user or API key can perform on specific resources.

Creating a Role​

When creating a new role, you define a set of rules:

  1. Name and Description: Provide a clear identifier for the role.
  2. Actions: Select the allowed operations, such as VIEW, CREATE, UPDATE, DELETE, or ANY.
  3. Resources: Select the resources the actions apply to, including ACCOUNT, API_KEY, AUDIT_LOG, COMPONENT, NOTIFICATION_GROUP, ROLE, ROLE_BINDING, TEMPLATE, VARIABLE, or ANY.

Predefined Roles​

ImageFactory includes several common roles to simplify management:

  • Admin: Full access to all resources and administrative functions.
  • Read-Only: Permission to view all resources but not to create or modify them.
  • Template Manager: Focused on creating and managing image templates and components.

API Keys​

API Keys provide a way for external systems, such as CI/CD pipelines or monitoring tools, to authenticate with the ImageFactory GraphQL API.

  • Creating a Key: When you create a new API key, you must provide a name. The system will then display the API secret in a modal. This secret is only shown once and must be stored securely.
  • Assigning Roles: Like users, API keys must be assigned roles to define their permissions. This ensures that programmatic access follows the principle of least privilege.
  • Managing Keys: The API Keys table shows the name and creation date of each key. You can delete a key at any time to immediately invalidate its access.
Via API

You can manage the entire permission system programmatically. This allows for integration with external identity management systems or automated provisioning of API keys.

mutation CreateNewRole($input: CreateRoleInput!) {
  createRole(input: $input) {
    role {
      id
      name
    }
  }
}

mutation CreateKey($input: CreateApiKeyInput!) {
  createApiKey(input: $input) {
    apiKey {
      id
      name
    }
    secret # Only returned during creation
  }
}

By carefully defining roles and managing user and API key assignments, you can ensure that your image factory remains secure while providing the necessary access for your team and automation tools.