Skip to content

feat: adding Nautobot Admin Groups and Permission sync#2157

Open
abhimanyu003 wants to merge 2 commits into
mainfrom
nautobotOPPermissions
Open

feat: adding Nautobot Admin Groups and Permission sync#2157
abhimanyu003 wants to merge 2 commits into
mainfrom
nautobotOPPermissions

Conversation

@abhimanyu003

@abhimanyu003 abhimanyu003 commented Jul 22, 2026

Copy link
Copy Markdown
Contributor

This PR adds Nautobot Admin Groups and Permission sync.
Example of config map this will sync form.

This is only for admin that's why it's nested into admin folder to keep things cleaner

apiVersion: v1
kind: ConfigMap
metadata:
  name: permission-groups
  namespace: nautobot
data:
  permission-groups.yaml: |
    permissions:
      - name: read-all
        description: Allow read access to all objects
        can_view: true
        object_types:
          - "dcim.device"
          - "dcim.location"
          - "dcim.rack"
          - "ipam.prefix"
          - "ipam.vlan"
        groups:
          - 'infra.baremetal.admin'
          - 'infra.controlplane.admin'
          - 'infra.ironops'
          - 'infra.fabricops'
          - 'infra.dctechs'
          - 'rxdb.manager'
          - 'sandbox.manager'
          - 'sddc.manager'
          - 'rxdb.member'
          - 'sandbox.member'
          - 'sddc.member'
          - 'rackspace.all'

      - name: user-api-tokens
        description: Allow users to manage their own API tokens
        can_view: true
        can_add: true
        can_change: true
        can_delete: true
        object_types:
          - "users.token"
        groups:
          - 'infra.baremetal.admin'
          - 'infra.controlplane.admin'
          - 'infra.ironops'
          - 'infra.fabricops'
          - 'infra.dctechs'
          - 'rxdb.manager'
          - 'sandbox.manager'
          - 'sddc.manager'
          - 'rxdb.member'
          - 'sandbox.member'
          - 'sddc.member'
          - 'rackspace.all'

      - name: napalm-read
        description: Allow NAPALM read operations on devices
        can_view: true
        additional_actions:
          - "napalm_read"
        object_types:
          - "dcim.device"
        groups:
          - 'infra.baremetal.admin'

      - name: job-execution
        description: Allow job execution
        can_view: true
        can_add: true
        can_change: true
        object_types:
          - "extras.job"
          - "extras.jobresult"
        groups:
          - 'infra.baremetal.admin'
          - 'infra.controlplane.admin'

      - name: sys-admin
        description: Full system administration access
        can_view: true
        can_add: true
        can_change: true
        can_delete: true
        object_types:
          - "dcim.device"
          - "dcim.location"
          - "dcim.rack"
          - "ipam.prefix"
          - "ipam.vlan"
          - "extras.job"
        groups:
          - 'infra.controlplane.admin'

      - name: storage-admin
        description: Storage administration access
        can_view: true
        can_add: true
        can_change: true
        can_delete: true
        object_types:
          - "dcim.device"
          - "dcim.rack"
        groups:
          - 'infra.baremetal.admin'
          - 'infra.controlplane.admin'

Groups Screenshot
image

Permission Screenshot

image

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant