Sign inTry Free

Important

Helios features are now enabled during weekly update windows and are no longer directly tied to SingleStore engine releases. Refer to the release notes to view the latest features available in your Helios cluster.

Container Services RBAC

On this page

SingleStore Aura supports Role-Based Access Control (RBAC), which allows administrators to assign granular permissions at multiple levels. This ensures that users and teams have only the access they need to develop, deploy, and manage Container services such as Cloud Functions, Dashboard Apps, Python UDFs, and Scheduled Jobs.

Refer to Role-Based Access Control (RBAC) for SingleStore Helios for more information on RBAC in SingleStore Helios.

Benefits of RBAC in SingleStore Aura

  • Operational Efficiency: You can onboard or offboard users efficiently and modify their access based on role changes.

  • Secure Collaboration: RBAC ensures that users access only the resources they need. For example, data scientists can build applications, while analysts can view them without making changes.

  • Compliance-Ready: Role-to-resource mappings and access logs simplify audit processes and help meet regulatory requirements.

  • Orphaned Resource Prevention: When users leave, RBAC helps prevent lost or unmanaged assets by enabling easy transfer of ownership.

Resources Governed by Aura App RBAC

Aura App RBAC model governs the following Container Services resources:

  • Cloud Functions

  • Dashboard Apps

  • Container App API Keys

  • Python UDFs

  • Scheduled Jobs (recurring)

  • Notebooks

Note

For Scheduled Jobs, the RBAC model applies only to recurring jobs.

Predefined Roles for Container App Resource

Role

Description

Permission

Owner

Provides full access including the ability to manage access, operate, delete, monitor and use the Container App.

  • Control Access

  • Create API Keys

  • Delete

  • Pause

  • Resume

  • Revoke API Keys

  • Share

  • Update

  • Use

User

Provides access to the Container App and allows creating Container App API keys.

  • Create API Keys

  • Use

Note

  • Python UDFs: Only the Owner can update, delete, or share a Python UDF. The User role grants view and invoke access only.

  • Scheduled Jobs (recurring): Only the Owner can edit, pause, resume, delete, or share a recurring Scheduled Job. The User role grants view access only.

Ownership on Create

When a user creates a Python UDF or a recurring Scheduled Job, the system automatically grants the creator the Owner role on the underlying Aura App resource. The Owner role allows the creator to manage, share, update, and delete the resource without an additional access grant.

An organization-level role that grants the Aura Creator role is required to create a Python UDF or a recurring Scheduled Job. Users without this permission cannot create Python UDFs or Scheduled Jobs, regardless of their resource-level roles.

Visibility

Users can only view the Python UDFs and Scheduled Jobs they have access to. Both list and detail views in the Cloud Portal and the corresponding Management API responses are filtered by role:

  • Users with the Owner or User role on a resource can view it in list and detail views.

  • Users without a required role on a resource cannot view it in the Cloud Portal or API responses.

This means an Organization member who does not inherit Aura App access and has no explicit role on a specific Python UDF or recurring Scheduled Job cannot view or interact with that resource. Refer to Organization Role Inheritance for more information.

Organization Role Inheritance

Organization-level roles determine whether a user automatically has access to Container Services resources without an explicit resource-level grant.

Roles that inherit full Aura App permissions:

  • Organization Owner

  • AI Administrator

These roles have Owner-equivalent access to every Python UDF and recurring Scheduled Job in the organization without any explicit sharing.

Roles that do not inherit Aura App permissions:

  • Reader

  • Writer

  • Operator

  • Observer

  • Billing Administrator

  • User Administrator

Users with these organization-level roles need an explicit Owner or User role on a specific resource to view or use it. For example, an Operator without an explicit grant on a recurring Scheduled Job cannot view the job in the Jobs page.

Note

A user can hold both Domain-level or resource-level roles regardless of their organization-level role. A "roleless" organization member can receive Owner or User access to a specific Python UDF or Scheduled Job.

How to Use RBAC in SingleStore Aura

Aura App users can enforce RBAC in SingleStore Aura using both the Cloud Portal and Management API.

Using Cloud Portal

To use RBAC in the Cloud Portal, perform the following steps:

  1. Under the Container Services section, navigate to an Aura App.

  2. Select the three dots under the Actions column next to your Container App instance, and then select Share.

  3. From the list, select User or Team to share the Container App with.

  4. In the Access list, select the desired role next to the selected user or team.

  5. To remove access for a user or team, select Remove Access in the Access list.

Using Management API

Use the Users (/v1/users endpoint) and Teams path (/v1/teams endpoint) in the Management API to use RBAC in SingleStore Aura. Refer to Management API Reference for more information.

Last modified:

Was this article helpful?

On this page

Was this article helpful?

Verification instructions

Note: You must install cosign to verify the authenticity of the SingleStore file.

Use the following steps to verify the authenticity of singlestoredb-server, singlestoredb-toolbox, singlestoredb-studio, and singlestore-client SingleStore files that have been downloaded.

You may perform the following steps on any computer that can run cosign, such as the main deployment host of the cluster.

  1. (Optional) Run the following command to view the associated signature files.

    curl undefined

  2. Download the signature file from the SingleStore release server.

    • Option 1: Click the Download Signature button next to the SingleStore file.

    • Option 2: Copy and paste the following URL into the address bar of your browser and save the signature file.

    • Option 3: Run the following command to download the signature file.

      curl -O undefined

  3. After the signature file has been downloaded, run the following command to verify the authenticity of the SingleStore file.

    echo -n undefined |
        cosign verify-blob --certificate-oidc-issuer https://oidc.eks.us-east-1.amazonaws.com/id/CCDCDBA1379A5596AB5B2E46DCA385BC \
          --certificate-identity https://kubernetes.io/namespaces/freya-production/serviceaccounts/job-worker \
          --bundle undefined \
          --new-bundle-format -
    Verified OK

Try Out This Notebook to See What’s Possible in SingleStore

Get access to other groundbreaking datasets and engage with our community for expert advice.

Sign UpLog In