Stack Permissions

Stack permissions use Kubernetes role-based access control (RBAC) in the management.loft.sh API group. StackTemplate resources are cluster-scoped. StackInstance resources and their outputs subresource are project-scoped.

Unlike tenant clusters or namespaces, Stacks don't have a per-object Permissions tab in the UI. Grant access with a ClusterRoleTemplate instead, as shown below.

Permission map

Grant only the verbs required by each role:

Task	Resource	Verbs
Browse the Stack catalog	stacktemplates	get, list
Create Stack templates	stacktemplates	create
Manage Stack templates	stacktemplates	get, list, watch, create, update, patch, delete
Install a Stack	stackinstances	create
View Stack status	stackinstances	get, list, watch
Change or remove a Stack	stackinstances	update, patch, delete
Read published outputs	stackinstances/outputs	get

Reading a StackInstance does not grant access to its published values. Grant get on stackinstances/outputs separately because published values can include data captured from Secrets. The outputs API marks values captured from Secrets as sensitive.

A user who creates a StackInstance must also be authorized for its destination tenant cluster or control plane cluster. Task type licensing and destination access checks are independent of the resource rules in this page.

Default roles in Platform 4.12

The built-in Template Admin, Template Creator, and Template Viewer global roles include stacktemplates alongside the other template resources. Template Admin grants all verbs, and Template Viewer grants get. Template Creator's rule grants only create, but a StackTemplate defaults its owner to whoever creates it, and owner access separately grants that creator get, update, patch, and delete on templates they created.

The built-in Project Admin role grants all verbs on both stackinstances and stackinstances/outputs. The built-in Project User and Project Viewer roles do not grant StackInstance permissions in Platform 4.12. Add the required rules to a custom project role when those members need to install or operate Stacks.

Custom project role example

The following rule lets a project member create and monitor StackInstances and read their published outputs. The rule itself doesn't grant update or delete access. StackInstance creation defaults the owner to the caller, though, and owner access separately grants that member get, update, patch, delete, and the outputs subresource on instances they created. It doesn't extend to instances someone else created.

apiVersion: management.loft.sh/v1
kind: ClusterRoleTemplate
metadata:
  name: stack-user
  labels:
    loft.sh/project-role: "true"
spec:
  displayName: Stack User
  management: true
  clusterRoleTemplate:
    rules:
      - apiGroups:
          - management.loft.sh
        resources:
          - stackinstances
        verbs:
          - create
          - get
          - list
          - watch
      - apiGroups:
          - management.loft.sh
        resources:
          - stackinstances/outputs
        verbs:
          - get

Assign the custom role to project members as described in Project membership. For API request paths and resource fields, see the StackTemplate, StackInstance, and outputs references.