Permissions - Celum

This is the complete set of IAM actions — 216 actions across 39 services. Use it to write policy statements; see Permissions model for how matching works.

An action this page does not list is rejected when the policy is saved, not silently ignored — unknown action category "argocd", or unknown action "supervisor:Manage". That guard exists because the failure it replaced was a policy that saved cleanly and then authorised nothing, with no error anywhere. So a stale copy of this page does not merely mislead: it produces policies that will not save.

How to read this page

Every row is an action and the KRN template the request is checked against. Braces mark values filled in from the request:

Placeholder	Filled from
`{name}`	The supervisor name in the URL path
`{cluster}`, `{vm}`, `{release}`, `{issuer}`	The corresponding path segment
`{id}`	The object’s database ID
`{?supervisor}`	The `?supervisor` query parameter

{?supervisor} resolves to * when the query parameter is absent — so those routes are checked against krn:celum:supervisor:*:.... Any policy meant to restrict them must be scoped by the other segments, not by the supervisor.

Where a row lists more than one KRN, different routes share the action at different scopes. A policy needs to cover whichever one the route you care about uses.

Wildcards

{ "actions": ["cluster:List"] }   // one action
{ "actions": ["cluster:*"] }      // every action in the cluster service
{ "actions": ["*:*"] }            // everything

Six actions no route carries

Most actions are reached by calling a route. Six are not, and they are listed here because a policy naming them is legal and is validated against this same set — Celum rejects an unknown action when a policy is saved, so an action it ships and this page omits would look invented.

Action	Where it is enforced
`cluster:DeleteWithoutApproval`	directly inside the guest-cluster delete handler
`security:WriteClusterwide`	by the policy-visibility filter
`cluster:ListDeletionRequests`	nothing checks it — the listing endpoint authorises per row
`iam:GetMyPermissions`	nothing checks it — `/api/iam/me/*` is self-service and deliberately carries no action
`dnsprovider:Use`	inside DNS Publishing, when a supervisor binds to a registered DNS provider (it hands the supervisor that provider’s key)
`vcenter:Use`	inside the Cluster API step and Migrations, when a supervisor uses a registered vCenter (it hands the supervisor that vCenter’s credential)

cluster:ListDeletionRequests and iam:GetMyPermissions are shipped rather than enforced: they exist so that a policy granting them saves cleanly. Granting them changes nothing on its own.

Not on this page

A handful of routes bypass IAM entirely and cannot be granted or denied by policy: the health check, the /auth/* endpoints, and everything under /api/iam/me/ — your own permissions, groups, and API tokens. The MCP endpoint at /mcp is authorized per tool instead. Routes that appear in neither place are unmapped, and unmapped routes are denied outright when IAM_ENABLED=true.

Actions by service

ai

The assistant and its stored conversations.

Action	Resource (KRN)
`ai:Chat`	`krn:celum:ai:chat`
`ai:DeleteConversation`	`krn:celum:ai:conversation:{id}`
`ai:GetConversation`	`krn:celum:ai:conversation:{id}`
`ai:ListConversations`	`krn:celum:ai:conversation:*`
`ai:UpdateConversation`	`krn:celum:ai:conversation:{id}`

app

Platform application definitions — the catalog rendered onto clusters.

Action	Resource (KRN)
`app:Create`	`krn:celum:app:*`
`app:Delete`	`krn:celum:app:{id}`
`app:Export`	`krn:celum:app:*`
`app:Get`	`krn:celum:app:{id}`
`app:HelmCheck`	`krn:celum:app:*`
`app:Import`	`krn:celum:app:*`
`app:List`	`krn:celum:app:*`
`app:Render`	`krn:celum:app:*`
`app:Update`	`krn:celum:app:{id}`

audit-log

Action	Resource (KRN)
`audit-log:List`	`krn:celum:audit-log:*`

capi

Cluster API provider installation and status, including ClusterClasses and addons.

Action	Resource (KRN)
`capi:GetStatus`	`krn:celum:capi:` `krn:celum:supervisor:{name}:capi:`
`capi:Install`	`krn:celum:capi:` `krn:celum:supervisor:{name}:capi:`

ceph

Rook-Ceph discovery, status, and operator install.

Action	Resource (KRN)
`ceph:Discover`	`krn:celum:supervisor:{name}:ceph:*`
`ceph:GetStatus`	`krn:celum:supervisor:{name}:ceph:*`
`ceph:InstallOperator`	`krn:celum:supervisor:{name}:ceph:*`

certs

cert-manager, its issuers, and the certificates they hold.

Action	Resource (KRN)
`certs:GetStatus`	`krn:celum:supervisor:{name}:certs:*`
`certs:Install`	`krn:celum:supervisor:{name}:certs:*`

cilium

The CNI itself — install, configuration, BGP, and egress HA.

Action	Resource (KRN)
`cilium:Apply`	`krn:celum:supervisor:{name}:cilium:*`
`cilium:GetDefaults`	`krn:celum:cilium:` `krn:celum:supervisor:{name}:cilium:`
`cilium:GetState`	`krn:celum:supervisor:{name}:cilium:*`
`cilium:Install`	`krn:celum:supervisor:{name}:cilium:*`

cilium:Install also covers installing the FRR-K8s BGP engine, and cilium:Apply covers FRR configuration. There is no separate frrk8s:* service. Projects do have their own service — see project below; they were gated by cilium:* until 2026-08-17 and no longer are.

cloud-init-template

Reusable cloud-init documents for VM provisioning.

Action	Resource (KRN)
`cloud-init-template:Create`	`krn:celum:cloud-init-template:*`
`cloud-init-template:Delete`	`krn:celum:cloud-init-template:{id}`
`cloud-init-template:Get`	`krn:celum:cloud-init-template:{id}`
`cloud-init-template:List`	`krn:celum:cloud-init-template:*`
`cloud-init-template:Update`	`krn:celum:cloud-init-template:{id}`

cluster

Tenant cluster lifecycle and reads. Note the credential actions — there are four in total, the fourth being vcluster:GetKubeconfig.

Action	Resource (KRN)
`cluster:ApplyManifests`	`krn:celum:supervisor:{?supervisor}:cluster:{name}`
`cluster:ApproveDelete`	`krn:celum:supervisor:{name}:cluster:{cluster}`
`cluster:CreatePVC`	`krn:celum:supervisor:{?supervisor}:cluster:{name}`
`cluster:DeletePVC`	`krn:celum:supervisor:{?supervisor}:cluster:{name}`
`cluster:DeleteWithoutApproval`	`krn:celum:supervisor:{name}:cluster:{cluster}` — enforced inside the delete handler, not by a route
`cluster:ListDeletionRequests`	granted by two built-in policies; the listing endpoint authorises per row inside the handler
`cluster:Create`	`krn:celum:cluster-template:{id}` `krn:celum:supervisor:{?supervisor}:cluster:` `krn:celum:supervisor:{name}:cluster:`
`cluster:Delete`	`krn:celum:supervisor:{?supervisor}:cluster:{name}` `krn:celum:supervisor:{name}:cluster:{cluster}`
`cluster:Get`	`krn:celum:supervisor:{name}:cluster:{cluster}`
`cluster:GetEvents`	`krn:celum:supervisor:{?supervisor}:cluster:{name}`
`cluster:GetHealth`	`krn:celum:supervisor:{?supervisor}:cluster:*`
`cluster:GetIngresses`	`krn:celum:supervisor:{?supervisor}:cluster:{name}`
`cluster:GetKubeconfig`	`krn:celum:supervisor:{?supervisor}:cluster:{name}`
`cluster:GetLBServices`	`krn:celum:supervisor:{?supervisor}:cluster:{name}` `krn:celum:supervisor:{name}:cluster:{cluster}`
`cluster:GetNodes`	`krn:celum:supervisor:{?supervisor}:cluster:{name}`
`cluster:GetResources`	`krn:celum:supervisor:{?supervisor}:cluster:{name}` `krn:celum:supervisor:{name}:cluster:{cluster}`
`cluster:GetSshPassword`	`krn:celum:supervisor:{?supervisor}:cluster:{name}`
`cluster:GetTalosconfig`	`krn:celum:supervisor:{?supervisor}:cluster:{name}`
`cluster:GetWorkloads`	`krn:celum:supervisor:{?supervisor}:cluster:{name}`
`cluster:List`	`krn:celum:supervisor:{?supervisor}:cluster:*`
`cluster:Update`	`krn:celum:supervisor:{name}:cluster:{cluster}`

cluster:GetKubeconfig, cluster:GetTalosconfig, and cluster:GetSshPassword hand out working credentials for the tenant cluster. They are deliberately excluded from K8sGateOperator and K8sGateViewer — grant them through K8sGateSensitiveRead to named people.

cluster-template

The blueprints cluster creation renders from.

Action	Resource (KRN)
`cluster-template:Create`	`krn:celum:cluster-template:*`
`cluster-template:Delete`	`krn:celum:cluster-template:{id}`
`cluster-template:Get`	`krn:celum:cluster-template:{id}`
`cluster-template:List`	`krn:celum:cluster-template:*`
`cluster-template:Update`	`krn:celum:cluster-template:{id}`

database

Action	Resource (KRN)
`database:Backup`	`krn:celum:system:database`

discovery

Read-only lookups that populate form dropdowns. Denying these leaves creation forms empty rather than returning an obvious error.

Action	Resource (KRN)
`discovery:GetLBAddress`	`krn:celum:supervisor:{name}:discovery:*`
`discovery:ListAvailabilityZones`	`krn:celum:supervisor:{name}:discovery:*`
`discovery:ListClusterClasses`	`krn:celum:supervisor:{?supervisor}:discovery:` `krn:celum:supervisor:{name}:discovery:`
`discovery:ListInstanceTypes`	`krn:celum:supervisor:{name}:discovery:*`
`discovery:ListK8sVersions`	`krn:celum:supervisor:{name}:discovery:*`
`discovery:ListNamespaces`	`krn:celum:supervisor:{name}:discovery:*`
`discovery:ListPVCs`	`krn:celum:supervisor:{name}:discovery:*`
`discovery:ListStorageClasses`	`krn:celum:supervisor:{name}:discovery:*`
`discovery:ListVmClasses`	`krn:celum:supervisor:{name}:discovery:*`
`discovery:ListVolumeSnapshots`	`krn:celum:supervisor:{name}:discovery:*`

dns

external-dns — the publisher that writes route hostnames into a real DNS zone.

Action	Resource (KRN)
`dns:GetStatus`	`krn:celum:supervisor:{name}:dns:*`
`dns:Install`	`krn:celum:supervisor:{name}:dns:*`

dnsprovider

DNS servers registered once for the platform (Settings → Domains & DNS), whose keys stay in the secret store.

Action	Resource (KRN)
`dnsprovider:Create`	`krn:celum:dnsprovider:*`
`dnsprovider:Delete`	`krn:celum:dnsprovider:{name}`
`dnsprovider:Get`	`krn:celum:dnsprovider:{name}`
`dnsprovider:List`	`krn:celum:dnsprovider:*`
`dnsprovider:Update`	`krn:celum:dnsprovider:{name}`
`dnsprovider:Use`	enforced inside DNS Publishing, not by a route

domain

DNS domains available for ingress and gateway publication.

Action	Resource (KRN)
`domain:Create`	`krn:celum:domain:*`
`domain:Delete`	`krn:celum:domain:{id}`
`domain:List`	`krn:celum:domain:*`

gateway

Gateway API objects, listeners, TLS secrets, and the Envoy Gateway controller.

Action	Resource (KRN)
`gateway:Create`	`krn:celum:supervisor:{name}:gateway:*`
`gateway:Delete`	`krn:celum:supervisor:{name}:gateway:*`
`gateway:List`	`krn:celum:supervisor:{name}:gateway:*`

helm-release

Helm releases inside a tenant cluster.

Action	Resource (KRN)
`helm-release:GetValues`	`krn:celum:supervisor:{?supervisor}:cluster:{name}:helm-release:{release}`
`helm-release:Install`	`krn:celum:supervisor:{?supervisor}:cluster:{name}:helm-release:*`
`helm-release:List`	`krn:celum:supervisor:{?supervisor}:cluster:{name}:helm-release:*`
`helm-release:Uninstall`	`krn:celum:supervisor:{?supervisor}:cluster:{name}:helm-release:{release}`
`helm-release:Upgrade`	`krn:celum:supervisor:{?supervisor}:cluster:{name}:helm-release:{release}`

iam

Policies, groups, and group membership. Granting any of these is granting the ability to grant.

Action	Resource (KRN)
`iam:AddGroupMember`	`krn:celum:iam:group:{id}`
`iam:GetMyPermissions`	offered by the console’s policy builder; `/api/iam/me/*` is self-service and deliberately carries no action
`iam:ListTokens`	`krn:celum:iam:*`
`iam:MintToken`	`krn:celum:iam:*`
`iam:RevokeToken`	`krn:celum:iam:*`
`iam:AttachGroupPolicy`	`krn:celum:iam:group:{id}`
`iam:CreateGroup`	`krn:celum:iam:*`
`iam:CreatePolicy`	`krn:celum:iam:*`
`iam:DeleteGroup`	`krn:celum:iam:group:{id}`
`iam:DeletePolicy`	`krn:celum:iam:policy:{id}`
`iam:DetachGroupPolicy`	`krn:celum:iam:group:{id}`
`iam:GetPolicy`	`krn:celum:iam:group:{id}` `krn:celum:iam:policy:{id}`
`iam:ListGroupMembers`	`krn:celum:iam:group:{id}`
`iam:ListGroups`	`krn:celum:iam:*`
`iam:ListPolicies`	`krn:celum:iam:*`
`iam:RemoveGroupMember`	`krn:celum:iam:group:{id}`
`iam:UpdateGroup`	`krn:celum:iam:group:{id}`
`iam:UpdatePolicy`	`krn:celum:iam:policy:{id}`

iam:AttachGroupPolicy plus iam:AddGroupMember is effectively full access: the holder can attach K8sGateAdmin to a group and add themselves to it.

image

The Image Library’s golden images.

Action	Resource (KRN)
`image:Create`	`krn:celum:image:*`
`image:Delete`	`krn:celum:image:{id}`
`image:Get`	`krn:celum:image:{id}`
`image:List`	`krn:celum:image:*`
`image:Update`	`krn:celum:image:{id}`

kubeconfig

Supervisor kubeconfigs stored in the database.

Action	Resource (KRN)
`kubeconfig:Check`	`krn:celum:kubeconfig:*` `krn:celum:kubeconfig:{id}`
`kubeconfig:Delete`	`krn:celum:kubeconfig:{id}`
`kubeconfig:Download`	`krn:celum:kubeconfig:{id}`
`kubeconfig:List`	`krn:celum:kubeconfig:*`
`kubeconfig:Replace`	`krn:celum:kubeconfig:{id}`
`kubeconfig:Toggle`	`krn:celum:kubeconfig:{id}`
`kubeconfig:Upload`	`krn:celum:kubeconfig:*`

kubeconfig:Download returns admin credentials for a supervisor, not a tenant cluster. Only K8sGateAdmin carries it among the built-in policies.

license

Action	Resource (KRN)
`license:Update`	`krn:celum:license:global`

Reading the licence status needs no action.

migration

VM migration from vSphere: the Forklift install, its sources and its plans.

Action	Resource (KRN)
`migration:ArchivePlan`	`krn:celum:supervisor:{name}:migration:{plan}`
`migration:CancelPlan`	`krn:celum:supervisor:{name}:migration:{plan}`
`migration:CreatePlan`	`krn:celum:supervisor:{name}:migration:*`
`migration:CreateProvider`	`krn:celum:supervisor:{name}:migration:*`
`migration:CutoverPlan`	`krn:celum:supervisor:{name}:migration:{plan}`
`migration:DeletePlan`	`krn:celum:supervisor:{name}:migration:{plan}`
`migration:DeleteProvider`	`krn:celum:supervisor:{name}:migration:*`
`migration:Disable`	`krn:celum:supervisor:{name}:migration:*`
`migration:Enable`	`krn:celum:supervisor:{name}:migration:*`
`migration:GetPlan`	`krn:celum:supervisor:{name}:migration:{plan}`
`migration:GetStatus`	`krn:celum:supervisor:{name}:migration:*`
`migration:ListPlans`	`krn:celum:supervisor:{name}:migration:*`
`migration:ListProviders`	`krn:celum:supervisor:{name}:migration:*`
`migration:ReadInventory`	`krn:celum:supervisor:{name}:migration:*`
`migration:StartPlan`	`krn:celum:supervisor:{name}:migration:{plan}`
`migration:UpdateProvider`	`krn:celum:supervisor:{name}:migration:*`

monitoring

The observability stack — Prometheus, Loki, Alloy, ClickHouse, and the flow pipeline all share these two actions.

Action	Resource (KRN)
`monitoring:GetStatus`	`krn:celum:supervisor:{name}:monitoring:*`
`monitoring:Install`	`krn:celum:supervisor:{name}:monitoring:*`

oidc

Action	Resource (KRN)
`oidc:GetMetadata`	`krn:celum:oidc:*`

platform

Action	Resource (KRN)
`platform:GetDefaults`	`krn:celum:platform:charts`

project

Projects — the platform’s tenancy unit. A namespace plus its slice of pod, LoadBalancer, and egress address space.

Action	Resource (KRN)
`project:Configure`	`krn:celum:supervisor:{name}:project:*`
`project:Create`	`krn:celum:supervisor:{name}:project:*`
`project:Delete`	`krn:celum:supervisor:{name}:project:{project}`
`project:Get`	`krn:celum:supervisor:{name}:project:{project}`
`project:GetConfig`	`krn:celum:supervisor:{name}:project:*`
`project:List`	`krn:celum:supervisor:{name}:project:*`
`project:Update`	`krn:celum:supervisor:{name}:project:{project}`

Three of these name the individual project (…:project:{project}), which is what lets a policy say “project A but not project B”. Until 2026-08-17 these routes were gated by cilium:Apply and no narrower grant existed; that is no longer true, and a policy written against the old shape grants nothing here.

registry

Container registries and per-supervisor image buckets.

Action	Resource (KRN)
`registry:Create`	`krn:celum:registry:` `krn:celum:registry:image-bucket:`
`registry:Delete`	`krn:celum:registry:image-bucket:{supervisor}:{name}` `krn:celum:registry:{id}`
`registry:Get`	`krn:celum:registry:{id}`
`registry:List`	`krn:celum:registry:` `krn:celum:registry:image-bucket:`
`registry:Prepull`	`krn:celum:registry:{id}`
`registry:Test`	`krn:celum:registry:image-bucket:{supervisor}:{name}` `krn:celum:registry:{id}`
`registry:Update`	`krn:celum:registry:image-bucket:{supervisor}:{name}` `krn:celum:registry:{id}`

secrets

The secret store integration — Vault and External Secrets Operator.

Action	Resource (KRN)
`secrets:Configure`	`krn:celum:supervisor:{name}:secrets:*`
`secrets:GetStatus`	`krn:celum:supervisor:{name}:secrets:*`
`secrets:Install`	`krn:celum:supervisor:{name}:secrets:*`

security

Flow telemetry, topology, forensics, and network policy — read and write.

Action	Resource (KRN)
`security:Onboard`	`krn:celum:supervisor:{name}:security:*`
`security:Read`	`krn:celum:supervisor:` `krn:celum:supervisor:{?supervisor}:cluster:{name}:security:` `krn:celum:supervisor:{name}:project:{project}:security:` `krn:celum:supervisor:{name}:security:`
`security:ReadSecrets`	`krn:celum:supervisor:{name}:security:*`
`security:WriteClusterwide`	enforced by the policy-visibility filter, not by a route — it gates writing cluster-wide Cilium policies
`security:Write`	`krn:celum:supervisor:{?supervisor}:cluster:{name}:security:` `krn:celum:supervisor:{name}:security:`
`security:WriteSecrets`	`krn:celum:supervisor:{name}:security:*`

security:Read carries a project-qualified KRN alongside the supervisor-wide one, so a tenant can be granted flow visibility inside their own project and nowhere else. These routes moved off supervisor:GetSummary / supervisor:Manage / supervisor:Onboard on 2026-08-26; a policy still naming those for security reads grants nothing.

settings

Global platform settings — a single resource, not per-supervisor.

Action	Resource (KRN)
`settings:Read`	`krn:celum:settings:global`
`settings:Update`	`krn:celum:settings:global`

site

Physical locations that supervisors and registries are tagged with.

Action	Resource (KRN)
`site:Create`	`krn:celum:site:*`
`site:Delete`	`krn:celum:site:{id}`
`site:List`	`krn:celum:site:*`

storage

Storage drivers, storage classes, disks, and Rook.

Action	Resource (KRN)
`storage:ApplyStorageClass`	`krn:celum:supervisor:{name}:storage:*`
`storage:CreatePVC`	`krn:celum:supervisor:{name}:storage:*`
`storage:DeletePVC`	`krn:celum:supervisor:{name}:storage:*`
`storage:DeleteStorageClass`	`krn:celum:supervisor:{name}:storage:*`
`storage:Discover`	`krn:celum:supervisor:{name}:storage:*`
`storage:GetStatus`	`krn:celum:supervisor:{name}:storage:*`
`storage:InstallDriver`	`krn:celum:supervisor:{name}:storage:*`
`storage:Test`	`krn:celum:supervisor:{name}:storage:*`

storage:InstallDriver also covers wiping disks during backend preparation, and it installs the CSI snapshot controller as a storage prerequisite. It is not a read-adjacent permission.

supervisor

The supervisor itself — summary, refresh, bootstrap, onboarding, power profile.

Action	Resource (KRN)
`supervisor:ApplyManifests`	`krn:celum:supervisor:{name}`
`supervisor:Bootstrap`	`krn:celum:supervisor:{name}`
`supervisor:GetResources`	`krn:celum:supervisor:{name}`
`supervisor:GetSummary`	`krn:celum:supervisor:{name}`
`supervisor:List`	`krn:celum:supervisor:*`
`supervisor:Onboard`	`krn:celum:supervisor:{name}`
`supervisor:Refresh`	`krn:celum:supervisor:{name}`
`supervisor:SetPowerProfile`	`krn:celum:supervisor:{name}`

sysprep-template

Windows sysprep documents for VM provisioning.

Action	Resource (KRN)
`sysprep-template:Create`	`krn:celum:sysprep-template:*`
`sysprep-template:Delete`	`krn:celum:sysprep-template:{id}`
`sysprep-template:Get`	`krn:celum:sysprep-template:{id}`
`sysprep-template:List`	`krn:celum:sysprep-template:*`
`sysprep-template:Update`	`krn:celum:sysprep-template:{id}`

vcluster

Action	Resource (KRN)
`vcluster:GetKubeconfig`	`krn:celum:supervisor:{name}:vcluster:*`
`vcluster:GetStatus`	`krn:celum:supervisor:{name}:vcluster:*`
`vcluster:Install`	`krn:celum:supervisor:{name}:vcluster:*`

vcluster:GetKubeconfig is a credential action — it hands out a working kubeconfig for a hosted control plane. Like the three cluster:Get* credential actions it is excluded from K8sGateOperator and K8sGateViewer and lives in K8sGateSensitiveRead.

virt

KubeVirt and CDI.

Action	Resource (KRN)
`virt:GetStatus`	`krn:celum:supervisor:{name}:virt:*`
`virt:Install`	`krn:celum:supervisor:{name}:virt:*`

virt:GetStatus still reads the snapshot controller’s status, but it no longer installs it: the controller arrives with a storage backend under storage:InstallDriver. A policy that granted virt:Install in order to get volume snapshots onto a supervisor no longer achieves that.

vcenter

vCenters registered once for the platform (Settings → vCenters), whose credentials stay in the secret store.

Action	Resource (KRN)
`vcenter:Create`	`krn:celum:vcenter:*`
`vcenter:Delete`	`krn:celum:vcenter:{name}`
`vcenter:Get`	`krn:celum:vcenter:{name}`
`vcenter:List`	`krn:celum:vcenter:*`
`vcenter:Update`	`krn:celum:vcenter:{name}`
`vcenter:Use`	enforced inside the Cluster API step and Migrations, not by a route

vm

Virtual machine lifecycle and console access.

Action	Resource (KRN)
`vm:AttachVolume`	`krn:celum:supervisor:{name}:vm:{vm}`
`vm:Create`	`krn:celum:supervisor:{name}:vm:*` `krn:celum:supervisor:{name}:vm:{vm}`
`vm:Delete`	`krn:celum:supervisor:{name}:vm:{vm}`
`vm:Eject`	`krn:celum:supervisor:{name}:vm:{vm}`
`vm:Expose`	`krn:celum:supervisor:{name}:vm:*` `krn:celum:supervisor:{name}:vm:{vm}`
`vm:Get`	`krn:celum:supervisor:{name}:vm:{vm}`
`vm:List`	`krn:celum:supervisor:{name}:vm:*`
`vm:Migrate`	`krn:celum:supervisor:{name}:vm:{vm}`
`vm:Move`	`krn:celum:supervisor:{name}:vm:{vm}`
`vm:Restart`	`krn:celum:supervisor:{name}:vm:{vm}`
`vm:Restore`	`krn:celum:supervisor:{name}:vm:{vm}`
`vm:Snapshot`	`krn:celum:supervisor:{name}:vm:{vm}`
`vm:Start`	`krn:celum:supervisor:{name}:vm:{vm}`
`vm:Stop`	`krn:celum:supervisor:{name}:vm:{vm}`
`vm:Update`	`krn:celum:supervisor:{name}:vm:{vm}`
`vm:VncProxy`	`krn:celum:supervisor:{name}:vm:{vm}`

vm:VncProxy grants interactive console access to a running VM — keyboard and screen, with no further authentication. It is included in K8sGateOperator but not in K8sGateViewer.

vm-cloudinit-template

Action	Resource (KRN)
`vm-cloudinit-template:Get`	`krn:celum:vm-cloudinit-template:{name}`
`vm-cloudinit-template:List`	`krn:celum:vm-cloudinit-template:*`

Built-in policies

Policy	Shape
`K8sGateAdmin`	`:` on `krn:celum:*`
`K8sGateOperator`	A broad read statement plus an operate statement covering cluster, VM, Helm and domain mutations — all on `krn:celum:`. It carries no `project:` write verb and no `iam:*`.
`K8sGateViewer`	Read-only actions on `krn:celum:*`, with no credential downloads
`K8sGateSensitiveRead`	The four credential actions — `cluster:GetKubeconfig`, `cluster:GetTalosconfig`, `cluster:GetSshPassword` and `vcluster:GetKubeconfig` — on `krn:celum:*`

These are reconciled at startup and cannot be edited in the UI. To vary them, write a custom policy and attach both.

Permissions model

How actions and KRNs are matched.

Authentication & IAM

Groups, OIDC claim mapping, and the first admin.

​How to read this page

​Wildcards

​Six actions no route carries

​Not on this page

​Actions by service

​ai

​app

​audit-log

​capi

​ceph

​certs

​cilium

​cloud-init-template

​cluster

​cluster-template

​database

​discovery

​dns

​dnsprovider

​domain

​gateway

​helm-release

​iam

​image

​kubeconfig

​license

​migration

​monitoring

​oidc

​platform

​project

​registry

​secrets

​security

​settings

​site

​storage

​supervisor

​sysprep-template

​vcluster

​virt

​vcenter

​vm

​vm-cloudinit-template

​Built-in policies

​Related

Permissions model

Authentication & IAM

How to read this page

Wildcards

Six actions no route carries

Not on this page

Actions by service

ai

app

audit-log

capi

ceph

certs

cilium

cloud-init-template

cluster

cluster-template

database

discovery

dns

dnsprovider

domain

gateway

helm-release

iam

image

kubeconfig

license

migration

monitoring

oidc

platform

project

registry

secrets

security

settings

site

storage

supervisor

sysprep-template

vcluster

virt

vcenter

vm

vm-cloudinit-template

Built-in policies

Related