Group-based permissions with JWT authentication. Control who can execute what, on which resources, on which nodes.
DevOps, Security, and Platform teams need different permissions. A single shared cluster with fine-grained access control.
# Create DevOps group
$ curl -X POST /api/v1.0/groups \
-d '{
"name": "devops",
"permissions": {
"orchestrations": ["can_read", "can_create", "can_execute"],
"vault": ["can_read:app-*"],
"servers": ["can_read", "can_register"],
"files": ["can_upload"]
}
}'
# Security team - limited access
$ curl -X POST /api/v1.0/groups \
-d '{
"name": "security",
"permissions": {
"vault": ["can_read"],
"logs": ["can_query"],
"users": ["can_read"]
}
}'vault:prod-*can_execute_on:prod-serversShort-lived access tokens minimize damage if leaked:
# Login to get tokens
$ curl -X POST /api/v1.0/auth/login \
-d '{
"username": "alice",
"password": "secret"
}'
{
"access_token": "eyJ...valid for 15 min",
"refresh_token": "eyJ...valid for 30 days"
}
# Token automatically validated on every request
$ curl /api/v1.0/orchestrations \
-H "Authorization: Bearer $ACCESS_TOKEN"Users get minimum permissions needed for their job.
All access logged for compliance and forensics.
15-minute access tokens limit exposure window.
JWT tokens, SHA-256 hashed passwords only.