Roles and permissions

These are the built-in roles for the Registry service. Each row lists a role, what it grants, and the exact permissions it includes. Roles are system-defined (built-in) or custom; permissions are system-defined and read-only. The platform-wide Viewer, Editor, and Admin roles also apply across every service; see the roles and permissions catalogue. You can also compose a custom role from any of these permissions.

Role	Included permissions
Registry Viewer Read-only access to all registry resources	registry.accesspolicy.get registry.accesspolicy.list registry.artifact.get registry.artifact.list registry.auditlog.list registry.credential.get registry.crossnamespacegrant.get registry.crossnamespacegrant.list registry.deploymentlock.get registry.deploymentlock.list registry.namespace.get registry.namespace.list registry.operation.get registry.operation.list registry.repository.get registry.repository.list registry.retentionpolicy.get registry.retentionpolicy.list registry.scan.get registry.scanpolicy.get registry.scanpolicy.list
Registry Editor Read and write access to all registry resources	registry.accesspolicy.create registry.accesspolicy.get registry.accesspolicy.list registry.accesspolicy.update registry.artifact.get registry.artifact.list registry.auditlog.list registry.credential.get registry.crossnamespacegrant.create registry.crossnamespacegrant.get registry.crossnamespacegrant.list registry.crossnamespacegrant.update registry.deploymentlock.create registry.deploymentlock.get registry.deploymentlock.list registry.deploymentlock.update registry.namespace.create registry.namespace.get registry.namespace.list registry.namespace.update registry.operation.get registry.operation.list registry.repository.create registry.repository.get registry.repository.list registry.repository.update registry.retentionpolicy.create registry.retentionpolicy.get registry.retentionpolicy.list registry.retentionpolicy.update registry.scan.get registry.scan.trigger registry.scanpolicy.create registry.scanpolicy.get registry.scanpolicy.list registry.scanpolicy.update
Registry Admin Full access to all registry resources	registry.accesspolicy.create registry.accesspolicy.delete registry.accesspolicy.get registry.accesspolicy.list registry.accesspolicy.update registry.artifact.delete registry.artifact.get registry.artifact.list registry.auditlog.list registry.credential.get registry.crossnamespacegrant.create registry.crossnamespacegrant.delete registry.crossnamespacegrant.get registry.crossnamespacegrant.list registry.crossnamespacegrant.update registry.deploymentlock.create registry.deploymentlock.delete registry.deploymentlock.get registry.deploymentlock.list registry.deploymentlock.update registry.namespace.create registry.namespace.delete registry.namespace.get registry.namespace.list registry.namespace.update registry.operation.get registry.operation.list registry.repository.create registry.repository.delete registry.repository.get registry.repository.list registry.repository.update registry.retentionpolicy.create registry.retentionpolicy.delete registry.retentionpolicy.get registry.retentionpolicy.list registry.retentionpolicy.update registry.scan.get registry.scan.trigger registry.scanpolicy.create registry.scanpolicy.delete registry.scanpolicy.get registry.scanpolicy.list registry.scanpolicy.update registry.tag.delete
Namespace Viewer View namespaces	registry.credential.get registry.namespace.get registry.namespace.list registry.operation.get registry.operation.list
Namespace Editor View and manage namespaces	registry.credential.get registry.namespace.create registry.namespace.get registry.namespace.list registry.namespace.update registry.operation.get registry.operation.list
Namespace Admin Full access to namespaces	registry.credential.get registry.namespace.create registry.namespace.delete registry.namespace.get registry.namespace.list registry.namespace.update registry.operation.get registry.operation.list
Repository Viewer View repositories	registry.repository.get registry.repository.list
Repository Editor View and manage repositories	registry.repository.create registry.repository.get registry.repository.list registry.repository.update
Repository Admin Full access to repositories	registry.repository.create registry.repository.delete registry.repository.get registry.repository.list registry.repository.update
Artifact Viewer View artifacts	registry.artifact.get registry.artifact.list
Artifact Editor View artifacts	registry.artifact.get registry.artifact.list
Artifact Admin Full access to artifacts	registry.artifact.delete registry.artifact.get registry.artifact.list
Tag Admin Detag artifacts (registry.tag.delete)	registry.tag.delete
Scan Viewer Read vulnerability scan reports	registry.scan.get
Scan Editor Read scan reports and trigger scans	registry.scan.get registry.scan.trigger
Scan Admin Read scan reports and trigger scans	registry.scan.get registry.scan.trigger

Related

• Registry overview
• The authorization model
• Roles and permissions catalogue