mirror of
https://github.com/coder/coder.git
synced 2026-09-21 12:44:32 +08:00
Samuel Volin
50640063a2
Premium badging and gating consistency as a OSS user, I want to be upsold to premium, and tastefully Summary Standardize all base-Premium full-page gates and the two named inline notices. Admins see an in-app “Learn about Premium” path; non-admins are told to contact their deployment administrator. * DEVEX-732 * updates for premium docs pages for consistency * updates for premium badging and paywall components * updates implemented uses of premium badge and premiumpaywall | Before | After | | --- | ----------- | | <img width="1271" height="564" alt="Screenshot 2026-08-04 at 3 02 32 PM" src="https://github.com/user-attachments/assets/027d4bca-3e34-40b2-ad69-28dbaa4a004b" /> | <img width="1273" height="600" alt="Screenshot 2026-08-04 at 3 26 37 PM" src="https://github.com/user-attachments/assets/321083c0-7a4c-4c7e-a19c-059807018d3b" /> | | Before | After | | --- | ----------- | | <img width="1084" height="672" alt="image" src="https://github.com/user-attachments/assets/741e6bd9-93b0-4ae0-97df-027e8aba5716" /> | <img width="1289" height="622" alt="Screenshot 2026-08-04 at 3 20 07 PM" src="https://github.com/user-attachments/assets/b3a8c169-ca6e-439b-8752-9209131fc097" /> | | Before | After | | --- | ----------- | | <img width="1091" height="865" alt="image (1)" src="https://github.com/user-attachments/assets/f7cd92dd-a975-4db0-bc2a-af092ba783ce" /> | <img width="1268" height="680" alt="Screenshot 2026-08-04 at 3 37 06 PM" src="https://github.com/user-attachments/assets/8af8081a-0ec9-4fd3-921c-470127f2328b" /> |
99 lines
4.5 KiB
Markdown
99 lines
4.5 KiB
Markdown
# Groups and Roles (Premium)
|
|
|
|
Groups and roles can be manually assigned in Coder. For production deployments,
|
|
these can also be [managed and synced by the identity provider](./idp-sync.md).
|
|
|
|
## Groups
|
|
|
|
> [!NOTE]
|
|
> Groups require a
|
|
> [Premium license](https://coder.com/pricing#compare-plans).
|
|
> For more details, [contact your account team](https://coder.com/contact).
|
|
|
|
Groups are logical segmentations of users in Coder and can be used to control
|
|
which templates developers can use. For example:
|
|
|
|
- Users within the `devops` group can access the `AWS-VM` template
|
|
- Users within the `data-science` group can access the `Jupyter-Kubernetes`
|
|
template
|
|
|
|
## Roles
|
|
|
|
Roles determine which actions users can take within the platform.
|
|
|
|
| | Auditor | User Admin | Template Admin | Owner |
|
|
|-----------------------------------------------------------------|---------|------------|----------------|-------|
|
|
| Add and remove Users | | ✅ | | ✅ |
|
|
| Manage groups (premium) | | ✅ | | ✅ |
|
|
| Change User roles | | | | ✅ |
|
|
| Manage **ALL** Templates | | | ✅ | ✅ |
|
|
| View **ALL** Workspaces | | | ✅ | ✅ |
|
|
| Update and delete **ALL** Workspaces | | | | ✅ |
|
|
| Run [external provisioners](../provisioners/index.md) | | | ✅ | ✅ |
|
|
| Execute and use **ALL** Workspaces | | | | ✅ |
|
|
| View all user operation [Audit Logs](../security/audit-logs.md) | ✅ | | | ✅ |
|
|
|
|
A user may have one or more roles. All users have an implicit Member role that
|
|
may use personal workspaces.
|
|
|
|
Whether organization members can create and use workspaces is controlled per
|
|
organization through its default member roles. See
|
|
[Default member roles](./organizations.md#default-member-roles) for how to
|
|
remove workspace operations from the default member set.
|
|
|
|
## Custom Roles
|
|
|
|
> [!NOTE]
|
|
> Custom roles are a Premium feature.
|
|
> [Learn more](https://coder.com/pricing#compare-plans).
|
|
|
|
Starting in v2.16.0, Premium Coder deployments can configure custom roles on the
|
|
[Organization](./organizations.md) level. You can create and assign custom roles
|
|
in the dashboard under **Organizations** -> **My Organization** -> **Roles**.
|
|
|
|
|
|
|
|
### Example roles
|
|
|
|
- The `Banking Compliance Auditor` custom role cannot create workspaces, but can
|
|
read template source code and view audit logs
|
|
- The `Organization Lead` role can access user workspaces for troubleshooting
|
|
purposes, but cannot edit templates
|
|
- The `Platform Member` role cannot edit or create workspaces as they are
|
|
created via a third-party system
|
|
|
|
Custom roles can also be applied to
|
|
[headless user accounts](./headless-auth.md):
|
|
|
|
- A `Health Check` role can view deployment status but cannot create workspaces,
|
|
manage templates, or view users
|
|
- A `CI` role can update manage templates but cannot create workspaces or view
|
|
users
|
|
|
|
### Creating custom roles
|
|
|
|
Clicking "Create custom role" opens a UI to select the desired permissions for a
|
|
given persona.
|
|
|
|
|
|
|
|
From there, you can assign the custom role to any user in the organization under
|
|
the **Users** settings in the dashboard.
|
|
|
|
|
|
|
|
Note that these permissions only apply to the scope of an
|
|
[organization](./organizations.md), not across the deployment.
|
|
|
|
### Security notes
|
|
|
|
A malicious Template Admin could write a template that executes commands on the
|
|
host (or `coder server` container), which potentially escalates their privileges
|
|
or shuts down the Coder server. To avoid this, run
|
|
[external provisioners](../provisioners/index.md).
|
|
|
|
In low-trust environments, we do not recommend giving users direct access to
|
|
edit templates. Instead, use
|
|
[CI/CD pipelines to update templates](../templates/managing-templates/change-management.md)
|
|
with proper security scans and code reviews in place.
|