Open in Claude Open in Claude Ask questions about this page Open in ChatGPT Ask questions about this page Copy page Copy page as Markdown for LLMs View as Markdown View this page as plain text

Manage users, roles, and policies for your Union cluster.

User management

Union includes role-based access control (RBAC) for managing user and application permissions. The system has four core concepts:

  • Role: A named set of actions (e.g. view inventory, create executions).
  • Policy: Binds one or more roles to specific projects, domains, or the entire organization.
  • User / Application: An actor assigned to policies. Users are identified by email; applications by ID.
  • Action: An operation like view_flyte_inventory, create_flyte_executions or register_flyte_inventory. See Available actions.

Built-in policies

Union ships with three built-in policies:

Policy Actions Summary
Admin All actions Full control including user management and billing
Contributor create_flyte_executions, register_flyte_inventory, view_flyte_executions, view_flyte_inventory, edit_execution_related_attributes, edit_cluster_related_attributes, view_llm_gateway, manage_llm_gateway_keys, view_secrets, manage_secrets, view_apps, manage_apps, view_triggers, manage_triggers, view_workspaces, manage_workspaces, view_artifacts, manage_artifacts, view_settings, edit_settings, manage_api_keys, view_clusters, view_usage, view_identities Register and run workflows
Viewer view_flyte_executions, view_flyte_inventory, view_llm_gateway, view_apps, view_triggers, view_workspaces, view_artifacts, view_settings, view_clusters, view_usage, view_identities Read-only access

Built-in policies are managed by Union. Custom roles only hold the actions you give them.

Users can hold multiple policies: permissions are the union of all assigned policies.

Custom roles and policies

For fine-grained control, create custom roles and policies using the CLI or programmatically.

Prerequisites

Install the Union CLI plugin:

pip install 'flyteplugins-union>=0.20.2'

This adds role, policy, assignment, user, and member subcommands to the flyte CLI.

Use flyteplugins-union 0.20.2 or later. With flyte 2.12.2 or later, earlier versions fail to import and the flyte CLI drops their subcommands. Versions before 0.20.1 also don’t support the actions listed after the table in Available actions (all except view_identities), which the built-in policies hold. On a role that holds one, Role.actions and flyte update role fail, and Role.update silently removes those actions.

Walkthrough: restrict a team to run workflows in production only

The goal: create a role that can view and execute workflows but not register new ones, bind it to the production domain of a specific project, and assign it to a user.

ProgrammaticCLI 
from flyteplugins.union.remote import Role, Policy, Assignment

# Step 1 — Create the role
Role.create(
    "Production Runner",
    description="Can view and execute workflows",
    actions=[
        "view_flyte_inventory",
        "view_flyte_executions",
        "create_flyte_executions",
    ],
)

# Step 2 — Create the policy
Policy.create(
    "Team Prod Access",
    description="Production execution access for the team",
    bindings=[
        {
            "role": "Production Runner",
            "resource": {
                "project": "my-project",
                "domain": "production",
            },
        },
    ],
)

# Step 3 — Assign the policy to a user
Assignment.create(email="[email protected]", policy="Team Prod Access")

Step 1: Create the role

Use --edit to open an interactive editor (no YAML file needed):

flyte create role "Production Runner" --edit

Your $EDITOR opens with a template. Set the actions:

name: Production Runner
description: Can view and execute workflows
actions:
  - view_flyte_inventory
  - view_flyte_executions
  - create_flyte_executions

Save and close. The role is created.

Step 2: Create the policy

flyte create policy "Team Prod Access" --edit

Bind the role to a specific project and domain:

name: Team Prod Access
description: Production execution access for the team
bindings:
  - role: Production Runner
    resource:
      project: my-project
      domain: production

Step 3: Assign the policy to a user

flyte create assignment --email [email protected] --policy "Team Prod Access"

You can also assign by user subject or application credentials subject:

flyte create assignment --user-subject user-123 --policy "Team Prod Access"
flyte create assignment --creds-subject app-456 --policy "Team Prod Access"

Updating roles and policies

ProgrammaticCLI 
from flyteplugins.union.remote import Role, Policy

# Add an action to an existing role
Role.update(
    "Production Runner",
    actions=[
        "view_flyte_inventory",
        "view_flyte_executions",
        "create_flyte_executions",
        "register_flyte_inventory",  # newly added
    ],
)

# Update policy bindings
policy = Policy.get("Team Prod Access")
new_bindings = policy.bindings + [
    {
        "role": "Production Runner",
        "resource": {"project": "my-project", "domain": "staging"},
    },
]
Policy.update("Team Prod Access", old_bindings=policy.bindings, new_bindings=new_bindings)

update opens the existing definition in your editor so you can modify it in place:

flyte update role "Production Runner"
flyte update policy "Team Prod Access"

Managing users in the UI

Navigate to Settings > User Management to:

  • View users: see all users and their assigned policies.
  • Add a user: specify name, email, and policies. The user receives an email invite.
  • Change policies: select a user and edit their assignments.
  • Remove a user: select a user and remove them.

Available actions

Action Description
administer_project Archive/update projects, manage customizable resources
manage_permissions View and edit roles and policies, and manage users, applications, and policy assignments
create_flyte_executions Launch runs and upload inputs
register_flyte_inventory Register and deploy workflows, tasks, and launch plans
view_flyte_executions View runs and actions
view_flyte_inventory View registered workflows, tasks, and launch plans
administer_account Manage billing and account-wide settings
manage_cluster Manage clusters
manage_queue Manage cluster queues
view_cluster_config View the component configuration of a cluster
edit_execution_related_attributes Edit execution-related attributes (task resources, workflow execution config, external resources)
edit_cluster_related_attributes Edit cluster-related attributes (cluster resources, cluster assignment)
edit_unused_attributes Edit execution queue, execution cluster label, quality of service, and plugin override attributes
support_system_logs View system logs
view_llm_gateway View the inference gateway, its providers, guardrails, and virtual keys (without their values)
manage_llm_gateway Deploy and delete the inference gateway, and manage its upstream providers and guardrails
manage_llm_gateway_keys Issue, revoke, and view inference gateway virtual keys, and view inference gateway usage

Roles also accept the following actions, but no Union service checks them, so granting one has no effect: view_secrets, manage_secrets, view_apps, manage_apps, view_triggers, manage_triggers, view_workspaces, manage_workspaces, view_artifacts, manage_artifacts, view_settings, edit_settings, manage_api_keys, view_clusters, view_permissions, view_usage, view_identities. A role that holds create_flyte_executions can list, get, create, update, and delete secrets at the scope it’s bound to. Viewing triggers requires view_flyte_inventory. Creating, activating, deactivating, and deleting triggers requires register_flyte_inventory.

CLI command reference

Command Description
flyte create role <name> --edit | --file <path> Create a role interactively or from YAML
flyte get role [<name>] List all roles or view a specific one
flyte update role <name> Edit a role in $EDITOR
flyte delete role <name> Delete a role
flyte create policy <name> --edit | --file <path> Create a policy interactively or from YAML
flyte get policy [<name>] List all policies or view a specific one
flyte update policy <name> Edit a policy in $EDITOR
flyte delete policy <name> Delete a policy
flyte create assignment --email <email> | --user-subject <id> | --creds-subject <id> --policy <name> Assign a policy to a user or application
flyte get assignment [--user-subject <id> | --creds-subject <id>] View the policies assigned to a user or application
flyte delete assignment --user-subject <id> | --creds-subject <id> --policy <name> Unassign a policy from a user or application
flyte get user [<subject>] List all users or view a specific one
flyte delete user <subject> Delete a user
flyte get member List all members (users and applications)
Docs: unionai/unionai-docs 2.13.2.0SDK: flyteorg/flyte-sdk 2.13.2 flyteplugins-union 0.20.2