Manage user roles and privileges via Milvus Manager - Vector Retrieval Service for Milvus

Milvus Manager uses a comprehensive role-based access control (RBAC) system to ensure only authorized users access specific resources. This topic explains how to manage users, roles, and permission groups within the platform.

User management

Add a user

On the Users and Roles page, go to the Users tab and click + User. Configure the following parameters in the dialog box:

Parameter	Description
Username	Usernames must be 1 to 32 characters long, start with a letter, and contain only letters, numbers, and underscores.
Password	The password must be 6 to 32 characters long and include uppercase letters, lowercase letters, numbers, and special characters (@#$%^*_+-).
Role	Assign an existing built-in role or custom role to the new user.

User operations

In the user list, you can perform the following operations on a user:

Associate RAM Identity: Associate an Alibaba Cloud RAM user to manage external collections. The system then uses this RAM identity for DLF permission checks.
Change Password: You must verify the current password to change it.
Edit Role: Assign roles to the user.
Delete: Delete the user.

Note
The built-in root user cannot be deleted. An admin user with the required permissions can delete custom users.

Role management

Built-in roles

Role name	Description
admin	The administrative role that has all permissions.
public	The default role assigned to all users, providing basic access permissions.

Create a custom role

If the built-in roles do not meet your specific permission management requirements, you can create a custom role:

On the role management page, click + Role.
Enter a role name, select permission groups or individual permissions, and click Create.

Supported resources and permissions:

Resource level	Available permissions
Cluster	ReadOnly, ReadWrite, Admin
Database	ReadOnly, ReadWrite, Admin
Collection	ReadOnly (includes 14 permissions such as Query, Search, and IndexDetail), ReadWrite (includes Insert, Delete, Upsert, and more), Admin (includes Load, Release, Flush, and more)

Edit and delete roles

Built-in roles cannot be edited or deleted.
Custom roles can be edited, granted, and deleted by an admin with the required permissions.

Permission system

The permission system of Milvus Manager is built on the native Milvus RBAC mechanism. For external collections, it integrates with the Alibaba Cloud RAM identity system to provide dual access control.

Permission model

Milvus permissions are organized into three levels:

Level	Description
Cluster	Permissions that affect the entire instance, such as system configuration and global monitoring.
Database	Permissions that affect a specific database, such as creating or deleting databases and managing collections within a database.
Collection	Permissions that affect a specific collection, such as data read/write, index management, and load/release operations.

Built-in permission groups

Milvus Manager provides nine built-in permission groups across three levels:

Level	Permission group	Included permissions overview
Cluster	ClusterReadOnly	Global read-only access, including monitoring and metadata viewing.
Cluster	ClusterReadWrite	Global read and write access, including data operations and index management.
Cluster	ClusterAdmin	Global admin access, including user management and role management.
Database	DatabaseReadOnly	Database-level read-only access.
Database	DatabaseReadWrite	Database-level read and write access.
Database	DatabaseAdmin	Database-level admin access.
Collection	CollectionReadOnly	Includes 14 permissions such as Query, Search, and IndexDetail.
Collection	CollectionReadWrite	Includes Insert, Delete, Upsert, and more.
Collection	CollectionAdmin	Includes Load, Release, Flush, and more.

Custom permission groups

In addition to the built-in permission groups, Milvus Manager supports creating custom permission groups for fine-grained access control.

Create a permission group:

On the user and role management page, click the Permission Groups tab.
Click + Permission Group.
Configure the following parameters in the dialog box:
- Permission Group Name: The name of the custom permission group.
- Permissions: Select the specific permissions to include in the permission group.

Important

A permission group can only contain permissions from the same level. Cross-level permission mixing is not supported.

Use permission groups: After you create a custom permission group, you can select it when granting permissions to a role. This allows you to grant a set of related permissions in bulk and simplifies permission management.