Privileges and Roles

To perform specific operations, you require privileges associated with the specific role. VMware Telco Cloud Automation includes a set of system-defined roles and associated privileges. You cannot edit or delete them.

Note: The roles and permissions are migrated automatically to TCA 3.0 with the enhanced permission model applied to the existing roles. Also, the attribute filters are retained during migration. Due to the enhanced permission model in TCA 3.0, which includes resource ownership and parent-child relations, a few additional objects are available as read-only.

System-defined Privileges

The following tables list the system-defined privileges:

Table 1. CaaS Privileges

Privilege	Included Privilege(s)	Accessible Objects
Cluster Create - Create privileges for Cluster		K8s Cluster Instance K8s Cluster Template
Cluster Modify - Modify privileges for Cluster	Cluster Read	K8s Cluster Instance
Cluster Read - Read privileges for Cluster		K8s Cluster Instance
Cluster Template Create - Create privileges for Cluster Template		K8s Cluster Template
Cluster Template Modify - Modify privileges for Cluster Template	Cluster Template Read	K8s Cluster Template
Cluster Template Read - Read privileges for Cluster Template		K8s Cluster Template
Cluster Template Use - Use privileges for Cluster Template	Cluster Template Read	K8s Cluster Template
Cluster Use - Use privileges for Cluster	Cluster Read	K8s Cluster Instance
Infrastructure Design - Design privileges for caas cluster templates		K8s Cluster Template
Infrastructure Lifecycle Management - Lifecycle management privileges for caas cluster instance	Infrastructure Design	K8s Cluster Instance K8s Cluster Template

Table 2. Virtual Infrastructure Privileges

Privilege	Included Privileges	Accessible Objects
Namespace Modify - Modify Kubernetes namespace		K8s Cluster Namespace
Virtual Infrastructure Admin - Administration privileges for infrastructures	Virtual Infrastructure Audit Virtual Infrastructure Consume Virtual Infrastructure Read	K8s Cluster Namespace Virtual Infrastructure Vcenter Datastore Vcenter Network Vcenter Resource Pool
Virtual Infrastructure Audit - Audit privileges for infrastructures	Virtual Infrastructure Read	Virtual Infrastructure
Virtual Infrastructure Consume - Deploy privileges for Vim	Virtual Infrastructure Read	K8s Cluster Namespace Virtual Infrastructure Vcenter Datastore Vcenter Network Vcenter Resource Pool
Virtual Infrastructure Create - Create privileges for infrastructures		Virtual Infrastructure
Virtual Infrastructure Read - Read privileges for infrastructures		Virtual Infrastructure

Table 3. Network Function Catalog Privileges

Privilege	Included Privileges	Accessible Objects
Network Function Draft Create - Network Function Draft Create privilege.		Network Function Draft
Network Function Draft Modify - Design privileges for Network Function Draft	Network Function Draft Read	Network Function Draft
Network Function Draft Read - Network Function Draft Read privilege		Network Function Draft
Network Function Catalog Instantiate - Instantiation privileges for Network Function Catalog		Network Function Catalog Network Function Instance
Network Function Package Modify - Network Function Package Modify privilege	Network Function Package Read	Network Function Catalog
Network Function Package Onboard - Network Function Package Onboard privilege		Network Function Catalog Network Function Draft
Network Function Package Read - Network Function Package Read privilege		Network Function Catalog
Network Function Package Use - Network Function Package Use privilege	Network Function Package Read	Network Function Catalog

Table 4. Network Function Instance Privileges

Privilege	Included Privileges	Accessible Objects
Network Function Instance Lifecycle Management - Lifecycle management privileges for Network Function Instance	Network Function Instance Read	Network Function Instance
Network Function Instance Lifecycle Management - Lifecycle management privileges for Network Function Instance.		Network Function Instance
Network Function Instance Use - Use privileges for Network Function Instance	Network Function Instance Read	Network Function Instance

Table 5. Network Service Catalog Privileges

Privilege	Included Privileges	Accessible Objects
Network Service Catalog Design - Design privileges for Network Service Catalog		Network Service Draft
Network Service Draft Modify - Network Service Draft Modify Privilege	Network Service Draft Read	Network Service Draft
Network Service Draft Read - Network Service Draft Read privilege		Network Service Draft
Network Service Catalog Instantiate - Instantiation privileges for Network Service Catalog		Network Service Catalog Network Service Instanc
Network Service Package Modify - Network Service Package Modify privilege	Network Service Package Read	Network Service Catalog
Network Service Package Onboard - Network Service Package Onboarding privilege		Network Service Catalog Network Service Draft
Network Service Package Read - Network Service Package Read privilege		Network Service Catalog
Network Service Package Use - Network Service Package Read privilege	Network Service Package Read	Network Service Catalog

Table 6. Network Service Instance Privileges

Privilege	Included Privileges	Accessible Objects
Network Service Instance Lifecycle Management - Lifecycle Management privileges for Network Service Instance	Network Service Instance Read	Network Service Instance
Network Service Instance Read - Read privileges for Network Service Instance		Network Service Instance
Network Service Instance Use - Use privileges for Network Service Instance	Network Service Instance Read	Network Service Instance

Table 7. Partner System Privileges

Privilege	Included Privileges	Accessible Objects
Partner System Create - Create privileges for partner systems		Partner System
Partner System Modify - Modify privileges for partner systems	Partner System Read	Partner System
Partner System Read - Read privileges for partner systems		Partner System

Table 8. Subscription Privileges

Privilege	Included Privileges	Accessible Objects
Subscription Create - Create privileges for Subscription		Subscription
Subscription Delete - Delete privileges for Subscription		Subscription
Subscription Read - Read privileges for Subscription		Subscription

Table 9. Workflow Privileges

Privilege	Included Privileges	Accessible Objects
Workflow Design - Design privileges for Workflow		Workflow
Workflow Execute - Execute privileges for Workflow		Workflow
Workflow Execution Modify - Modify privileges for Workflow Executio	Workflow Execution Read	Workflow Execution
Workflow Modify - Modify privileges for Workflow	Workflow Read	Workflow
Workflow Read - Read privileges for Workflow		Workflow

Table 10. Workflow Hub Privileges

Privilege	Included Privileges	Accessible Objects
Workflow Hub Certificate Authority Read - Read privileges for CA certificates		Workflow Hub Certificate Authority
Workflow Hub Certificate Authority Write - Add/Delete privileges for CA certificates	Workflow Hub Certificate Authority Read	Workflow Hub Certificate Authority
Workflow Hub Configuration Read - Read privileges for Workflow Hub configuration		Workflow Hub Configuration
Workflow Hub Configuration Write - Modify privileges for Workflow Hub configuration	Workflow Hub Configuration Read	Workflow Hub Configuration
Workflow Hub Openapi Schema Read - Read privileges for openapi schemas		Workflow Hub Openapi Schema
Workflow Hub Openapi Schema Write - Create/Modify/Delete privileges for openapi schemas	Workflow Hub Openapi Schema Read	Workflow Hub Openapi Schema
Workflow Hub Schedule Read - Read privileges for schedules		Workflow Hub Schedule
Workflow Hub Schedule Write - Create/Modify/Delete privileges for schedules	Workflow Hub Schedule Read Workflow Hub Workflow Read	Workflow Hub Schedule Workflow Hub Workflow
Workflow Hub Secret Manager Read - Read privileges for secret manager		Workflow Hub Secret Manager
Workflow Hub Secret Manager Write - Create/Modify/Delete privileges for secret manager	Workflow Hub Secret Manager Read	Workflow Hub Secret Manager
Workflow Hub Workflow Read - Read privileges for workflows		Workflow Hub Workflow
Workflow Hub Workflow Run Read - Read privileges for workflow runs		Workflow Hub Workflow Run
Workflow Hub Workflow Run Statistics Read - Read privileges for workflow run statistics		Workflow Hub Workflow Run Statistics

Table 11. Tenant-wide Privileges

Privilege	Included Privileges	Accessible Objects
Alarm Read - Alarm read		Alarm
Audit Log Read - Read privileges for tenant audit logs
Role Admin - Administration privileges for all roles operations	Role Audit
Role Audit - Read privileges for all roles operations
Tag Admin - Admin privileges for tag management
Tenant Audit - Tenant audit privilege	Alarm Read Audit Log Read Cluster Read Cluster Template Read Network Function Draft Read Network Function Package Read Network Service Draft Read Network Service Package Read Subscription Read Virtual Infrastructure Audit Virtual Infrastructure Read Workflow Hub Certificate Authority Read Workflow Hub Openapi Schema Read Workflow Hub Schedule Read Workflow Hub Secret Manager Read Workflow Hub Workflow Read Workflow Hub Workflow Run Read Workflow Hub Workflow Run Statistics Read Workflow Read	Alarm K8s Cluster Instance K8s Cluster Template Network Function Catalog Network Function Draft Network Service Catalog Network Service Draft Network Service Instance Subscription Virtual Infrastructure Workflow Workflow Hub Certificate Authority Workflow Hub Openapi Schema Workflow Hub Schedule Workflow Hub Secret Manager Workflow Hub Workflow Workflow Hub Workflow Run Workflow Hub Workflow Run Statistics

System-wide Privileges

The following table lists the system-defined roles.

Privilege	Included Privileges	Accessible Objects
System Admin - Administration privileges for all operations	Alarm Read Audit Log Read Cluster Create Cluster Modify Cluster Read Cluster Template Create Cluster Template Modify Cluster Template Read Cluster Template Use Cluster Use Infrastructure Design Infrastructure Lifecycle Management Namespace Modify Network Function Catalog Instantiate Network Function Draft Create Network Function Draft Modify Network Function Draft Read Network Function Instance Lifecycle Management Network Function Instance Read Network Function Instance Use Network Function Package Modify Network Function Package Onboard Network Function Package Read Network Function Package Use Network Service Catalog Instantiate Network Service Draft Create Network Service Draft Modify Network Service Draft Read Network Service Instance Lifecycle Management Network Service Instance Read Network Service Instance Use Network Service Package Modify Network Service Package Onboard Network Service Package Read Network Service Package Use Partner System Create Partner System Modify Partner System Read Role Admin Role Audit Subscription Create Subscription Delete Subscription Read System Audit Tag Admin Tcf Admin Tenant Audit Vim Policy Admin Virtual Infrastructure Admin Virtual Infrastructure Audit Virtual Infrastructure Consume Virtual Infrastructure Create Virtual Infrastructure Read Workflow Design Workflow Execute Workflow Execution Modify Workflow Execution Read Workflow Hub Certificate Authority Read Workflow Hub Certificate Authority Write Workflow Hub Configuration Read Workflow Hub Configuration Write Workflow Hub Openapi Schema Read Workflow Hub Openapi Schema Write Workflow Hub Schedule Read Workflow Hub Schedule Write Workflow Hub Secret Manager Read Workflow Hub Secret Manager Write Workflow Hub Workflow Read Workflow Hub Workflow Run Read Workflow Hub Workflow Run Statistics Read Workflow Hub Workflow Run Write Workflow Hub Workflow Write Workflow Modify Workflow Read	Alarm K8s Cluster Instance K8s Cluster Namespace K8s Cluster Template Network Function Catalog Network Function Draft Network Function Instance Network Service Catalog Network Service Draft Network Service Instance Partner System Subscription Virtual Infrastructure Workflow Workflow Execution Workflow Hub Certificate Authority Workflow Hub Configuration Workflow Hub Openapi Schema Workflow Hub Schedule Workflow Hub Secret Manager Workflow Hub Workflow Workflow Hub Workflow Run Workflow Hub Workflow Run Statistics Vcenter Datastore Vcenter Network Vcenter Resource Pool
System Audit - Read privileges for all operations	Alarm Read Audit Log Read Cluster Read Cluster Template Read Network Function Draft Read Network Function Instance Read Network Function Package Read Network Service Draft Read Network Service Instance Read Network Service Package Read Subscription Read Tenant Audit Virtual Infrastructure Audit Virtual Infrastructure Read Workflow Hub Certificate Authority Read Workflow Hub Configuration Read Workflow Hub Openapi Schema Read Workflow Hub Schedule Read Workflow Hub Secret Manager Read Workflow Hub Workflow Read Workflow Hub Workflow Run Read Workflow Hub Workflow Run Statistics Read Workflow Read	Alarm K8s Cluster Instance Network Function Catalog Network Function Draft Network Function Instance Network Service Catalog Network Service Draft Network Service Instance Subscription Virtual Infrastructure Workflow Workflow Hub Certificate Authority Workflow Hub Configuration Workflow Hub Openapi Schema Workflow Hub Schedule Workflow Hub Secret Manager Workflow Hub Workflow Workflow Hub Workflow Run Workflow Hub Workflow Run Statistics
Tcf Admin - Administration privileges for Infrastructure Administrator	Virtual Infrastructure Consume Virtual Infrastructure Read	K8s Cluster Namespace Virtual Infrastructure Vcenter Datastore Vcenter Network Vcenter Resource Pool

Table 12. System-defined Roles

Role	Description	Privilege
Network Function Deployer	The users assigned to this role can perform all network function actions related to LCM operations such as Instantiate, Scale, Heal, and other actions available for a network function instance.	Network Function Catalog Instantiate Network Function Instance Lifecycle Management Network Function Instance Read Network Function Package Read Network Function Package Use Virtual Infrastructure Consume Virtual Infrastructure Read Workflow Execute Workflow Read
Network Function Designer	The users assigned to this role can perform all network function actions such as designing, uploading, and managing the network function catalogs.	Network Function Draft Create Network Function Draft Modify Network Function Draft Read Network Function Package Modify Network Function Package Onboard Network Function Package Read Workflow Design Workflow Read
Network Service Deployer	The users assigned to this role can perform all network service actions related to LCM operations such as Instantiate, Scale, Heal, and other actions available on a network service instance.	Network Function Catalog Instantiate Network Function Instance Lifecycle Management Network Function Instance Read Network Function Instance Use Network Function Package Read Network Function Package Use Network Service Catalog Instantiate Network Service Instance Lifecycle Management Network Service Instance Read Network Service Instance Use Network Service Package Read Network Service Package Use Virtual Infrastructure Consume Virtual Infrastructure Read Workflow Execute Workflow Read
Network Service Designer	The users assigned to this role can perform all network service actions like designing, uploading, and managing network service catalogs.	Network Function Package Read Network Service Draft Create Network Service Draft Modify Network Service Draft Read Network Service Package Modify Network Service Package Onboard Network Service Package Read Workflow Design Workflow Read
Partner System Administrator	The users assigned to this role can perform all partner-systems-related actions for VMware Telco Cloud Platform.	Partner System Create Partner System Modify Partner System Read Virtual Infrastructure Consume Virtual Infrastructure Read
Partner System Read Only	The users assigned to this role can view all partner system entities for VMware Telco Cloud Platform.	Partner System Read
Role Administrator	The users assigned to this role can perform all object-access-control-related actions for the Telco Cloud Platform.	Role Admin Role Audit Tag Admin
Role Auditor	The users assigned to this role can view all object access control related roles and permissions for VMware Telco Cloud Platform.	Role Audit
System Administrator	The users assigned to this role can perform all available actions for the VMware Telco Cloud Platform.	Alarm Read Audit Log Read Cluster Create Cluster Modify Cluster Read Cluster Template Create Cluster Template Modify Cluster Template Read Cluster Template Use Cluster Use Infrastructure Design Infrastructure Lifecycle Management Namespace Modify Network Function Catalog Instantiate Network Function Draft Create Network Function Draft Modify Network Function Draft Read Network Function Instance Lifecycle Management Network Function Instance Read Network Function Instance Use Network Function Package Modify Network Function Package Onboard Network Function Package Read Network Function Package Use Network Service Catalog Instantiate Network Service Draft Create Network Service Draft Modify Network Service Draft Read Network Service Instance Lifecycle Management Network Service Instance Read Network Service Instance Use Network Service Package Modify Network Service Package Onboard Network Service Package Read Network Service Package Use Partner System Create Partner System Modify Partner System Read Role Admin Role Audit Subscription Create Subscription Delete Subscription Read System Admin System Audit Tag Admin Tcf Admin Tenant Audit Vim Policy Admin Virtual Infrastructure Admin Virtual Infrastructure Audit Virtual Infrastructure Consume Virtual Infrastructure Create Virtual Infrastructure Read Workflow Design Workflow Execute Workflow Execution Modify Workflow Execution Read Workflow Hub Certificate Authority Read Workflow Hub Certificate Authority Write Workflow Hub Configuration Read Workflow Hub Configuration Write Workflow Hub Openapi Schema Read Workflow Hub Openapi Schema Write Workflow Hub Schedule Read Workflow Hub Schedule Write Workflow Hub Secret Manager Read Workflow Hub Secret Manager Write Workflow Hub Workflow Read Workflow Hub Workflow Run Read Workflow Hub Workflow Run Statistics Read Workflow Hub Workflow Run Write Workflow Hub Workflow Write Workflow Modify Workflow Read
System Auditor	The users assigned to this role can view all entities in the VMware Telco Cloud Platform.	Alarm Read Audit Log Read Cluster Read Cluster Template Read Network Function Draft Read Network Function Instance Read Network Function Package Read Network Service Draft Read Network Service Instance Read Network Service Package Read Subscription Read System Audit Tenant Audit Virtual Infrastructure Audit Virtual Infrastructure Read Workflow Hub Certificate Authority Read Workflow Hub Configuration Read Workflow Hub Secret Manager Read Workflow Hub Workflow Read Workflow Hub Workflow Run Read Workflow Hub Workflow Run Statistics Read Workflow Read
Tcf Administrator	The users assigned to this role can perform all the available actions in the VMware Telco Cloud Platform.	Tcf Admin Virtual Infrastructure Consume Virtual Infrastructure Read
Tenant Administrator	The users assigned to this role can perform all available actions for the tenant.	Alarm Read Audit Log Read Cluster Create Cluster Modify Cluster Read Cluster Template Create Cluster Template Modify Cluster Template Read Cluster Template Use Cluster Use Infrastructure Design Infrastructure Lifecycle Management Namespace Modify Network Function Catalog Instantiate Network Function Draft Create Network Function Draft Modify Network Function Draft Read Network Function Instance Lifecycle Management Network Function Instance Read Network Function Instance Use Network Function Package Modify Network Function Package Onboard Network Function Package Read Network Function Package Use Network Service Catalog Instantiate Network Service Draft Create Network Service Draft Modify Network Service Draft Read Network Service Instance Lifecycle Management Network Service Instance Read Network Service Instance Use Network Service Package Modify Network Service Package Onboard Network Service Package Read Network Service Package Use Partner System Create Partner System Modify Partner System Read Role Admin Role Audit Subscription Create Subscription Delete Subscription Read Tag Admin Tenant Audit Vim Policy Admin Virtual Infrastructure Admin Virtual Infrastructure Audit Virtual Infrastructure Consume Virtual Infrastructure Create Virtual Infrastructure Read Workflow Design Workflow Execute Workflow Execution Modify Workflow Execution Read Workflow Hub Certificate Authority Read Workflow Hub Certificate Authority Write Workflow Hub Configuration Read Workflow Hub Configuration Write Workflow Hub Openapi Schema Read Workflow Hub Openapi Schema Write Workflow Hub Schedule Read Workflow Hub Schedule Write Workflow Hub Secret Manager Read Workflow Hub Secret Manager Write Workflow Hub Workflow Read Workflow Hub Workflow Run Read Workflow Hub Workflow Run Statistics Read Workflow Hub Workflow Run Write Workflow Hub Workflow Write Workflow Modify Workflow Read
Tenant Auditor	The users assigned to this role can view all entities in the Tenant.	Alarm Read Audit Log Read Cluster Read Cluster Template Read Network Function Draft Read Network Function Instance Read Network Function Package Read Network Service Draft Read Network Service Instance Read Network Service Package Read Partner System Read Role Audit Subscription Read Tenant Audit Virtual Infrastructure Audit Virtual Infrastructure Read Workflow Execution Read Workflow Hub Certificate Authority Read Workflow Hub Configuration Read Workflow Hub Openapi Schema Read Workflow Hub Schedule Read Workflow Hub Secret Manager Read Workflow Hub Workflow Run Read Workflow Hub Workflow Run Statistics Read Workflow Read
Virtual Infrastructure Administrator	The users assigned to this role can perform all infrastructure-related actions for the Telco Cloud Platform	Cluster Create Cluster Modify Cluster Read Cluster Template Create Cluster Template Modify Cluster Template Read Cluster Template Use Cluster Use Infrastructure Design Infrastructure Lifecycle Management Namespace Modify Virtual Infrastructure Admin Virtual Infrastructure Audit Virtual Infrastructure Consume Virtual Infrastructure Create Virtual Infrastructure Read
Virtual Infrastructure Auditor	The users assigned to this role can view all infrastructure entities for the VMware Telco Cloud Platform.	Cluster Read Cluster Template Read Virtual Infrastructure Audit Virtual Infrastructure Read
Workflow Designer	The users assigned to this role can perform all actions like designing, uploading, and managing the workflows.	Workflow Design Workflow Modify Workflow Read
Workflow Executor	The users assigned to this role can execute workflows.	Workflow Execute Workflow Execution Modify Workflow Execution Read Workflow Read
Workflow Hub Workflow Designer	The users assigned to this role can view, create, and modify workflows and openapi schemas on Workflow Hub. They can also execute workflows.	Workflow Hub Openapi Schema Read Workflow Hub Openapi Schema Write Workflow Hub Workflow Read Workflow Hub Workflow Run Read Workflow Hub Workflow Run Write Workflow Hub Workflow Write
Workflow Hub Workflow Executor	The users assigned to this role can view and execute workflows and schedules. They can also view workflow run statistics.	Workflow Hub Schedule Read Workflow Hub Schedule Write Workflow Hub Workflow Read Workflow Hub Workflow Run Read Workflow Hub Workflow Run Statistics Read Workflow Hub Workflow Run Write