Grant Privilege or Privilege Group to Roles
Once a role is created, you can grant privileges to the role. This guide introduces how to grant privileges or privilege groups to a role.
Grant a privilege or a privilege group to a role
Milvus 2.5 introduces a new version of API which streamlines the grant operation. You no longer need to look up the object type when granting a privilege to a role. The following are the parameters and corresponding explanations.
role_name: The name of the target role to which privilege(s) or privilege group(s) need to be granted.
Resource: The target resource of a privilege, which can be a specific instance, database or collection. The following table explains how to specify the resource in the
client.grantV2()method.
Level | Resource | Grant Method | Notes |
|---|---|---|---|
Collection | A specific collection | client.grant_privilege_v2(role_name="roleA", privilege="CollectionAdmin", collection_name="col1", db_name="db1") | Input the name of your target collection and the name of the database to which the target collection belongs. |
All collections under a specific database | client.grant_privilege_v2(role_name="roleA", privilege="CollectionAdmin", collection_name="*", db_name="db1") | Input the name of your target database and a wildcard | |
**Database** | A specific database | client.grant_privilege_v2(role_name="roleA", privilege="DatabaseAdmin", collection_name="*", db_name="db1") | Input the name of your target database and a wildcard |
All databases under the current instance | client.grant_privilege_v2(role_name="roleA", privilege="DatabaseAdmin", collection_name="*", db_name="*") | Input | |
**Instance** | The current instance | client.grant_privilege_v2(role_name="roleA", privilege="ClusterAdmin", collection_name="*", db_name="*") | Input |
Privilege: The specific privilege or privilege group that you need to grant to a role. Currently, Milvus provides 56 types of privileges that you can grant. The table below lists the privileges in Milvus.
The type column in the table below are user to facilitate your quick lookup for privileges and is used for classification purposes only. When granting privileges, you do not need to understand the types. You just need to input the corresponding privileges.
**Type ** | **Privilege** | **Description** | **Relevant API description on the client side** |
|---|---|---|---|
Database Privileges | ListDatabases | View all databases in the current instance | |
DescribeDatabase | View the details of a database | [DescribeDatabase](https://milvus.io/docs/manage_databases.md) | |
CreateDatabase | Create a database | [CreateDatabase](https://milvus.io/docs/manage_databases.md) | |
DropDatabase | Drop a database | ||
AlterDatabase | Modify the properties of a database | ||
Collection Privileges | GetFlushState | Check the status of the collection flush operation | [GetFlushState](https://milvus.io/api-reference/pymilvus/v2.5.x/ORM/Collection/flush.md) |
GetLoadState | Check the load status of a collection | ||
GetLoadingProgress | Check the loading progress of a collection | ||
ShowCollections | View all collections with collection privileges | [ShowCollections](https://milvus.io/docs/view-collections.md) | |
ListAliases | View all aliases of a collection | ||
DescribeCollection | View the details of a collection | ||
DescribeAlias | View the details of an alias | ||
GetStatistics | Obtain the statistics of a collection (eg. The number of entities in a collection) | ||
CreateCollection | Create a collection | [CreateCollection](https://milvus.io/docs/create-collection.md) | |
DropCollection | Drop a collection | ||
Load | Load a collection | [LoadCollection](https://milvus.io/docs/load-and-release.md)/[GetLoadingProgress](https://milvus.io/api-reference/pymilvus/v2.5.x/ORM/utility/loading_progress.md)/[GetLoadState](https://milvus.io/api-reference/restful/v2.5.x/v2/Collection%20(v2)/Get%20Load%20State.md) | |
Release | Release a collection | [ReleaseCollection](https://milvus.io/docs/load-and-release.md) | |
Flush | Persist all entities in a collection to a sealed segment. Any entity inserted after the flush operation will be stored in a new segment. | [Flush](https://milvus.io/api-reference/pymilvus/v2.5.x/ORM/Collection/flush.md)/[GetFlushState](https://milvus.io/api-reference/pymilvus/v2.5.x/ORM/Collection/flush.md) | |
Compaction | Manually trigger compaction | ||
RenameCollection | Rename a collection | [RenameCollection](https://milvus.io/docs/modify-collection.md) | |
CreateAlias | Create an alias for a collection | ||
DropAlias | Drop the alias of a collection | ||
FlushAll | Flush all collections in a database | [FlushAll](https://milvus.io/api-reference/pymilvus/v2.5.x/ORM/utility/flush_all.md) | |
Partition Privileges | HasPartition | Check whether a partition exists | |
ShowPartitions | View all partitions in a collection | [ShowPartitions](https://milvus.io/docs/manage-partitions.md) | |
CreatePartition | Create a partition | [CreatePartition](https://milvus.io/docs/manage-partitions.md) | |
DropPartition | Drop a partition | [DropPartition](https://milvus.io/docs/manage-partitions.md) | |
Index Privileges | IndexDetail | View the details of an index | |
CreateIndex | Create an index | [CreateIndex](https://milvus.io/docs/index-vector-fields.md?tab=floating) | |
DropIndex | Drop an index | [DropIndex](https://milvus.io/docs/index-vector-fields.md?tab=floating) | |
Resource Management Privileges | LoadBalance | Achieve load balance | |
CreateResourceGroup | Create a resource group | ||
DropResourceGroup | Drop a resource group | [DropResourceGroup](https://milvus.io/docs/resource_group.md) | |
UpdateResourceGroups | Update a resource group | [UpdateResourceGroups](https://milvus.io/docs/resource_group.md) | |
DescribeResourceGroup | View the details of a resource group | [DescribeResourceGroup](https://milvus.io/docs/resource_group.md) | |
ListResourceGroups | View all resource groups of the current instance | [ListResourceGroups](https://milvus.io/docs/resource_group.md) | |
TransferNode | Transfer nodes between resource groups | ||
TransferReplica | Transfer replicas between resource groups | ||
BackupRBAC | Create a backup for all RBAC related operations in the current instance | BackupRBAC | |
RestoreRBAC | Restore a backup of all RBAC related operations in the current instance | RestoreRBAC | |
Entity Privileges | Query | Conduct a query | |
Search | Conduct a search | ||
Insert | Insert entities | ||
Delete | Delete entities | ||
Upsert | Upsert entities | ||
Import | Bulk insert or import entities | ||
RBAC Privileges | CreateOwnership | Create a user or a role | [CreateUser/CreateRole](https://zilliverse.feishu.cn/wiki/CnzkwQBW3i7bE3kVtLzcqQLtn9d) |
UpdateUser | Update the password of a user | [UpdateCredential](https://zilliverse.feishu.cn/wiki/CnzkwQBW3i7bE3kVtLzcqQLtn9d) | |
DropOwnership | Drop a user password or a role | [DeleteCredential/DropRole](https://zilliverse.feishu.cn/wiki/OqZnwJHrJilLPukfvp5cSgnmnTh) | |
SelectOwnership | View all users that are granted a specific role | [SelectRole/SelectGrant](https://zilliverse.feishu.cn/wiki/ZsNZwn1MkiOtH9kFU35cyRgVnue) | |
ManageOwnership | Manage a user or a role or grant a role to a user | ||
SelectUser | View all roles granted to a user | [SelectUser](https://zilliverse.feishu.cn/wiki/ZsNZwn1MkiOtH9kFU35cyRgVnue) | |
CreatePrivilegeGroup | Create a privilege group | [CreatePrivilegeGroup](https://zilliverse.feishu.cn/wiki/FpV8wdWcZiDwnQkBloucYF7wnUg) | |
DropPrivilegeGroup | Drop a privilege group | [DropPrivilegeGroup](https://zilliverse.feishu.cn/wiki/FpV8wdWcZiDwnQkBloucYF7wnUg) | |
ListPrivilegeGroups | View all privilege groups in the current instance | [ListPrivilegeGroups](https://zilliverse.feishu.cn/wiki/FpV8wdWcZiDwnQkBloucYF7wnUg) | |
OperatePrivilegeGroup | Add privileges to or remove privileges from a privilege group | [OperatePrivilegeGroup](https://zilliverse.feishu.cn/wiki/FpV8wdWcZiDwnQkBloucYF7wnUg) |
The following example demonstrates how to grant the privilege PrivilegeSearch on collection_01 under the default database as well as a privilege group named privilege_group_1 to the role role_a.
from pymilvus import MilvusClient
client = MilvusClient(
uri="http://localhost:19530",
token="root:Milvus"
)
client.grant_privilege_v2(
role_name="role_a",
privilege="Search"
collection_name='collection_01'
db_name='default',
)
client.grant_privilege_v2(
role_name="role_a",
privilege="privilege_group_1"
collection_name='collection_01'
db_name='default',
)
client.grant_privilege_v2(
role_name="role_a",
privilege="ClusterReadOnly"
collection_name='*'
db_name='*',
)
import io.milvus.v2.service.rbac.request.GrantPrivilegeReqV2
client.grantPrivilegeV2(GrantPrivilegeReqV2.builder()
.roleName("role_a")
.privilege("Search")
.collectionName("collection_01")
.dbName("default")
.build());
client.grantPrivilegeV2(GrantPrivilegeReqV2.builder()
.roleName("role_a")
.privilege("privilege_group_1")
.collectionName("collection_01")
.dbName("default")
.build());
client.grantPrivilegeV2(GrantPrivilegeReqV2.builder()
.roleName("role_a")
.privilege("ClusterReadOnly")
.collectionName("*")
.dbName("*")
.build());
import "github.com/milvus-io/milvus-sdk-go/v2/client"
client.GrantV2(context.Background(), "role_a", "collection_01", "Search", entity.WithOperatePrivilegeDatabase("default"))
client.GrantV2(context.Background(), "role_a", "collection_01", "privilege_group_1", entity.WithOperatePrivilegeDatabase("default"))
client.GrantV2(context.Background(), "role_a", "*", "ClusterReadOnly", entity.WithOperatePrivilegeDatabase("*"))
const { MilvusClient, DataType } = require("@zilliz/milvus2-sdk-node")
const address = "http://localhost:19530";
const token = "root:Milvus";
const client = new MilvusClient({address, token});
await milvusClient.grantPrivilege({
roleName: 'role_a',
object: 'Collection',
objectName: 'collection_01',
privilegeName: 'Search'
});
curl --request POST \
--url "${CLUSTER_ENDPOINT}/v2/vectordb/roles/grant_privilege_v2" \
--header "Authorization: Bearer ${TOKEN}" \
--header "Content-Type: application/json" \
-d '{
"roleName": "role_a",
"privilege": "Search",
"collectionName": "collection_01",
"dbName":"default"
}'
curl --request POST \
--url "${CLUSTER_ENDPOINT}/v2/vectordb/roles/grant_privilege_v2" \
--header "Authorization: Bearer ${TOKEN}" \
--header "Content-Type: application/json" \
-d '{
"roleName": "role_a",
"privilege": "privilege_group_1",
"collectionName": "collection_01",
"dbName":"default"
}'
curl --request POST \
--url "${CLUSTER_ENDPOINT}/v2/vectordb/roles/grant_privilege_v2" \
--header "Authorization: Bearer ${TOKEN}" \
--header "Content-Type: application/json" \
-d '{
"roleName": "role_a",
"privilege": "ClusterReadOnly",
"collectionName": "*",
"dbName":"*"
}'
Describe a role
The following example demonstrates how to view the privileges granted to the role role_a using the describe_role method.
from pymilvus import MilvusClient
client.describe_role(role_name="role_a")
import io.milvus.v2.service.rbac.response.DescribeRoleResp;
import io.milvus.v2.service.rbac.request.DescribeRoleReq
DescribeRoleReq describeRoleReq = DescribeRoleReq.builder()
.roleName("role_a")
.build();
DescribeRoleResp resp = client.describeRole(describeRoleReq);
List<DescribeRoleResp.GrantInfo> infos = resp.getGrantInfos();
import "github.com/milvus-io/milvus-sdk-go/v2/client"
client.ListRoles(context.Background())
const { MilvusClient, DataType } = require("@zilliz/milvus2-sdk-node")
await milvusClient.describeRole({roleName: 'role_a'});
curl --request POST \
--url "${CLUSTER_ENDPOINT}/v2/vectordb/roles/describe" \
--header "Authorization: Bearer ${TOKEN}" \
--header "Content-Type: application/json" \
-d '{
"roleName": "role_a"
}'
Below is an example output.
{
"role": "role_a",
"privileges": [
{
"collection_name": "collection_01",
"db_name": "default",
"role_name": "role_a",
"privilege": "Search",
"grantor_name": "root"
},
"privilege_group_1"
]
}
Revoke a privilege or a privilege group from a role
The following example demonstrates how to revoke the privilege PrivilegeSearch on collection_01 under the default database as well as the privilege group privilege_group_1 that have been granted to the role role_a.
from pymilvus import MilvusClient
client = MilvusClient(
uri="http://localhost:19530",
token="root:Milvus"
)
client.revoke_privilege_v2(
role_name="role_a",
privilege="Search"
collection_name='collection_01'
db_name='default',
)
client.revoke_privilege_v2(
role_name="role_a",
privilege="privilege_group_1"
collection_name='collection_01'
db_name='default',
)
client.revoke_privilege_v2(
role_name="role_a",
privilege="ClusterReadOnly"
collection_name='*'
db_name='*',
)
import io.milvus.v2.service.rbac.request.RevokePrivilegeReqV2
client.revokePrivilegeV2(RevokePrivilegeReqV2.builder()
.roleName("role_a")
.privilege("Search")
.collectionName("collection_01")
.dbName("default")
.build());
client.revokePrivilegeV2(RevokePrivilegeReqV2.builder()
.roleName("role_a")
.privilege("privilege_group_1")
.collectionName("collection_01")
.dbName("default")
.build());
client.revokePrivilegeV2(RevokePrivilegeReqV2.builder()
.roleName("role_a")
.privilege("ClusterReadOnly")
.collectionName("*")
.dbName("*")
.build());
import "github.com/milvus-io/milvus-sdk-go/v2/client"
client.RevokeV2(context.Background(), "role_a", "collection_01", "Search", entity.WithOperatePrivilegeDatabase("default"))
client.RevokeV2(context.Background(), "role_a", "collection_01", "privielge_group_1", entity.WithOperatePrivilegeDatabase("default"))
client.RevokeV2(context.Background(), "role_a", "*", "ClusterReadOnly", entity.WithOperatePrivilegeDatabase("*"))
curl --request POST \
--url "${CLUSTER_ENDPOINT}/v2/vectordb/roles/revoke_privilege_v2" \
--header "Authorization: Bearer ${TOKEN}" \
--header "Content-Type: application/json" \
-d '{
"roleName": "role_a",
"privilege": "Search",
"collectionName": "collection_01",
"dbName":"default"
}'
curl --request POST \
--url "${CLUSTER_ENDPOINT}/v2/vectordb/roles/revoke_privilege_v2" \
--header "Authorization: Bearer ${TOKEN}" \
--header "Content-Type: application/json" \
-d '{
"roleName": "role_a",
"privilege": "Search",
"collectionName": "collection_01",
"dbName":"default"
}'
curl --request POST \
--url "${CLUSTER_ENDPOINT}/v2/vectordb/roles/revoke_privilege_v2" \
--header "Authorization: Bearer ${TOKEN}" \
--header "Content-Type: application/json" \
-d '{
"roleName": "role_a",
"privilege": "ClusterReadOnly",
"collectionName": "*",
"dbName":"*"
}'