Platform: Role-Based Access Control

Roles & Permissions (RBAC)

Nexus GSLB uses role-based access control (RBAC). Each user is assigned a single role; each role carries a set of permission atoms that gate individual API endpoints.

The system API key (GSLB_API_KEY) is always treated as a super-admin and bypasses RBAC entirely.

Built-in Roles

Three system roles are seeded on startup and cannot be deleted (but their permission sets can be updated).

Role	Description
`tenant_admin`	Full read/write access to all resources within the tenant
`operator`	Read/write access to operational resources; no user/tenant management
`viewer`	Read-only access to all resources

Built-in permission sets

Permission	tenant_admin	operator	viewer
`pool:read/write/delete`	✓	✓	read
`member:read/write/delete`	✓	✓	read
`service:read/write/delete`	✓	✓	read
`hc:read/write/delete`	✓	✓	read
`geo:read/write/delete`	✓	✓	read
`user:read/write/delete`	✓	read	—
`tenant:read/write/delete`	✓	—	—
`role:read/write`	✓	read	read
`usage:read_own`	✓	✓	✓
`cluster:status`	✓	✓	✓
`dnssec:read/write`	✓	read	read
`domain:read/write`	✓	✓	read
`txt:read/write`	✓	✓	read
`tsig:read/write`	✓	✓	read
`redirect:read/write`	✓	✓	read
`license:read/write`	✓	read	read

Permission Atoms

Permission	Description
`pool:read`	List and view pools
`pool:write`	Create and update pools
`pool:delete`	Delete pools
`member:read`	List and view pool members
`member:write`	Create and update members
`member:delete`	Delete members
`service:read`	List and view services
`service:write`	Create and update services
`service:delete`	Delete services
`hc:read`	View health check configuration
`hc:write`	Create and update health checks
`hc:delete`	Delete health checks
`geo:read`	List geo rules
`geo:write`	Create and update geo rules
`geo:delete`	Delete geo rules
`user:read`	List users
`user:write`	Create and update users
`user:delete`	Delete users
`tenant:read`	List tenants
`tenant:write`	Create and update tenants
`tenant:delete`	Delete tenants
`role:read`	List roles and their permissions
`role:write`	Create and update roles
`usage:read_own`	View usage for own tenant
`usage:read_any`	View usage for any tenant
`cluster:status`	View cluster and NATS status
`cluster:restart`	Trigger node restart
`snapshot:read`	Download DB snapshot
`dnssec:read`	View DNSSEC key status
`dnssec:write`	Manage DNSSEC keys and initiate rollovers
`domain:read`	List delegated domains
`domain:write`	Create and verify delegated domains
`txt:read`	List TXT records
`txt:write`	Create and delete TXT records
`tsig:read`	List TSIG keys
`tsig:write`	Create and delete TSIG keys
`redirect:read`	List redirect rules
`redirect:write`	Create and delete redirect rules
`license:read`	View license status and install ID
`license:write`	Apply a new license token
`bgp:status`	View BGP peer and route announcement status
`rrl:read`	List RRL allowlist entries
`rrl:write`	Add and delete RRL allowlist entries
`alert:read`	List alert channels
`alert:write`	Create, update, and delete alert channels
`history:read`	List and view config snapshots
`history:write`	Create checkpoints, restore, and delete snapshots
`settings:read`	View server settings (SMTP configuration)
`settings:write`	Update server settings

Role matrix (complete)

Permission	tenant_admin	operator	viewer
`pool:read/write/delete`	✓	✓	read
`member:read/write/delete`	✓	✓	read
`service:read/write/delete`	✓	✓	read
`hc:read/write/delete`	✓	✓	read
`geo:read/write/delete`	✓	✓	read
`user:read/write/delete`	✓	read	—
`tenant:read/write/delete`	✓	—	—
`role:read/write`	✓	read	read
`usage:read_own`	✓	✓	✓
`cluster:status`	✓	✓	✓
`dnssec:read/write`	✓	read	read
`domain:read/write`	✓	✓	read
`txt:read/write`	✓	✓	read
`tsig:read/write`	✓	✓	read
`redirect:read/write`	✓	✓	read
`license:read/write`	✓	read	read
`bgp:status`	✓	✓	✓
`rrl:read/write`	✓	✓	read
`alert:read/write`	✓	✓	read
`history:read/write`	✓	✓	read
`settings:read/write`	✓	—	—

Custom Roles

License: Creating and modifying custom roles requires the enterprise tier. The three built-in roles (tenant_admin, operator, viewer) are available on all tiers. Contact licensing@gslb.nexus to upgrade.

You can create custom roles with any combination of permissions.

WebUI

Admin → Roles → New Role

gslbctl

gslbctl roles create --name "dns-operator" \  --permissions "domain:read,domain:write,txt:read,txt:write,tsig:read,tsig:write" \  --server https://nexus.example.com:8880

API

# Create a custom rolePOST /api/v1/roles{  "name": "dns-operator",  "permissions": ["domain:read","domain:write","txt:read","txt:write"]}# Update a role's permissionsPUT /api/v1/roles/{id}{  "permissions": ["domain:read","domain:write"]}# Delete a custom role (system roles cannot be deleted)DELETE /api/v1/roles/{id}

Terraform

resource "nexus_role" "dns_operator" {
  name        = "dns-operator"
  permissions = ["domain:read", "domain:write", "txt:read", "txt:write"]
}

Assigning Roles to Users

A user's role is set at creation time and can be changed via update.

# Create a user with a specific rolePOST /api/v1/users{  "email": "alice@example.com",  "password": "...",  "role": "operator"}# Update rolePUT /api/v1/users/{id}{  "role": "tenant_admin"}

In the WebUI: Admin → Users → select user → change role.

RBAC Notes

The system_admin identity (GSLB_API_KEY) is not a role — it bypasses all permission checks.
Built-in role permissions are automatically expanded on binary upgrades to include any newly-added permission atoms, without removing admin-added custom permissions.
Custom roles survive binary upgrades unchanged.
There is no permission inheritance — a user has exactly the permissions of their assigned role.