Manage Your Team

Every team member is assigned one of five roles. These roles map directly to GitLab access levels and Rancher project roles via Okta groups — the role a member holds in IronSled is the same permission level they have in the project's GitLab repositories and the project's Rancher project.

Roles follow a hierarchy. A user's effective permissions are determined by their highest assigned role. Members with the Owners or Maintainers role can manage other team members; only Owners can set the Point of Contact and access project-level administrative settings.

When a project is provisioned, IronSled creates a set of Okta groups using the project's unique prefix. Each role maps to its own group:

• {okta-prefix}{project-prefix}-owners
• {okta-prefix}{project-prefix}-maintainers
• {okta-prefix}{project-prefix}-developers
• {okta-prefix}{project-prefix}-reporters
• {okta-prefix}{project-prefix}-guests

These Okta groups are bound to two downstream systems:

• GitLab — The Okta groups are linked to the project's GitLab group through SAML group links. GitLab reads the SAML assertion during authentication and grants the matching access level.
• Rancher — The Okta groups are bound to the project's Rancher project, granting the matching Rancher project role. A Rancher project is a logical grouping of Kubernetes namespaces and deployments inside a cluster; the binding applies to every namespace and workload under that Rancher project, so a member with the Maintainer role has Project Member access across all of the project's deployments — not just one.

When a member is assigned a role in IronSled:

• Adding a member adds them to the Okta group and grants GitLab and Rancher access at the matching level.
• Changing a role moves them between Okta groups, updating GitLab and Rancher permissions on their next authentication.
• Removing a member removes them from all project Okta groups, revoking access in both systems.

Reporters and Guests receive GitLab access only — they are not granted any role in Rancher.

No manual GitLab or Rancher permission management is needed — IronSled is the single source of truth for project access.

To add members to a project:

1. Navigate to the project's Team section.
2. Click the Add Members button (visible to Owners and Maintainers).
3. Search for users by name or email — results appear after typing at least two characters.
4. Select one or more users to add.
5. Choose the role to assign.
6. Click Save.

The selected users are added to the project, enrolled in the appropriate Okta group, and granted the corresponding GitLab and Rancher access (Reporters and Guests receive GitLab access only). Users who are already members of the project will not appear in the search results.

To change a member's role:

1. Open the action menu on the member's row in the team table.
2. Select Edit Role.
3. Choose the new role from the dropdown.
4. Click Save.

The member is moved from their previous Okta group to the new one, and their GitLab and Rancher permissions update accordingly on their next authentication.

Each project has a single Point of Contact (POC) — the person primarily responsible for the project. The POC is displayed on the project dashboard and serves as the go-to contact for the platform team.

To set a member as POC:

1. Open the action menu on the member's row.
2. Select Set as POC.
3. Confirm the change.

The previous POC (if any) is automatically unset. Only one member can be the POC at a time. The POC cannot be removed from the project — to remove them, first assign another member as POC.

To remove a member from the project:

1. Open the action menu on the member's row.
2. Select Remove.
3. Confirm the removal.

The member is removed from the project, removed from all associated Okta groups, and their GitLab and Rancher access is revoked. Members can also remove themselves from a project, provided they are not the current POC.

Note: The POC cannot be removed. To remove the current POC, first reassign the POC role to another team member.

Platform managers can synchronize team membership from Okta to ensure IronSled reflects the current state of the identity provider. This is useful when group membership has been modified directly in Okta outside of IronSled.

To sync:

1. Click the Sync from Okta button (visible to platform managers only).
2. Optionally enable Remove unmatched members to remove members who are no longer in any of the project's Okta groups.
3. Confirm the sync.

The sync process queries each of the project's Okta groups, adds any new members found, updates roles for members whose group membership has changed, and optionally removes members who no longer appear in any group. If a user appears in multiple groups, they are assigned the highest role.