Teams

A team defines how an organization grants permissions for sensitive management and administrative operations to accounts, including user accounts and service accounts. A team’s accounts have a shared responsibility for certain services. Chronosphere Observability Platform represents those services as collections, which contain resources related to the service a collection represents, such as dashboards and monitors. A team can own multiple collections. All user and service accounts in a team that has the special System Administrator (SysAdmin) role are administrators. If you’re an administrator, you can add this role to a team. Teams can own collections and services, which in turn own other functions:

View teams

To search for a team:

Click the search bar to focus on it, or use the keyboard shortcut Control+K (Command+K on macOS).
Begin typing any part of the team’s name.
Optional: Click the Teams filter at the top of the search results to constrain your results to only Teams.
Click the search result you’re interested in, or use the arrow keys to select it and press enter, to go to that team.

View teams and their collections

To view teams and the collections they own, in the navigation menu exit the Admin menu (if needed, click Exit Admin) and select Collections. For details about working with collections, see Collections.

View a list of teams to manage

To view teams in a list that displays their members, provides an audit log of membership changes, and includes management options for administrators:

Cloud
Chronoctl

In the navigation menu, click Go to Admin and then select Platform > Teams.

Use the command:

chronoctl teams list

For details, see Accounts and Teams.

Manage teams

To manage teams, you must use a user account or service account that belongs to a team with the SysAdmin role.

To manage teams, in the navigation menu, click Go to Admin and then select Platform > Teams.

Create a team

Web
Chronoctl
Terraform
API

To create a new team:

In the navigation menu, click Go to Admin and then select Platform > Teams.
Click Create team.
In the dialog that appears, enter a name for the new team and the access role it should have.
Click Save to create the team.

The team now appears in the list of users and teams.

To create teams or modify team membership with Chronoctl, you must use a user account or service account that belongs to a team with the SysAdmin role.

To create and manage a team with Chronoctl, use the Team resource type. The resource can contain these fields:

Field	Type	Description
`name`	String	The team name as displayed in Observability Platform.
`slug`	String	Optional. A unique identifier that Observability Platform uses to identify the team. If omitted, Observability Platform generates a slug.
`description`	String	Optional. A description displayed when viewing this team.
`user_emails`	Collection of strings	Contains an item for each member account’s email address.

To generate an example Team resource, run chronoctl teams scaffold.If an email address in users doesn’t already have an Observability Platform account, the app creates a pending user account for that email address. When that user signs in, Observability Platform then activates the account.For example, this YAML resource creates a team named DBAs in Observability Platform, with the description Database administrators, and which the app identifies with the slug dbas. It also includes the listed accounts identified by their email addresses as team members:

api_version: v1/config
kind: Team
spec:
  name: DBAs
  slug: dbas
  description: "Database administrators"
  user_emails:
    - adam@example.com
    - betty@example.com

To include service accounts, add the service account’s internal email address to the users list. For details, see Service Accounts.

To create teams or modify team membership with Terraform, you must use a user account or service account that belongs to a team with the SysAdmin role.

To create and manage a team with Terraform, declare the chronosphere_team resource type and provide a resource name. The resource can contain these fields:

Field	Type	Description
`name`	String	The team name as displayed in Observability Platform.
`slug`	String	Optional. A unique identifier that Observability Platform uses to identify the team. If omitted, Observability Platform generates a slug.
`description`	String	Optional. A description displayed when viewing this team.
`user_emails`	Array of strings	The email address for each member account.

For example, this resource creates a team referred to by Terraform as dbas, named DBAs in Observability Platform, and identified in the app with the slug dbas. It also includes the listed accounts identified by their email addresses as team members:

resource "chronosphere_team" "dbas" {
  name = "DBAs"
  slug = "dbas"
  description = "Database administrators"

  user_emails = [
    "adam@example.com",
    "betty@example.com",
  ]
}

To include service accounts, add the service account’s internal email address to the user_emails array. For details, see Service Accounts.

Add the definition to a Terraform file.
Run this command to create the resource:
```
terraform apply
```

To complete this action with the Chronosphere API, use the CreateTeam endpoint.Because the Chronosphere API requires authentication, include an API token with your curl request, as shown in the following example. For more details, see Create an API token.

export CHRONOSPHERE_API_TOKEN="TOKEN"
export CHRONOSPHERE_DOMAIN="INSTANCE.chronosphere.io"

curl -H "API-Token: ${CHRONOSPHERE_API_TOKEN}" \
     -X METHOD "https://${CHRONOSPHERE_DOMAIN}/ENDPOINT_PATH"

Replace the following:

TOKEN: Your API token.
INSTANCE: The subdomain name for your organization’s Observability Platform instance.
METHOD: The HTTP method to use with the request, such as GET or POST.
ENDPOINT_PATH: The specific endpoint you want to access.

Edit team membership

Web
Chronoctl
Terraform
API

To add users to or remove users from a team:

In the navigation menu, click Go to Admin and then select Platform > Teams.
Select the team to manage.
Click Edit Team.
In the Team Members section, click Update Membership.
From the account list that appears, select the checkbox for each account you want to add to the team, and clear the checkbox for each account you want to remove from the team.
Click Save to edit the team’s membership.

The team page updates its membership list accordingly, and the audit log adds an entry logging the operation.

To modify teams with Chronoctl, you must use a user account or service account that belongs to a team with the SysAdmin role.

You can use Chronoctl to replace and update a team and its membership with those defined in a YAML file.To generate a YAML description of your current teams and accounts, see View Accounts and Teams.Following the DBAs team example from creating a team, to add a user to that team, update the YAML to include the new user’s email:

api_version: v1/config
kind: Team
spec:
  name: DBAs
  slug: dbas
  description: "Database administrators"
  user_emails:
    - adam@example.com
    - betty@example.com
    - charles@example.com

To apply the changes, use the Chronoctl chronoctl teams update command, which updates teams but doesn’t create them if they don’t already exist:

chronoctl teams update -f FILE_NAME.yaml

Replace FILE_NAME with the path to the YAML definition file.You can test the changes without applying them by including the --dry-run flag:

chronoctl teams update -f FILE_NAME.yaml --dry-run

To force teams update to create a defined team if it doesn’t exist, include the --create-if-missing flag:

chronoctl teams update -f FILE_NAME.yaml --create-if-missing

To edit a team’s membership using Terraform, modify the user_emails array in the team’s chronosphere_team resource, and then apply the resource using Terraform.

To complete this action with the Chronosphere API, use the UpdateTeam endpoint.Because the Chronosphere API requires authentication, include an API token with your curl request, as shown in the following example. For more details, see Create an API token.

export CHRONOSPHERE_API_TOKEN="TOKEN"
export CHRONOSPHERE_DOMAIN="INSTANCE.chronosphere.io"

curl -H "API-Token: ${CHRONOSPHERE_API_TOKEN}" \
     -X METHOD "https://${CHRONOSPHERE_DOMAIN}/ENDPOINT_PATH"

Replace the following:

TOKEN: Your API token.
INSTANCE: The subdomain name for your organization’s Observability Platform instance.
METHOD: The HTTP method to use with the request, such as GET or POST.
ENDPOINT_PATH: The specific endpoint you want to access.

Assign team roles and permissions

Observability Platform teams use roles to grant or restrict access to features that create, edit, or delete resources, teams, and accounts. Roles are assigned to teams, and all accounts that belong to a team gain the permissions granted by that team’s role. During creation, accounts are assigned to the Default team, which has the Editor role. The Default team can’t be deleted, and its role can’t be changed. Service accounts also can’t be removed from the Default team and therefore always have Editor access.

To remove editing access from a user, remove the user from the Default team. This limits the user to read-only access provided they don’t have edit access through membership in another team.

The available roles are:

None: Accounts on teams with this role can view pages in Observability Platform but can’t create, edit, or remove resources or accounts. Accounts that don’t belong to any team also have the None role by default.
Editor: Accounts on teams with this role can create, view, edit, and delete resources within Observability Platform, but can’t create, edit, or delete accounts and teams.
SysAdmin: Any account that’s a member of a team with the System Administrator (SysAdmin) role can create, edit, and delete accounts and teams, assign accounts to teams, and assign roles to teams. Accounts with this role are designated by a key icon next to their name in the Users list.
User Administrator: Accounts belonging to teams with this role can access the System for Cross-domain Identity Management (SCIM) API, which manages accounts that use single sign-on. This role grants no other permissions. The User Administrator role can be assigned to teams only in organizations that have SCIM integration enabled. For more information, see Okta user synchronization.

If an account belongs to multiple teams with different roles, they inherit the highest-level permissions of each assigned team. For example, an account in a team with the Editor role and a second team with the SysAdmin role has both sets of privileges. The following chart summarizes roles and permissions:

Action	None	Editor	SysAdmin	User Admin
Interact with SCIM API
View pages in Observability Platform
Add and edit user and service accounts
Add, edit, and remove teams
Change users’ team membership
Apply service configuration changes
Add, edit, and remove trace control plane datasets
Add, edit, and remove derived labels
Add, edit, and remove other resources

Add a role to a team

To add a role to a team:

In the navigation menu, click Go to Admin and then select Platform > Teams.
Select the team to manage.
In the Team Information section, click Edit.
Click the Role dropdown and select the role you want to assign to the team.
Click Save.

Remove a role from a team

To remove a role from a team:

In the navigation menu, click Go to Admin and then select Platform > Teams.
Select the team to manage.
In the Team Information section, click Edit.
Click the Role dropdown and select the None role.
Click Save.

Rename a team

To rename a team:

In the navigation menu, click Go to Admin and then select Platform > Teams.
Select the team to manage.
In the Team Information section, click Edit.
Change the team’s name in the Name field.
Click Save.

Describe a team

Team pages can display a brief description in the Team Information section. You can use this description to clarify the team’s purpose, identify the people responsible for managing it, or provide general information or context to the team’s activities. You can also add links to URLs, whether within or external to Observability Platform, to the Team Information section. To access a team’s information:

In the navigation menu, click Go to Admin and then select Platform > Teams.
Select the team to manage.
In the Team Information section, click Edit.

To add, edit, or remove a team’s description:

Enter the team description in the Description field.
Click Save.

To add links to a team’s information:

In the Team Links section, click Add. This adds a row of fields to the section.
Enter the link text in the Link Name field.
Enter the link target in the URL field.
Repeat these steps to add more links.
Click Save.

To edit a team’s links:

In the Team Links section, modify the link’s Link Name and URL fields.
Click Save.

To remove links from a team’s information:

In the Team Links section, click the delete button in the rows of the links you want to delete.
Click Save.

Delete a team

Use one of the following methods to delete a team. The Default team can’t be deleted.

Cloud
Chronoctl
Terraform
API

To delete a team:

In the navigation menu, click Go to Admin and then select Platform > Teams.
Select the team to delete.
In the Team Information section, click Edit.
Click Delete team.
In the confirmation dialog that appears, click Delete.

To delete teams with Chronoctl, use the chronoctl teams delete command:

chronoctl teams delete SLUG

Replace SLUG with the unique slug of the team you want to delete.For example, to delete the team with the slug dbas, run:

chronoctl teams delete dbas

To delete a resource that’s managed by Terraform:

Edit your Terraform configuration file to remove the pre-existing resource definition.
Run this command to remove the resource from Observability Platform:
```
terraform apply
```

To complete this action with the Chronosphere API, use the DeleteTeam endpoint.Because the Chronosphere API requires authentication, include an API token with your curl request, as shown in the following example. For more details, see Create an API token.

export CHRONOSPHERE_API_TOKEN="TOKEN"
export CHRONOSPHERE_DOMAIN="INSTANCE.chronosphere.io"

curl -H "API-Token: ${CHRONOSPHERE_API_TOKEN}" \
     -X METHOD "https://${CHRONOSPHERE_DOMAIN}/ENDPOINT_PATH"

Replace the following:

TOKEN: Your API token.
INSTANCE: The subdomain name for your organization’s Observability Platform instance.
METHOD: The HTTP method to use with the request, such as GET or POST.
ENDPOINT_PATH: The specific endpoint you want to access.

Observability Platform

Telemetry Pipeline

Tools

More information

View teams

View teams and their collections

View a list of teams to manage

Manage teams

Create a team

Edit team membership

Assign team roles and permissions

Add a role to a team

Remove a role from a team

Rename a team

Describe a team

Delete a team

Observability Platform

Telemetry Pipeline

Tools

More information

​View teams

​View teams and their collections

​View a list of teams to manage

​Manage teams

​Create a team

​Edit team membership

​Assign team roles and permissions

​Add a role to a team

​Remove a role from a team

​Rename a team

​Describe a team

​Delete a team

View teams

View teams and their collections

View a list of teams to manage

Manage teams

Create a team

Edit team membership

Assign team roles and permissions

Add a role to a team

Remove a role from a team

Rename a team

Describe a team

Delete a team