Also manage/sync "admin" roles?

[rocketeerbkw]

Seems to me that there isn't any way for lagoon admin roles (platform-owner, platform-viewer, etc) to have admin access to opensearch unless it was done by whoever installed/configured opensearch.

Should this be handled with this tool, since it's also syncing project roles?

[smlx]

These roles aren't dynamic, which is why they aren't currently synced. These static roles are instead configured via the opensearch config file.

If there are likely to be more platform-* roles in future that would be added to Lagoon then maybe it makes sense for the sync tool to manage these. But equally it seems to me that it would be fairly simple to make adding new static roles to opensearch part of the Lagoon upgrade procedure.

[rocketeerbkw]

I don't know if there will be more or not, and I agree that it should be "part of the Lagoon upgrade procedure," but when looking for a place in lagoon to manage these roles automatically, I thought this tool was the best place since it's already where all opensearch "stuff" is happening.

So I'm suggesting that instead of some lagoon related roles having to be done manually in a config file and some of them being synced automatically by this tool, they just all move to this tool.