Skip to main content

​
Overview

Niro supports multi-tenancy through a recursive organization tree. This makes it well-suited for MSPs and platform teams managing fleets on behalf of multiple customers or internal teams. Every user is a member of one or more organizations. Every cluster belongs to exactly one organization. A member of a parent organization can see and manage all clusters in that org’s subtree — including child orgs and their clusters.

​
Organization model

In this example:
  • A member of Customer A Org sees only production-a and staging-a
  • A member of MSP Org sees all four clusters (through the org subtree)
  • Customer A and Customer B members can’t see each other’s clusters

​
Creating a child organization

Currently, child organizations are created by the platform admin. If you need a multi-org structure for your MSP use case, contact support.

​
Members and roles

Each organization has members with roles: Roles are per-organization — a user can be an Operator in one org and a Viewer in another.

​
What each role can and cannot do

An Owner can do everything an Admin can, plus:
  • Manage billing and upgrade the plan
  • Delete the organization
Typically assigned to the founding member or account holder. Every organization must have at least one Owner.
An Admin can:
  • Invite and remove members, change member roles
  • Create and delete clusters
  • Apply deployments, approve remediations, manage config
  • Access all clusters and namespaces in the org
Admins cannot change billing or delete the organization.
An Operator can:
  • Apply deployments to clusters
  • Approve and reject remediations
  • Create and update Secrets and ConfigMaps
  • View cluster health, pods, logs, incidents, and policies
Operators cannot invite members, change settings, or create/delete clusters. If namespace scoping is set, Operators see only their allowed namespaces.This role is suited for application teams that need to deploy and operate workloads but should not have org-admin access.
A Viewer can:
  • View cluster health, nodes, and pods
  • View deployments and apply history
  • Stream pod logs (if the cluster has log capability enabled)
  • View incidents, policy findings, cost, and rightsizing data
Viewers cannot apply deployments, approve remediations, or make any changes. If namespace scoping is set, Viewers see only their allowed namespaces.This role is suited for stakeholders, on-call engineers, or auditors who need visibility without write access.

​
Namespace-scoped access

Members with Operator or Viewer roles can be scoped to specific namespaces within a cluster. A namespace-scoped member sees only pods, deployments, config, and logs in their allowed namespaces — resources in other namespaces are hidden as if they don’t exist. Example use case: an application team responsible for the payments namespace can be given Operator access scoped to payments only. They can deploy, view logs, and manage config in their namespace without seeing (or accidentally affecting) other namespaces.

​
Setting namespace scopes

When inviting a member, select the Operator or Viewer role, then specify which namespaces they should have access to. You can scope to one namespace, multiple namespaces, or leave it unrestricted (all namespaces). Namespace scopes can be changed after invitation from Settings → Members → edit the member.
Owner and Admin roles always have access to all namespaces and cannot be namespace-scoped. Namespace scoping applies per-cluster — a member can be scoped to payments in one cluster and have full access in another.

​
Inviting teammates

Go to Settings → Members and click Invite. Enter the team member’s email address and select their role. The invitation is sent by email. When the invitee signs up (or logs in to an existing account), they’re added to the organization.

​
Authentication

Niro uses a self-hosted authentication system (no third-party auth vendor):
  • Email + password: sign up with your email and a password.
  • GitHub OAuth: sign in with your GitHub account.
Sessions last 24 hours and are refreshed automatically while you’re active.

​
Password reset

If you’ve forgotten your password, use the Forgot password link on the login page. Niro sends a one-time reset link to your email.

​
Plans and billing

Each organization is on a plan that controls feature access. See Plans for the full feature matrix. Plans are managed by the organization Owner in Settings → Billing.

​
Organization settings

Settings → General:
  • Organization name
  • Default auto-sync setting for new deployments
Settings → Members:
  • Invite and manage team members
Settings → Alerts:
  • Configure notification channels (Slack, Discord, PagerDuty, Webhook, Incident.io)
  • Set auto-investigation mode
Settings → Billing:
  • View current plan
  • Upgrade or downgrade

Plans

Feature availability by plan, including org hierarchy.

Alerts & Incidents

Org-level notification channel configuration.

Audit Log

Review every member action and deployment across the org.

Connect a Cluster

Enroll clusters into the organization.
Last modified on June 19, 2026