Skip to content

Commit 8a0575b

Browse files
themr0cAndrienkoAleksandr
themr0c
and
AndrienkoAleksandr
authored
RHID-3976 Managing authorization by importing external files (redhat-developer#704)
Co-authored-by: Oleksandr Andriienko <[email protected]>
1 parent 2a2dcd5 commit 8a0575b

12 files changed

+254
-428
lines changed

Diff for: ‎assemblies/assembly-configuring-authorization-in-rhdh.adoc

+2-12
Original file line numberDiff line numberDiff line change
@@ -36,17 +36,10 @@ include::assembly-managing-authorizations-by-using-the-rhdh-web-ui.adoc[leveloff
3636
include::assembly-managing-authorizations-by-using-the-rest-api.adoc[leveloffset=+1]
3737

3838

39-
include::modules/authorization/ref-rbac-permission-policies.adoc[leveloffset=+1]
40-
41-
42-
include::modules/authorization/con-rbac-config-permission-policies.adoc[leveloffset=+2]
43-
39+
include::assembly-managing-authorizations-by-using-external-files.adoc[leveloffset=+1]
4440

45-
include::modules/authorization/con-rbac-config-permission-policies-external-file.adoc[leveloffset=+3]
4641

47-
include::modules/authorization/proc-mounting-the-policy-csv-file-using-the-operator.adoc[leveloffset=+4]
48-
49-
include::modules/authorization/proc-mounting-the-policy-csv-file-using-helm.adoc[leveloffset=+4]
42+
include::modules/authorization/ref-rbac-permission-policies.adoc[leveloffset=+1]
5043

5144

5245
include::modules/authorization/con-rbac-conditional-policies-rhdh.adoc[leveloffset=+1]
@@ -55,9 +48,6 @@ include::modules/authorization/con-rbac-conditional-policies-rhdh.adoc[leveloffs
5548
include::modules/authorization/ref-rbac-conditional-policy-definition.adoc[leveloffset=+2]
5649

5750

58-
include::modules/authorization/proc-rbac-config-conditional-policy-file.adoc[leveloffset=+2]
59-
60-
6151
include::modules/authorization/con-user-stats-rhdh.adoc[leveloffset=+1]
6252

6353

Diff for: ‎assemblies/assembly-managing-authorizations-by-using-external-files.adoc

+10
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
[id='managing-authorizations-by-using-external-files']
2+
= Managing authorizations by using external files
3+
4+
To automate {product} maintenance, you can configure permissions and roles in external files, before starting {product-short}.
5+
6+
7+
include::modules/authorization/proc-defining-authorizations-in-external-files-by-using-the-operator.adoc[leveloffset=+1]
8+
9+
include::modules/authorization/proc-defining-authorizations-in-external-files-by-using-helm.adoc[leveloffset=+1]
10+

Diff for: ‎assemblies/assembly-managing-authorizations-by-using-the-rhdh-web-ui.adoc

+1-1
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
[id='proc-rbac-ui-manage-roles_{context}']
1+
[id='managing-authorizations-by-using-the-web-ui']
22
= Managing role-based access controls (RBAC) using the {product} Web UI
33

44
Policy administrators can use the {product-short} web interface (Web UI) to allocate specific roles and permissions to individual users or groups. Allocating roles ensures that access to resources and functionalities is regulated across the {product-short}.

Diff for: ‎modules/authorization/con-rbac-config-permission-policies-external-file.adoc

-66
This file was deleted.

Diff for: ‎modules/authorization/con-rbac-config-permission-policies.adoc

-7
This file was deleted.

Diff for: ‎modules/authorization/proc-defining-authorizations-in-external-files-by-using-helm.adoc

+105
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,105 @@
1+
[id='defining-authorizations-in-external-files-by-using-helm']
2+
= Defining authorizations in external files by using Helm
3+
4+
To automate {product} maintenance, you can define permissions and roles in external files, before starting {product-short}.
5+
You need to prepare your files, upload them to your {ocp-short} project,
6+
and configure {product-short} to use the external files.
7+
8+
.Prerequisites
9+
* xref:enabling-and-giving-access-to-rbac[You enabled the RBAC feature].
10+
11+
.Procedure
12+
. Define your policies in a `rbac-policies.csv` CSV file by using the following format:
13+
14+
.. Define role permissions:
15+
+
16+
[source,csv,subs="+quotes"]
17+
----
18+
p, _<role_entity_reference>_, _<permission>_, _<action>_, _<allow_or_deny>_
19+
----
20+
21+
_<role_entity_reference>_::
22+
Role entity reference, such as: `role:default/guest`.
23+
24+
_<permission>_::
25+
Permission, such as: `bulk.import`, `catalog.entity.read`, or `catalog.entity.refresh`, or permission resource type, such as: `bulk-import` or `catalog-entity`.
26+
+
27+
See: xref:ref-rbac-permission-policies_{context}[Permission policies reference].
28+
_<action>_::
29+
Action type, such as: `use`, `read`, `create`, `update`, `delete`.
30+
31+
_<allow_or_deny>_::
32+
Access granted: `allow` or `deny`.
33+
34+
.. Assign the role to a group or a user:
35+
+
36+
[source,csv,subs="+quotes"]
37+
----
38+
g, _<group_or_user>_, _<role_entity_reference>_
39+
----
40+
41+
_<group_or_user>_::
42+
Group, such as: `user:default/mygroup`, or user, such as: `user:default/myuser`.
43+
+
44+
.Sample `rbac-policies.csv`
45+
[source,csv,subs="+quotes"]
46+
----
47+
p, role:default/guests, catalog-entity, read, allow
48+
p, role:default/guests, catalog.entity.create, create, allow
49+
g, user:default/my-user, role:default/guests
50+
g, group:default/my-group, role:default/guests
51+
----
52+
53+
. Define your conditional policies in a `rbac-conditional-policies.yaml` YAML file by using the following format:
54+
+
55+
[source,yaml,subs="+quotes"]
56+
----
57+
result: CONDITIONAL
58+
roleEntityRef: _<role_entity_reference>_
59+
pluginId: _<plugin_id>_
60+
permissionMapping:
61+
- read
62+
- update
63+
- delete
64+
conditions: _<conditions>_
65+
----
66+
+
67+
See: xref:ref-rbac-conditional-policy-definition_{context}[Conditional policies reference].
68+
69+
. Upload your `rbac-policies.csv` and `rbac-conditional-policies.yaml` files to a `rbac-policies` config map in your {ocp-short} project containing {product-short}.
70+
+
71+
[source,terminal]
72+
----
73+
$ oc create configmap rbac-policies \
74+
--from-file=rbac-policies.csv \
75+
--from-file=rbac-conditional-policies.yaml
76+
----
77+
78+
. Update your {product-short} `Backstage` Helm chart to mount in the {product-short} filesystem your files from the `rbac-policies` config map:
79+
80+
.. In the {product-short} Helm Chart, go to *Root Schema -> Backstage chart schema -> Backstage parameters -> Backstage container additional volume mounts*.
81+
82+
.. Select *Add Backstage container additional volume mounts* and add the following values:
83+
84+
mountPath:: `/opt/app-root/src`
85+
Name:: `rbac-policies`
86+
87+
.. Add the RBAC policy to the *Backstage container additional volumes* in the {product-short} Helm Chart:
88+
89+
name:: `rbac-policies`
90+
configMap::
91+
defaultMode::: `420`
92+
name::: `rbac-policies`
93+
94+
. Update your {product-short} `app-config.yaml` configuration file to use the `rbac-policies.csv` and `rbac-conditional-policies.yaml` external files:
95+
+
96+
.`app-config.yml` fragment
97+
[source,yaml]
98+
----
99+
permission:
100+
enabled: true
101+
rbac:
102+
conditionalPoliciesFile: /opt/app-root/src/rbac-conditional-policies.yaml
103+
policies-csv-file: /opt/app-root/src/rbac-policies.csv
104+
policyFileReload: true
105+
----

Diff for: ‎modules/authorization/proc-defining-authorizations-in-external-files-by-using-the-operator.adoc

+104
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,104 @@
1+
[id='defining-authorizations-in-external-files-by-using-the-operator']
2+
= Defining authorizations in external files by using the operator
3+
4+
To automate {product} maintenance, you can define permissions and roles in external files, before starting {product-short}.
5+
You need to prepare your files, upload them to your {ocp-short} project,
6+
and configure {product-short} to use the external files.
7+
8+
.Prerequisites
9+
* xref:enabling-and-giving-access-to-rbac[You enabled the RBAC feature].
10+
11+
.Procedure
12+
. Define your policies in a `rbac-policies.csv` CSV file by using the following format:
13+
14+
.. Define role permissions:
15+
+
16+
[source,csv,subs="+quotes"]
17+
----
18+
p, _<role_entity_reference>_, _<permission>_, _<action>_, _<allow_or_deny>_
19+
----
20+
21+
_<role_entity_reference>_::
22+
Role entity reference, such as: `role:default/guest`.
23+
24+
_<permission>_::
25+
Permission, such as: `bulk.import`, `catalog.entity.read`, or `catalog.entity.refresh`, or permission resource type, such as: `bulk-import` or `catalog-entity`.
26+
+
27+
See: xref:ref-rbac-permission-policies_{context}[Permission policies reference].
28+
_<action>_::
29+
Action type, such as: `use`, `read`, `create`, `update`, `delete`.
30+
31+
_<allow_or_deny>_::
32+
Access granted: `allow` or `deny`.
33+
34+
.. Assign the role to a group or a user:
35+
+
36+
[source,csv,subs="+quotes"]
37+
----
38+
g, _<group_or_user>_, _<role_entity_reference>_
39+
----
40+
41+
_<group_or_user>_::
42+
Group, such as: `user:default/mygroup`, or user, such as: `user:default/myuser`.
43+
+
44+
.Sample `rbac-policies.csv`
45+
[source,csv,subs="+quotes"]
46+
----
47+
p, role:default/guests, catalog-entity, read, allow
48+
p, role:default/guests, catalog.entity.create, create, allow
49+
g, user:default/my-user, role:default/guests
50+
g, group:default/my-group, role:default/guests
51+
----
52+
53+
. Define your conditional policies in a `rbac-conditional-policies.yaml` YAML file by using the following format:
54+
+
55+
[source,yaml,subs="+quotes"]
56+
----
57+
result: CONDITIONAL
58+
roleEntityRef: _<role_entity_reference>_
59+
pluginId: _<plugin_id>_
60+
permissionMapping:
61+
- read
62+
- update
63+
- delete
64+
conditions: _<conditions>_
65+
----
66+
+
67+
See: xref:ref-rbac-conditional-policy-definition_{context}[Conditional policies reference].
68+
69+
. Upload your `rbac-policies.csv` and `rbac-conditional-policies.yaml` files to a `rbac-policies` config map in your {ocp-short} project containing {product-short}.
70+
+
71+
[source,terminal]
72+
----
73+
$ oc create configmap rbac-policies \
74+
--from-file=rbac-policies.csv \
75+
--from-file=rbac-conditional-policies.yaml
76+
----
77+
78+
. Update your {product-short} `Backstage` custom resource to mount in the {product-short} filesystem your files from the `rbac-policies` config map:
79+
+
80+
.`Backstage` Custom resource fragment
81+
[source,yaml]
82+
----
83+
apiVersion: rhdh.redhat.com/v1alpha1
84+
kind: Backstage
85+
spec:
86+
application:
87+
extraFiles:
88+
mountPath: /opt/app-root/src
89+
configMaps:
90+
- name: rbac-policies
91+
----
92+
93+
. Update your {product-short} `app-config.yaml` configuration file to use the `rbac-policies.csv` and `rbac-conditional-policies.yaml` external files:
94+
+
95+
.`app-config.yml` fragment
96+
[source,yaml]
97+
----
98+
permission:
99+
enabled: true
100+
rbac:
101+
conditionalPoliciesFile: /opt/app-root/src/rbac-conditional-policies.yaml
102+
policies-csv-file: /opt/app-root/src/rbac-policies.csv
103+
policyFileReload: true
104+
----

Diff for: ‎modules/authorization/proc-mounting-the-policy-csv-file-using-helm.adoc

-66
This file was deleted.

0 commit comments

Comments
 (0)