Skip to content

Commit 6219278

Browse files
authored
[FMEPRD-294] FME RBAC guide: Update FME role names (#11654)
Update role names to new names already displayed in Harness (in text and images): Split FME Administrator Role → FME Administrator Role Split FME Manager Role → FME Manager Role Replace the organization structure PNG image with a mermaid diagram.
1 parent 444cf97 commit 6219278

File tree

6 files changed

+137
-11
lines changed

6 files changed

+137
-11
lines changed

docs/feature-management-experimentation/split-to-harness/administering-migrated-account.md

Lines changed: 23 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -8,6 +8,10 @@ sidebar_position: 3
88
import Tabs from '@theme/Tabs';
99
import TabItem from '@theme/TabItem';
1010

11+
import UnrestrictedProjectGroupsImage from '@site/docs/feature-management-experimentation/split-to-harness/static/unrestricted-project-groups.svg';
12+
13+
import RestrictedProjectGroupsImage from '@site/docs/feature-management-experimentation/split-to-harness/static/restricted-project-groups.svg';
14+
1115
## Overview
1216

1317
This guide is intended to be used as a reference shortly after your migration into Harness to guide you through administrative tasks. It will also help you understand permissions in Harness after your Split-to-Harness migration. It explains how legacy **Split access restrictions** map to **Harness RBAC (role-based access control) settings** in two ways:
@@ -238,7 +242,7 @@ To grant similar permissions to your legacy Split settings, the new Harness FME
238242
</td>
239243
<td>
240244
<p>
241-
Split FME Administrator Role
245+
FME Administrator Role
242246
</p>
243247
<p>
244248
Project Viewer
@@ -262,7 +266,7 @@ To grant similar permissions to your legacy Split settings, the new Harness FME
262266
</td>
263267
<td>
264268
<p>
265-
Split FME Manager Role
269+
FME Manager Role
266270
</p>
267271
<p>
268272
Project Viewer
@@ -309,7 +313,7 @@ To grant similar permissions to your legacy Split settings, the new Harness FME
309313
</td>
310314
<td>
311315
<p>
312-
Split FME Manager Role
316+
FME Manager Role
313317
</p>
314318
<p>
315319
Project Viewer
@@ -356,14 +360,14 @@ To grant similar permissions to your legacy Split settings, the new Harness FME
356360
:::warning In legacy Split groups with both editors and viewers – Editors will lose permissions.
357361
If a group in legacy Split had both editors and viewers (legacy roles) and the group was given access to a restricted project, then post-migration the Harness group will be assigned only the **Project Viewer** role. (This prevents viewers from gaining broader permissions upon migration.) The users that were legacy Split editors will no longer have edit permissions for the project.
358362

359-
Since RBAC is additive, you can assign edit permissions by adding the Harness user (with the legacy Editor role) at the project level and assigning the role binding: **Split FME Manager Role** role over the **All Project Level Resources** (or **FME All Resources**) resource group.
363+
Since RBAC is additive, you can assign edit permissions by adding the Harness user (with the legacy Editor role) at the project level and assigning the role binding: **FME Manager Role** role over the **All Project Level Resources** (or **FME All Resources**) resource group.
360364
:::
361365

362366
#### Examples showing user group inheritance and role bindings
363367

364368
For an unrestricted project:
365369

366-
![](./static/unrestricted-project.png)
370+
<UnrestrictedProjectGroupsImage />
367371

368372
The Website project was an unrestricted project in legacy Split. After migration, the FME user groups (**All FME Admins**, **All FME Editors**, and **All FME Viewers**) are inherited and role bindings are assigned at the project level as shown above. (All role bindings are for the **All Project Level Resources** resource group, created on the Harness Free plan. On the Harness Enterprise plan, the **FME All Resources** resource group would be created and used instead.)
369373

@@ -373,7 +377,7 @@ The **All Project Users** is a Harness managed group that is created on project
373377

374378
For a restricted project:
375379

376-
![](./static/restricted-project.png)
380+
<RestrictedProjectGroupsImage />
377381

378382
The API project was a restricted project in legacy Split. After migration, only the **All FME Admins** user group and another user group are inherited at the project level, because these were explicitly added to the legacy Split project.
379383

@@ -761,8 +765,8 @@ To implement permissions similar to the legacy Split unrestricted project:
761765

762766
From your **Project Settings** inherit each of the [FME user groups](#fme-user-groups) and add the following project-level role bindings:
763767

764-
- All FME Admins: **Split FME Administrator Role** - **FME All Resources**\*
765-
- All FME Editors: **Split FME Manager Role** - **FME All Resources**\*
768+
- All FME Admins: **FME Administrator Role** - **FME All Resources**\*
769+
- All FME Editors: **FME Manager Role** - **FME All Resources**\*
766770
- All FME Viewers: **Project Viewer** - **FME All Resources**\*
767771

768772
Role bindings added at the project level grant access to the given project.
@@ -780,8 +784,8 @@ To implement permissions similar to the legacy Split restricted project:
780784

781785
1. Apply a role binding for **FME All Resources**\* that assigns one of the following roles:
782786

783-
- **Split FME Administrator Role** corresponds to the legacy Split Administrator permissions
784-
- **Split FME Manager Role** corresponds to the legacy Editor role
787+
- **FME Administrator Role** corresponds to the legacy Split Administrator permissions
788+
- **FME Manager Role** corresponds to the legacy Editor role
785789
- **Project Viewer** corresponds to the legacy Viewer role
786790

787791
</TabItem>
@@ -871,7 +875,15 @@ The environment scope of Admin API keys created in Harness post-migration will b
871875

872876
An organization is a Harness entity that fits into the Harness structure as shown below.
873877

874-
![](./static/org-diagram.png)
878+
```mermaid
879+
flowchart TD
880+
A[Account] --> B(Organization)
881+
A[Account] --> C(Organization)
882+
B --> D[Project]
883+
B --> E[Project]
884+
C --> F[Project]
885+
C --> G[Project]
886+
```
875887

876888
The migration script created Harness projects that correspond to legacy Split projects. These Harness projects are created in the **default** organization (on the Free plan) or in an organization named <strong> *legacy Split account name* FME</strong> (on the Enterprise plan).
877889

-26.3 KB
Binary file not shown.

docs/feature-management-experimentation/split-to-harness/static/restricted-project-groups.svg

Lines changed: 113 additions & 0 deletions
Loading
-179 KB
Binary file not shown.

docs/feature-management-experimentation/split-to-harness/static/unrestricted-project-groups.svg

Lines changed: 1 addition & 0 deletions
Loading
-318 KB
Binary file not shown.

0 commit comments

Comments
 (0)