You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
[FMEPRD-294] FME RBAC guide: Update FME role names (#11654)
Update role names to new names already displayed in Harness (in text and images):
Split FME Administrator Role → FME Administrator Role
Split FME Manager Role → FME Manager Role
Replace the organization structure PNG image with a mermaid diagram.
Copy file name to clipboardExpand all lines: docs/feature-management-experimentation/split-to-harness/administering-migrated-account.md
+23-11Lines changed: 23 additions & 11 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -8,6 +8,10 @@ sidebar_position: 3
8
8
import Tabs from '@theme/Tabs';
9
9
import TabItem from '@theme/TabItem';
10
10
11
+
import UnrestrictedProjectGroupsImage from '@site/docs/feature-management-experimentation/split-to-harness/static/unrestricted-project-groups.svg';
12
+
13
+
import RestrictedProjectGroupsImage from '@site/docs/feature-management-experimentation/split-to-harness/static/restricted-project-groups.svg';
14
+
11
15
## Overview
12
16
13
17
This guide is intended to be used as a reference shortly after your migration into Harness to guide you through administrative tasks. It will also help you understand permissions in Harness after your Split-to-Harness migration. It explains how legacy **Split access restrictions** map to **Harness RBAC (role-based access control) settings** in two ways:
@@ -238,7 +242,7 @@ To grant similar permissions to your legacy Split settings, the new Harness FME
238
242
</td>
239
243
<td>
240
244
<p>
241
-
Split FME Administrator Role
245
+
FME Administrator Role
242
246
</p>
243
247
<p>
244
248
Project Viewer
@@ -262,7 +266,7 @@ To grant similar permissions to your legacy Split settings, the new Harness FME
262
266
</td>
263
267
<td>
264
268
<p>
265
-
Split FME Manager Role
269
+
FME Manager Role
266
270
</p>
267
271
<p>
268
272
Project Viewer
@@ -309,7 +313,7 @@ To grant similar permissions to your legacy Split settings, the new Harness FME
309
313
</td>
310
314
<td>
311
315
<p>
312
-
Split FME Manager Role
316
+
FME Manager Role
313
317
</p>
314
318
<p>
315
319
Project Viewer
@@ -356,14 +360,14 @@ To grant similar permissions to your legacy Split settings, the new Harness FME
356
360
:::warning In legacy Split groups with both editors and viewers – Editors will lose permissions.
357
361
If a group in legacy Split had both editors and viewers (legacy roles) and the group was given access to a restricted project, then post-migration the Harness group will be assigned only the **Project Viewer** role. (This prevents viewers from gaining broader permissions upon migration.) The users that were legacy Split editors will no longer have edit permissions for the project.
358
362
359
-
Since RBAC is additive, you can assign edit permissions by adding the Harness user (with the legacy Editor role) at the project level and assigning the role binding: **Split FME Manager Role** role over the **All Project Level Resources** (or **FME All Resources**) resource group.
363
+
Since RBAC is additive, you can assign edit permissions by adding the Harness user (with the legacy Editor role) at the project level and assigning the role binding: **FME Manager Role** role over the **All Project Level Resources** (or **FME All Resources**) resource group.
360
364
:::
361
365
362
366
#### Examples showing user group inheritance and role bindings
363
367
364
368
For an unrestricted project:
365
369
366
-

370
+
<UnrestrictedProjectGroupsImage />
367
371
368
372
The Website project was an unrestricted project in legacy Split. After migration, the FME user groups (**All FME Admins**, **All FME Editors**, and **All FME Viewers**) are inherited and role bindings are assigned at the project level as shown above. (All role bindings are for the **All Project Level Resources** resource group, created on the Harness Free plan. On the Harness Enterprise plan, the **FME All Resources** resource group would be created and used instead.)
369
373
@@ -373,7 +377,7 @@ The **All Project Users** is a Harness managed group that is created on project
373
377
374
378
For a restricted project:
375
379
376
-

380
+
<RestrictedProjectGroupsImage />
377
381
378
382
The API project was a restricted project in legacy Split. After migration, only the **All FME Admins** user group and another user group are inherited at the project level, because these were explicitly added to the legacy Split project.
379
383
@@ -761,8 +765,8 @@ To implement permissions similar to the legacy Split unrestricted project:
761
765
762
766
From your **Project Settings** inherit each of the [FME user groups](#fme-user-groups) and add the following project-level role bindings:
763
767
764
-
- All FME Admins: **Split FME Administrator Role** - **FME All Resources**\*
765
-
- All FME Editors: **Split FME Manager Role** - **FME All Resources**\*
768
+
- All FME Admins: **FME Administrator Role** - **FME All Resources**\*
769
+
- All FME Editors: **FME Manager Role** - **FME All Resources**\*
766
770
- All FME Viewers: **Project Viewer** - **FME All Resources**\*
767
771
768
772
Role bindings added at the project level grant access to the given project.
@@ -780,8 +784,8 @@ To implement permissions similar to the legacy Split restricted project:
780
784
781
785
1. Apply a role binding for **FME All Resources**\* that assigns one of the following roles:
782
786
783
-
-**Split FME Administrator Role** corresponds to the legacy Split Administrator permissions
784
-
-**Split FME Manager Role** corresponds to the legacy Editor role
787
+
-**FME Administrator Role** corresponds to the legacy Split Administrator permissions
788
+
-**FME Manager Role** corresponds to the legacy Editor role
785
789
-**Project Viewer** corresponds to the legacy Viewer role
786
790
787
791
</TabItem>
@@ -871,7 +875,15 @@ The environment scope of Admin API keys created in Harness post-migration will b
871
875
872
876
An organization is a Harness entity that fits into the Harness structure as shown below.
873
877
874
-

878
+
```mermaid
879
+
flowchart TD
880
+
A[Account] --> B(Organization)
881
+
A[Account] --> C(Organization)
882
+
B --> D[Project]
883
+
B --> E[Project]
884
+
C --> F[Project]
885
+
C --> G[Project]
886
+
```
875
887
876
888
The migration script created Harness projects that correspond to legacy Split projects. These Harness projects are created in the **default** organization (on the Free plan) or in an organization named <strong> *legacy Split account name* FME</strong> (on the Enterprise plan).
0 commit comments