Skip to content

Commit 017c0e4

Browse files
Piotr1215Piotr1215
authored
docs(platform): document policy rule fields for clusterroletemplate (#1538)
ClusterRoleTemplate API reference shows PolicyRule fields (verbs, apiGroups, resources, etc.) but the auto-generated reference lacks descriptions. Users needed to generate YAML via UI to discover valid values for CI/CD pipelines. Added explanatory section to the main clusterroletemplate.mdx page documenting: - Standard Kubernetes RBAC verbs with descriptions - Common API groups including vCluster Platform groups - Complete list of management.loft.sh resources - Usage of resourceNames and nonResourceURLs Added to main page rather than auto-generated reference.mdx to ensure content survives regeneration. Addresses DOC-1125
1 parent 1087b00 commit 017c0e4

File tree

3 files changed

+235
-8
lines changed

3 files changed

+235
-8
lines changed

‎platform/api/resources/clusterroletemplate.mdx‎

Lines changed: 77 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -48,6 +48,83 @@ status: {}
4848

4949
```
5050
51+
## Policy rules
52+
53+
The `rules` field under `clusterRoleTemplate` defines RBAC permissions using standard Kubernetes PolicyRule objects. Each rule specifies which actions (verbs) are allowed on which resources.
54+
55+
### Verbs
56+
57+
Verbs define the actions allowed on resources. Standard Kubernetes RBAC verbs include:
58+
59+
| Verb | Description |
60+
|------|-------------|
61+
| `get` | Retrieve a single resource |
62+
| `list` | Retrieve a collection of resources |
63+
| `watch` | Watch for changes to resources |
64+
| `create` | Create a new resource |
65+
| `update` | Update an existing resource (replaces the entire object) |
66+
| `patch` | Partially modify an existing resource |
67+
| `delete` | Delete a single resource |
68+
| `deletecollection` | Delete a collection of resources |
69+
| `*` | Wildcard representing all verbs |
70+
71+
### API groups
72+
73+
API groups define which API the resources belong to. Common API groups include:
74+
75+
| API Group | Description |
76+
|-----------|-------------|
77+
| `""` | Core API group (pods, services, configmaps, secrets, namespaces) |
78+
| `apps` | Deployments, DaemonSets, ReplicaSets, StatefulSets |
79+
| `batch` | Jobs, CronJobs |
80+
| `networking.k8s.io` | NetworkPolicies, Ingresses |
81+
| `rbac.authorization.k8s.io` | Roles, RoleBindings, ClusterRoles, ClusterRoleBindings |
82+
| `management.loft.sh` | vCluster Platform resources |
83+
| `storage.loft.sh` | vCluster Platform storage resources |
84+
| `*` | Wildcard matching all API groups |
85+
86+
### Platform resources
87+
88+
vCluster Platform resources in the `management.loft.sh` API group:
89+
90+
| Resource | Description |
91+
|----------|-------------|
92+
| `announcements` | Platform announcements |
93+
| `apps` | Application configurations |
94+
| `backups` | Platform backups |
95+
| `clusteraccesses` | Cluster access permissions |
96+
| `clusterroletemplates` | Cluster role templates |
97+
| `clusters` | Connected clusters |
98+
| `configs` | Platform configuration |
99+
| `events` | Platform events |
100+
| `features` | Platform features |
101+
| `licenses` | Platform licenses |
102+
| `nodeclaims` | Node claims for auto-provisioning |
103+
| `nodeenvironments` | Node environment configurations |
104+
| `nodeproviders` | Node provider configurations |
105+
| `nodetypes` | Node type definitions |
106+
| `ownedaccesskeys` | User-owned access keys |
107+
| `projects` | Projects |
108+
| `selves` | Current user information |
109+
| `sharedsecrets` | Shared secrets |
110+
| `spaceinstances` | Space instances |
111+
| `spacetemplates` | Space templates |
112+
| `tasks` | Platform tasks |
113+
| `teams` | Teams |
114+
| `users` | Users |
115+
| `virtualclusterinstances` | Virtual cluster instances |
116+
| `virtualclustertemplates` | Virtual cluster templates |
117+
118+
Common subresources include `projects/members`, `projects/templates`, `clusters/members`, `virtualclusterinstances/kubeconfig`, and `virtualclusterinstances/log`.
119+
120+
### Resource names
121+
122+
The `resourceNames` field optionally restricts a rule to specific named resources. When empty, the rule applies to all resources of the specified type.
123+
124+
### Non-resource URLs
125+
126+
The `nonResourceURLs` field specifies access to non-resource endpoints like `/healthz`, `/api`, `/apis`, and `/version`. Use `*` as a suffix to match paths (for example, `/healthz/*`).
127+
51128
## ClusterRoleTemplate reference
52129

53130
<Reference />

‎platform_versioned_docs/version-4.4.0/api/resources/clusterroletemplate.mdx‎

Lines changed: 79 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -13,17 +13,15 @@ An example ClusterRoleTemplate:
1313
```yaml
1414
apiVersion: management.loft.sh/v1
1515
kind: ClusterRoleTemplate
16-
metadata:
17-
creationTimestamp: null
16+
metadata: {}
1817
spec:
1918
access:
2019
- users:
2120
- '*'
2221
verbs:
2322
- get
2423
clusterRoleTemplate:
25-
metadata:
26-
creationTimestamp: null
24+
metadata: {}
2725
rules:
2826
- apiGroups:
2927
- management.loft.sh/v1
@@ -50,6 +48,83 @@ status: {}
5048

5149
```
5250
51+
## Policy rules
52+
53+
The `rules` field under `clusterRoleTemplate` defines RBAC permissions using standard Kubernetes PolicyRule objects. Each rule specifies which actions (verbs) are allowed on which resources.
54+
55+
### Verbs
56+
57+
Verbs define the actions allowed on resources. Standard Kubernetes RBAC verbs include:
58+
59+
| Verb | Description |
60+
|------|-------------|
61+
| `get` | Retrieve a single resource |
62+
| `list` | Retrieve a collection of resources |
63+
| `watch` | Watch for changes to resources |
64+
| `create` | Create a new resource |
65+
| `update` | Update an existing resource (replaces the entire object) |
66+
| `patch` | Partially modify an existing resource |
67+
| `delete` | Delete a single resource |
68+
| `deletecollection` | Delete a collection of resources |
69+
| `*` | Wildcard representing all verbs |
70+
71+
### API groups
72+
73+
API groups define which API the resources belong to. Common API groups include:
74+
75+
| API Group | Description |
76+
|-----------|-------------|
77+
| `""` | Core API group (pods, services, configmaps, secrets, namespaces) |
78+
| `apps` | Deployments, DaemonSets, ReplicaSets, StatefulSets |
79+
| `batch` | Jobs, CronJobs |
80+
| `networking.k8s.io` | NetworkPolicies, Ingresses |
81+
| `rbac.authorization.k8s.io` | Roles, RoleBindings, ClusterRoles, ClusterRoleBindings |
82+
| `management.loft.sh` | vCluster Platform resources |
83+
| `storage.loft.sh` | vCluster Platform storage resources |
84+
| `*` | Wildcard matching all API groups |
85+
86+
### Platform resources
87+
88+
vCluster Platform resources in the `management.loft.sh` API group:
89+
90+
| Resource | Description |
91+
|----------|-------------|
92+
| `announcements` | Platform announcements |
93+
| `apps` | Application configurations |
94+
| `backups` | Platform backups |
95+
| `clusteraccesses` | Cluster access permissions |
96+
| `clusterroletemplates` | Cluster role templates |
97+
| `clusters` | Connected clusters |
98+
| `configs` | Platform configuration |
99+
| `events` | Platform events |
100+
| `features` | Platform features |
101+
| `licenses` | Platform licenses |
102+
| `nodeclaims` | Node claims for auto-provisioning |
103+
| `nodeenvironments` | Node environment configurations |
104+
| `nodeproviders` | Node provider configurations |
105+
| `nodetypes` | Node type definitions |
106+
| `ownedaccesskeys` | User-owned access keys |
107+
| `projects` | Projects |
108+
| `selves` | Current user information |
109+
| `sharedsecrets` | Shared secrets |
110+
| `spaceinstances` | Space instances |
111+
| `spacetemplates` | Space templates |
112+
| `tasks` | Platform tasks |
113+
| `teams` | Teams |
114+
| `users` | Users |
115+
| `virtualclusterinstances` | Virtual cluster instances |
116+
| `virtualclustertemplates` | Virtual cluster templates |
117+
118+
Common subresources include `projects/members`, `projects/templates`, `clusters/members`, `virtualclusterinstances/kubeconfig`, and `virtualclusterinstances/log`.
119+
120+
### Resource names
121+
122+
The `resourceNames` field optionally restricts a rule to specific named resources. When empty, the rule applies to all resources of the specified type.
123+
124+
### Non-resource URLs
125+
126+
The `nonResourceURLs` field specifies access to non-resource endpoints like `/healthz`, `/api`, `/apis`, and `/version`. Use `*` as a suffix to match paths (for example, `/healthz/*`).
127+
53128
## ClusterRoleTemplate reference
54129

55130
<Reference />

‎platform_versioned_docs/version-4.5.0/api/resources/clusterroletemplate.mdx‎

Lines changed: 79 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -13,17 +13,15 @@ An example ClusterRoleTemplate:
1313
```yaml
1414
apiVersion: management.loft.sh/v1
1515
kind: ClusterRoleTemplate
16-
metadata:
17-
creationTimestamp: null
16+
metadata: {}
1817
spec:
1918
access:
2019
- users:
2120
- '*'
2221
verbs:
2322
- get
2423
clusterRoleTemplate:
25-
metadata:
26-
creationTimestamp: null
24+
metadata: {}
2725
rules:
2826
- apiGroups:
2927
- management.loft.sh/v1
@@ -50,6 +48,83 @@ status: {}
5048

5149
```
5250
51+
## Policy rules
52+
53+
The `rules` field under `clusterRoleTemplate` defines RBAC permissions using standard Kubernetes PolicyRule objects. Each rule specifies which actions (verbs) are allowed on which resources.
54+
55+
### Verbs
56+
57+
Verbs define the actions allowed on resources. Standard Kubernetes RBAC verbs include:
58+
59+
| Verb | Description |
60+
|------|-------------|
61+
| `get` | Retrieve a single resource |
62+
| `list` | Retrieve a collection of resources |
63+
| `watch` | Watch for changes to resources |
64+
| `create` | Create a new resource |
65+
| `update` | Update an existing resource (replaces the entire object) |
66+
| `patch` | Partially modify an existing resource |
67+
| `delete` | Delete a single resource |
68+
| `deletecollection` | Delete a collection of resources |
69+
| `*` | Wildcard representing all verbs |
70+
71+
### API groups
72+
73+
API groups define which API the resources belong to. Common API groups include:
74+
75+
| API Group | Description |
76+
|-----------|-------------|
77+
| `""` | Core API group (pods, services, configmaps, secrets, namespaces) |
78+
| `apps` | Deployments, DaemonSets, ReplicaSets, StatefulSets |
79+
| `batch` | Jobs, CronJobs |
80+
| `networking.k8s.io` | NetworkPolicies, Ingresses |
81+
| `rbac.authorization.k8s.io` | Roles, RoleBindings, ClusterRoles, ClusterRoleBindings |
82+
| `management.loft.sh` | vCluster Platform resources |
83+
| `storage.loft.sh` | vCluster Platform storage resources |
84+
| `*` | Wildcard matching all API groups |
85+
86+
### Platform resources
87+
88+
vCluster Platform resources in the `management.loft.sh` API group:
89+
90+
| Resource | Description |
91+
|----------|-------------|
92+
| `announcements` | Platform announcements |
93+
| `apps` | Application configurations |
94+
| `backups` | Platform backups |
95+
| `clusteraccesses` | Cluster access permissions |
96+
| `clusterroletemplates` | Cluster role templates |
97+
| `clusters` | Connected clusters |
98+
| `configs` | Platform configuration |
99+
| `events` | Platform events |
100+
| `features` | Platform features |
101+
| `licenses` | Platform licenses |
102+
| `nodeclaims` | Node claims for auto-provisioning |
103+
| `nodeenvironments` | Node environment configurations |
104+
| `nodeproviders` | Node provider configurations |
105+
| `nodetypes` | Node type definitions |
106+
| `ownedaccesskeys` | User-owned access keys |
107+
| `projects` | Projects |
108+
| `selves` | Current user information |
109+
| `sharedsecrets` | Shared secrets |
110+
| `spaceinstances` | Space instances |
111+
| `spacetemplates` | Space templates |
112+
| `tasks` | Platform tasks |
113+
| `teams` | Teams |
114+
| `users` | Users |
115+
| `virtualclusterinstances` | Virtual cluster instances |
116+
| `virtualclustertemplates` | Virtual cluster templates |
117+
118+
Common subresources include `projects/members`, `projects/templates`, `clusters/members`, `virtualclusterinstances/kubeconfig`, and `virtualclusterinstances/log`.
119+
120+
### Resource names
121+
122+
The `resourceNames` field optionally restricts a rule to specific named resources. When empty, the rule applies to all resources of the specified type.
123+
124+
### Non-resource URLs
125+
126+
The `nonResourceURLs` field specifies access to non-resource endpoints like `/healthz`, `/api`, `/apis`, and `/version`. Use `*` as a suffix to match paths (for example, `/healthz/*`).
127+
53128
## ClusterRoleTemplate reference
54129

55130
<Reference />

0 commit comments

Comments
 (0)