Skip to content

Commit eedb8ec

Browse files
mjangmjang
authored
Merge branch 'main' into update-nim-helm-charts
2 parents 93c3035 + d9836d1 commit eedb8ec

File tree

7 files changed

+119
-4
lines changed

7 files changed

+119
-4
lines changed

‎CONTRIBUTING_DOCS.md‎

Lines changed: 20 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -64,7 +64,7 @@ We have templates for the following types of documentation:
6464

6565
## How to format docs
6666

67-
### Basic markdown formatting
67+
### Basic Markdown formatting
6868

6969
There are multiple ways to format text: for consistency and clarity, these are our conventions:
7070

@@ -152,6 +152,25 @@ Here are some other shortcodes:
152152
- `readfile`: Include the content of another file in the current file, which can be in an arbitrary location.
153153
- `bootstrap-table`: formats a table using Bootstrap classes; accepts any bootstrap table classes as additional arguments, e.g. `{{< bootstrap-table "table-bordered table-hover" }}`
154154

155+
### How to use Hugo includes
156+
157+
As mentioned above, [Hugo includes](https://gohugo.io/contribute/documentation/#include) are a custom shortcode that allows you to reference reusable content stored in the [`/content/includes` directory](https://github.com/nginx/documentation/tree/main/content/includes).
158+
159+
For example, if the [`controller/add-existing-instance.md`](https://github.com/nginx/documentation/blob/main/content/includes/controller/add-existing-instance.md) file contains instructions on adding an instance to the NGINX Controller, you can reuse it on multiple pages by adding:
160+
161+
```md
162+
{{< include "controller/add-existing-instance.md" >}}
163+
```
164+
165+
The `controller/add-existing-instance.md` file is included in the following pages on the NGINX Docs Site:
166+
167+
- [Add an NGINX App Protect Instance](https://github.com/nginx/documentation/blob/main/content/controller/infrastructure/instances/add-nap-instance.md?plain=1#L35)
168+
- [Manage Your NGINX Instances](https://github.com/nginx/documentation/blob/main/content/controller/infrastructure/instances/manage-instances.md?plain=1#L29)
169+
- [Trial NGINX Controller with NGINX Plus](https://github.com/nginx/documentation/blob/main/content/controller/admin-guides/install/try-nginx-controller.md?plain=1#L277)
170+
- [Trial NGINX Controller with App Security](https://github.com/nginx/documentation/blob/main/content/controller/admin-guides/install/try-nginx-controller-app-sec.md?plain=1#L290)
171+
172+
This ensures that content is defined once and referenced in multiple places without duplication.
173+
155174
## Linting
156175

157176
To run the markdownlint check, run the following command, which uses the .markdownlint.yaml file to specify rules. For `<content>`, specify the path to your Markdown files:

‎content/includes/security/rbac-intro.md‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
---
2+
files:
3+
- content/nginx-one/rbac/overview.md
4+
- content/nim/admin-guide/rbac/overview-rbac.md
5+
docs: DOCS-000
6+
---
7+
Role-based access control (RBAC) is a security system that governs access to resources within a software application. By assigning specific roles to users or groups, RBAC ensures that only authorized individuals have the ability to perform certain actions or access particular areas.
8+
9+
The value of RBAC lies in its ability to provide clear and structured control over what users can see and do. This makes it easier to maintain security, streamline user management, and ensure compliance with internal policies or regulations. By giving users only the permissions they need to fulfill their roles, RBAC reduces the risk of unauthorized access and fosters a more efficient and secure operating environment.

‎content/nginx-one/rbac/_index.md‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
---
2+
title: Role-based access control
3+
description:
4+
weight: 300
5+
url: /nginx-one/rbac
6+
---

‎content/nginx-one/rbac/overview.md‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
---
2+
title: "Role-based access control overview"
3+
weight: 400
4+
toc: true
5+
type: reference
6+
product: NGINX One
7+
docs: DOCS-000
8+
---
9+
10+
{{< include "security/rbac-intro.md" >}}
11+
12+
The NGINX One Console uses the **[F5 Distributed Cloud User Management](https://docs.cloud.f5.com/docs-v2/administration/how-tos/user-mgmt)** system for access controls and user permissions.
13+
General information can be found on the User Management documentation for **[F5 Distributed Cloud](https://docs.cloud.f5.com/docs-v2/administration/how-tos/user-mgmt)**. This document provides guidance and reference material for utilizing those features to grant and restrict access within the NGINX One Console.

‎content/nginx-one/rbac/rbac-api.md‎

Lines changed: 45 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,45 @@
1+
---
2+
title: "Custom roles and API groups"
3+
weight: 500
4+
toc: true
5+
type: reference
6+
product: NGINX One
7+
docs: DOCS-000
8+
---
9+
10+
Beyond [Default roles]({{< relref "/nginx-one/rbac/roles.md" >}}), you may need to set up custom roles. For convenience, we include a list of API groups that you could use to specify permissions for custom roles.
11+
12+
These are not NGINX One APIs.
13+
14+
## F5 API groups for NGINX One
15+
16+
The following table lists the **[F5 XC roles](https://docs.cloud.f5.com/docs-v2/administration/how-tos/user-mgmt/roles)** that you can use. These are narrowly scoped API Groups that align with all the features and functionality within the NGINX One Console. These groups can help you create custom roles tailored to your specific needs.
17+
18+
{{< note >}}If you create custom roles using the more granular API Groups, users may not have access until you add the corresponding API Groups to their roles.{{< /note >}}
19+
20+
| API Group Name | Level of Access | Description |
21+
|-----------------------------------------|-----------------|-------------------------------------------------------------------------------------------------------------------------------|
22+
| f5xc-nginx-one-application-monitor | Read | View all features and data. |
23+
| f5xc-nginx-one-application-settings | Write | View and update settings. |
24+
| f5xc-nginx-one-application-write | Write | View and edit all features except settings. |
25+
| f5xc-nginx-one-custom-all-instances-metric-read | Read | View metrics for all Instances. Required to see the Overview dashboard. |
26+
| f5xc-nginx-one-custom-instance-list | Read | View list of all Instances. Also view summarized information such as certificate status and CVEs. |
27+
| f5xc-nginx-one-custom-all-instances-manage | Write | View and delete all Instances. |
28+
| f5xc-nginx-one-custom-instance-manage | Write | View and edit Instance details. |
29+
| f5xc-nginx-one-custom-instance-read | Read | View Instance and configuration details. |
30+
| f5xc-nginx-one-custom-certificate-manage | Write | View TSL/SSL certificate details. Create, update, and delete any managed certificates. |
31+
| f5xc-nginx-one-custom-certificate-read | Read | View TLS/SSL certificates. |
32+
| f5xc-nginx-one-custom-all-certificates-manage | Write | View all TLS/SSL certificates. Delete managed certificates. |
33+
| f5xc-nginx-one-custom-data-plane-key-manage | Write | View, create, update, and delete any Data Plane Keys. Note: The actual Data Plane Key is shown _only_ when created. |
34+
| f5xc-nginx-one-custom-data-plane-key-read | Read | View Data Plane Key Details. Note: The actual Data Plane Key is shown _only_ when created. |
35+
| f5xc-nginx-one-custom-all-data-plane-keys-manage | Write | View and delete Data Plane Keys. |
36+
| f5xc-nginx-one-custom-cve-read | Read | View NGINX CVEs. |
37+
| f5xc-nginx-one-custom-config-sync-group-manage | Write | View, create, update, and delete Config Sync Groups. |
38+
| f5xc-nginx-one-custom-config-sync-group-read | Read | View Config Sync Groups with details. |
39+
| f5xc-nginx-one-custom-all-config-sync-groups-manage | Write | View and delete Config Sync Groups. |
40+
| f5xc-nginx-one-custom-settings-manage | Write | View and update NGINX One Console Settings. |
41+
| f5xc-nginx-one-custom-settings-read | Read | View NGINX One Console Settings. |
42+
| f5xc-nginx-one-custom-event-read | Read | View NGINX One Events. |
43+
| f5xc-nginx-one-custom-ai-assistant | Write | Interact with the NGINX One AI Assistant. |
44+
| f5xc-nginx-one-custom-staged-config-manage | Write | View, create, update, and delete Staged Configs. |
45+
| f5xc-nginx-one-custom-staged-config-read | Read | View Staged Configs. |

‎content/nginx-one/rbac/roles.md‎

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
---
2+
title: "Default roles"
3+
weight: 500
4+
toc: true
5+
type: reference
6+
product: NGINX One
7+
docs: DOCS-000
8+
---
9+
10+
## Default roles
11+
12+
We provide three default **[roles](https://docs.cloud.f5.com/docs-v2/administration/how-tos/user-mgmt/roles)** that can be used for providing various access levels to the NGINX One Console. These roles will be automatically updated as new features are added to the NGINX One Console. Default roles can be scoped to specific namespaces.
13+
14+
### Admin
15+
16+
The Admin role, identified as <code>f5xc-nginx-one-admin</code>, provides full read and write access to all endpoints and features within the NGINX One Console.
17+
18+
### User
19+
20+
Our standard User role, listed as <code>f5xc-nginx-one-user</code> in the role list, provides read and write access to all endpoints and features, save for those considered to be administrator level. An example of an administrator level feature would be **[Instance Settings](https://docs.nginx.com/nginx-one/how-to/nginx-configs/clean-up-unavailable-instances/)** where unavailable instance clean up logic is set.
21+
22+
### Monitor
23+
24+
Our read only or Monitor role, <code>f5xc-nginx-one-monitor</code>, grants read only access to all non-administrator features and endpoints within the NGINX One Console.
25+

‎content/nim/admin-guide/rbac/overview-rbac.md‎

Lines changed: 1 addition & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -9,9 +9,7 @@ docs: DOCS-919
99

1010
## Overview
1111

12-
Role-Based Access Control (RBAC) is a security system that governs access to resources within a software application. By assigning specific roles to users or groups, RBAC ensures that only authorized individuals have the ability to perform certain actions or access particular areas.
13-
14-
The value of RBAC lies in its ability to provide clear and structured control over what users can see and do. This makes it easier to maintain security, streamline user management, and ensure compliance with internal policies or regulations. By giving users only the permissions they need to fulfill their roles, RBAC reduces the risk of unauthorized access and fosters a more efficient and secure operating environment.
12+
{{< include "security/rbac-intro.md" >}}
1513

1614
The following are essential concepts related to RBAC:
1715

0 commit comments

Comments
 (0)