Skip to content

Commit 69e8002

Browse files
adellapeadellape
authored
Merge pull request #77370 from fmcdonal/OSDOCS-10209
OSDOCS-10209: ROSA "Approved Access" (was Lockbox)
2 parents a1f6330 + 90775a1 commit 69e8002

6 files changed

+148
-0
lines changed

‎_topic_maps/_topic_map_rosa.yml

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -315,6 +315,8 @@ Topics:
315315
File: index
316316
- Name: Managing your cluster resources
317317
File: managing-cluster-resources
318+
- Name: Approved Access
319+
File: approved-access
318320
- Name: Getting support
319321
File: getting-support
320322
Distros: openshift-rosa

‎modules/support-reviewing-an-access-request-from-an-email-notification.adoc

Lines changed: 32 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,32 @@
1+
// Module included in the following assemblies:
2+
//
3+
// * serverless/serverless-support.adoc
4+
// * support/getting-support.adoc
5+
// * service_mesh/v2x/ossm-troubleshooting-istio.adoc
6+
// * osd_architecture/osd-support.adoc
7+
8+
:_mod-docs-content-type: PROCEDURE
9+
[id="support-reviewing-an-access-request-from-an-email-notification_{context}"]
10+
= Reviewing an access request from an email notification
11+
12+
Cluster owners will receive an email notification when Red{nbsp}Hat Site Reliability Engineering (SRE) request access to their cluster with a link to review the request in the {hybrid-console-second}.
13+
14+
ifndef::openshift-rosa,openshift-dedicated[]
15+
.Prerequisites
16+
* You have access to the cluster as a user with the `cluster-admin` role.
17+
endif::openshift-rosa,openshift-dedicated[]
18+
19+
20+
.Procedure
21+
22+
. Click the link within the email to bring you to the {hybrid-console-second}.
23+
24+
. In the *Access Request Details* dialog, click *Approve* or *Deny* under *Decision*.
25+
+
26+
[NOTE]
27+
====
28+
Denying an access request requires you to complete the *Justification* field. In this case, SRE can not directly act on the resources related to the incident. Customers can still use the link:https://access.redhat.com/support/cases/#/case/list[*Customer Support*] to help investigate and resolve any issues.
29+
====
30+
31+
. Click *Save*.
32+

‎modules/support-reviewing-an-access-request-from-the-hybrid-console.adoc

Lines changed: 35 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,35 @@
1+
// Module included in the following assemblies:
2+
//
3+
// * support/getting-support.adoc
4+
// * osd_architecture/osd-support.adoc
5+
6+
:_mod-docs-content-type: PROCEDURE
7+
[id="support-reviewing-an-access-request-from-the-hybrid-cloud-console_{context}"]
8+
= Reviewing an access request from the {hybrid-console-second}
9+
10+
Review access requests for your {product-rosa} clusters from the {hybrid-console-second}.
11+
12+
ifndef::openshift-rosa,openshift-dedicated[]
13+
.Prerequisites
14+
* You have access to the cluster as a user with the `Cluster Owner` role.
15+
endif::openshift-rosa,openshift-dedicated[]
16+
17+
18+
.Procedure
19+
20+
. Navigate to {cluster-manager-url} and select *Clusters*.
21+
22+
. Click the cluster name to review the *Access Request*.
23+
24+
. Select the *Access Requests* tab to list all *states*.
25+
26+
. Select *Open* under *Actions* for the *Pending* state.
27+
28+
. In the *Access Request Details* dialog, click *Approve* or *Deny* under *Decision*.
29+
+
30+
[NOTE]
31+
====
32+
Denying an access request requires you to complete the *Justification* field. In this case, SRE can not directly act on the resources related to the incident. Customers can still use the link:https://access.redhat.com/support/cases/#/case/list[*Customer Support*] to help investigate and resolve any issues.
33+
====
34+
35+
. Click *Save*.

‎modules/support-submitting-a-case-enable-approved-access.adoc

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
1+
// Module included in the following assemblies:
2+
//
3+
// * support/getting-support.adoc
4+
// * osd_architecture/osd-support.adoc
5+
6+
:_mod-docs-content-type: PROCEDURE
7+
[id="support-submitting-a-case-enable-approved-access_{context}"]
8+
= Enabling Approved Access for ROSA clusters by submitting a support case
9+
10+
{product-rosa} _Approved Access_ is not enabled by default. To enable _Approved Access_ for your {product-rosa} clusters, you should create a support ticket.
11+
12+
.Procedure
13+
14+
. Log in to the link:https://access.redhat.com/support/cases/#/case/list[*Customer Support*] page of the Red{nbsp}Hat Customer Portal.
15+
16+
. Click *Get support*.
17+
18+
. On the *Cases* tab of the *Customer support* page:
19+
20+
.. Optional: Change the pre-filled account and owner details if needed.
21+
22+
.. Select the *Configuration* category and click *Continue*.
23+
24+
. Enter the following information:
25+
26+
.. In the *Product* field, select *{product-title}* or *{product-title} {hcp-capital}*.
27+
.. In the *Problem statement* field, enter *Enable ROSA Access Protection*.
28+
.. Click *See more options*.
29+
30+
. Select *OpenShift Cluster ID* from the drop-down list.
31+
32+
. Fill the remaining mandatory fields in the form:
33+
34+
.. What are you experiencing? What are you expecting to happen?
35+
... Fill with *Approved Access*.
36+
37+
.. Define the value or impact to you or the business.
38+
... Fill with *Approved Access*.
39+
.. Click *Continue*.
40+
41+
. Select *Severity* as *4(Low)* and click *Continue*.
42+
43+
. Preview the case details and click *Submit*.
44+

‎rosa_release_notes/rosa-release-notes.adoc

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -18,6 +18,10 @@ toc::[]
1818

1919
* **ROSA CLI update.** The ROSA CLI (`rosa`) was updated to a new version. For information about what has changed in this release, see the link:https://github.com/openshift/rosa/releases/tag/v1.2.41[ROSA CLI release notes]. For more information about the ROSA CLI (`rosa`), see xref:../cli_reference/rosa_cli/rosa-get-started-cli.adoc#rosa-about_rosa-getting-started-cli[About the ROSA CLI].
2020

21+
* **Approved Access for ROSA clusters.** Red{nbsp}Hat Site Reliability Engineering (SRE) managing and proactively supporting ROSA Clusters will typically not require access to customer Data as part of the normal operations. In the unlikely event should Red{nbsp}Hat SRE (Site Reliability Engineer) need access to customer data, the _Approved Access_ functionality provides an interface for customers to review and _approve_ or _deny_ access requests.
22+
+
23+
Access requests to customer data on ROSA clusters and the corresponding cloud accounts can be created by Red{nbsp}Hat SRE either in response to a customer-initiated support ticket or in response to alerts received by a Red{nbsp}Hat SRE, as part of the standard incident response process. For more information, see xref:../support/approved-access.adoc#approved-access[Approved Access]. This is applicable to ROSA and Red{nbsp}Hat OpenShift Service on AWS (classic architecture).
24+
2125
* **Permission boundaries for the installer role policy.** You can apply a policy as a _permissions boundary_ on the ROSA installer role. The combination of policy and boundary policy limits the maximum permissions for the Amazon Web Services(AWS) Identity and Access Management (IAM) entity role. ROSA includes a set of three prepared permission boundary policy files, with which you can restrict permissions for the installer role since changing the installer policy itself is not supported. For more information, see xref:../rosa_architecture/rosa-sts-about-iam-resources.adoc#rosa-sts-aws-requirements-attaching-boundary-policy_rosa-sts-about-iam-resources[Permission boundaries for the installer role]. This is applicable only to Red{nbsp}Hat OpenShift Service on AWS (classic architecture).
2226

2327
* **Cluster delete protection.** You can now enable the cluster delete protection option, which helps to prevent you from accidentally deleting a cluster. For more information on using the cluster delete protection option with the ROSA CLI, see xref:../cli_reference/rosa_cli/rosa-manage-objects-cli.adoc#rosa-edit-cluster_rosa-managing-objects-cli[edit cluster]. For more information on using the cluster delete protection option in the UI, see xref:../rosa_install_access_delete_clusters/rosa-sts-creating-a-cluster-quickly.adoc#rosa-sts-creating-a-cluster-using-defaults-ocm_rosa-sts-creating-a-cluster-quickly[Creating a cluster with the default options using OpenShift Cluster Manager].

‎support/approved-access.adoc

Lines changed: 31 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,31 @@
1+
:_mod-docs-content-type: ASSEMBLY
2+
[id="approved-access"]
3+
= Approved Access
4+
include::_attributes/common-attributes.adoc[]
5+
ifdef::openshift-dedicated[]
6+
include::_attributes/attributes-openshift-dedicated.adoc[]
7+
endif::[]
8+
:context: approved-access
9+
10+
toc::[]
11+
12+
Red{nbsp}Hat Site Reliability Engineering (SRE) typically does not require access to systems containing customer data as part of normal operations to manage and support {product-title} clusters. In the unlikely event that SRE needs access to systems containing customer data, you can use the _Approved Access_ interface to review and _approve_ or _deny_ access to these systems.
13+
14+
Access requests to customer data on {product-rosa} clusters and the corresponding cloud accounts can be created by SRE either in response to a customer-initiated support ticket or in response to alerts received by SRE as part of the standard incident response process.
15+
16+
When _Approved Access_ is enabled and an SRE creates an access request, _cluster owners_ receive an email notification informing them of a new access request. The email notification contains a link allowing the cluster owner to quickly approve or deny the access request. You must respond in a timely manner otherwise there is a risk to your SLA for {product-rosa}.
17+
18+
* If customers require additional users that are not the cluster owner to receive the email, they can link:https://docs.openshift.com/rosa/observability/logging/sd-accessing-the-service-logs.html#adding-cluster-notification-contacts_sd-accessing-the-service-logs[add additional cluster contacts].
19+
* Pending access requests are available in the {hybrid-console-second} on the clusters list or *Access Requests* tab on the cluster overview for the specific cluster.
20+
21+
[NOTE]
22+
====
23+
Denying an access request requires you to complete the *Justification* field. In this case, SRE can not directly act on the resources related to the incident. Customers can still use the link:https://access.redhat.com/support/cases/#/case/list[*Customer Support*] to help investigate and resolve any issues.
24+
====
25+
// Approved access
26+
27+
include::modules/support-submitting-a-case-enable-approved-access.adoc[leveloffset=+1]
28+
include::modules/support-reviewing-an-access-request-from-an-email-notification.adoc[leveloffset=+1]
29+
include::modules/support-reviewing-an-access-request-from-the-hybrid-console.adoc[leveloffset=+1]
30+
31+

0 commit comments

Comments
 (0)