Skip to content

Commit b590b54

Browse files
jmagakjmagak
authored
Merge branch 'main' into RHIDP-4569-Discover-Benefits-of-RHDH
2 parents 06f2b9f + b0d0026 commit b590b54

16 files changed

+160
-87
lines changed

‎.github/workflows/build-asciidoc.yml‎

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -17,7 +17,7 @@ name: GitHub Pages
1717

1818
on:
1919
push:
20-
branches:
20+
branches:
2121
- main
2222
- rhdh-1.**
2323
- 1.**.x
@@ -41,14 +41,14 @@ jobs:
4141
run: |
4242
# update
4343
sudo apt-get update -y || true
44-
# install
45-
sudo apt-get -y -q install asciidoctor && asciidoctor --version
44+
# install
45+
sudo apt-get -y -q install podman && podman --version
4646
echo "GIT_BRANCH=${GITHUB_HEAD_REF:-${GITHUB_REF#refs/heads/}}" >> $GITHUB_ENV
4747
4848
- name: Build guides and indexes
4949
run: |
5050
echo "Building branch ${{ env.GIT_BRANCH }}"
51-
build/scripts/build.sh -b ${{ env.GIT_BRANCH }}
51+
build/scripts/build-ccutil.sh -b ${{ env.GIT_BRANCH }}
5252
5353
# repo must be public for this to work
5454
- name: Deploy
@@ -60,7 +60,7 @@ jobs:
6060
keep_files: true
6161
publish_dir: ./titles-generated
6262

63-
- name: Cleanup merged PR branches
63+
- name: Cleanup merged PR branches
6464
run: |
6565
PULL_URL="https://api.github.com/repos/redhat-developer/red-hat-developers-documentation-rhdh/pulls"
6666
GITHUB_TOKEN="${{ secrets.RHDH_BOT_TOKEN }}"
@@ -70,7 +70,7 @@ jobs:
7070
git checkout gh-pages; git pull || true
7171
dirs=$(find . -maxdepth 1 -name "pr-*" -type d | sed -r -e "s|^\./pr-||")
7272
refs=$(cat pulls.html | grep pr- | sed -r -e "s|.+.html>pr-([0-9]+)</a>.+|\1|")
73-
for d in $(echo -e "$dirs\n$refs" | sort -uV); do
73+
for d in $(echo -e "$dirs\n$refs" | sort -uV); do
7474
PR="${d}"
7575
echo -n "Check merge status of PR $PR ... "
7676
PR_JSON=$(curl -sSL -H "Accept: application/vnd.github+json" -H "Authorization: Bearer $GITHUB_TOKEN" "$PULL_URL/$PR")

‎assemblies/assembly-authenticating-with-github.adoc‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
1-
[id="assembly-auth-provider-github"]
2-
= Enabling the GitHub authentication provider
1+
[id="authenticating-with-github"]
2+
= Authenticating with GitHub
33

44
To authenticate users with GitHub or GitHub Enterprise:
55

‎assemblies/assembly-configuring-authorization-in-rhdh.adoc‎

Lines changed: 29 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -1,44 +1,59 @@
11
[id='configuring-authorization-in-rhdh']
22
= Configuring authorization in {product}
33

4-
include::modules/authorization/con-rbac-overview.adoc[leveloffset=+1]
4+
In link:{authorization-book-url}[{authentication-book-title}], you learnt how to authenticate users to {product}.
5+
{product-short} knowns who the users are.
56

7+
In this book, learn how to authorize users to perform actions in {product-short}.
8+
Define what users can do in {product-short}.
69

7-
include::modules/authorization/ref-rbac-permission-policies.adoc[leveloffset=+1]
10+
Role-Based Access Control (RBAC) is a security concept that controls access to resources in a system, and specifies a mapping between users of the system, and the actions they can perform on resources in the system.
11+
You define roles with specific permissions, and then assign the roles to users and groups.
812

13+
RBAC on {product-short} is built on top of the Permissions framework, which defines RBAC policies in code.
14+
Rather than defining policies in code,
15+
the {product-short} RBAC feature allows you
16+
to define policies in a declarative fashion using a simple CSV based format.
17+
You can define the policies by using {product-short} web interface or REST API, rather than editing the CSV directly.
918

10-
include::modules/authorization/con-rbac-config-permission-policies.adoc[leveloffset=+2]
19+
To apply RBAC in {product-short}:
1120

21+
. The {product-short} administrator sets up the RBAC feature:
22+
.. Enable the RBAC feature
23+
.. Configure Policy Administrators
1224

13-
include::modules/authorization/con-rbac-config-permission-policies-admin.adoc[leveloffset=+3]
25+
. The {product-short} policy administrator configures your RBAC policies:
26+
.. Define roles with specific permissions
27+
.. Assign the roles to users and groups
1428

1529

16-
include::modules/authorization/con-rbac-config-permission-policies-external-file.adoc[leveloffset=+3]
30+
include::modules/authorization/proc-enabling-the-rbac-plugin.adoc[leveloffset=+1]
1731

18-
include::modules/authorization/proc-mounting-the-policy-csv-file-using-the-operator.adoc[leveloffset=+4]
1932

20-
include::modules/authorization/proc-mounting-the-policy-csv-file-using-helm.adoc[leveloffset=+4]
33+
include::assembly-managing-authorizations-by-using-the-rhdh-web-ui.adoc[leveloffset=+1]
2134

2235

23-
include::modules/authorization/con-rbac-conditional-policies-rhdh.adoc[leveloffset=+1]
36+
include::modules/authorization/ref-rbac-permission-policies.adoc[leveloffset=+1]
2437

2538

26-
include::modules/authorization/ref-rbac-conditional-policy-definition.adoc[leveloffset=+2]
39+
include::modules/authorization/con-rbac-config-permission-policies.adoc[leveloffset=+2]
2740

2841

29-
include::modules/authorization/proc-rbac-config-conditional-policy-file.adoc[leveloffset=+2]
42+
include::modules/authorization/con-rbac-config-permission-policies-external-file.adoc[leveloffset=+3]
43+
44+
include::modules/authorization/proc-mounting-the-policy-csv-file-using-the-operator.adoc[leveloffset=+4]
3045

46+
include::modules/authorization/proc-mounting-the-policy-csv-file-using-helm.adoc[leveloffset=+4]
3147

32-
include::modules/authorization/proc-rbac-ui-manage-roles.adoc[leveloffset=+1]
3348

49+
include::modules/authorization/con-rbac-conditional-policies-rhdh.adoc[leveloffset=+1]
3450

35-
include::modules/authorization/proc-rbac-ui-create-role.adoc[leveloffset=+2]
3651

52+
include::modules/authorization/ref-rbac-conditional-policy-definition.adoc[leveloffset=+2]
3753

38-
include::modules/authorization/proc-rbac-ui-edit-role.adoc[leveloffset=+2]
3954

55+
include::modules/authorization/proc-rbac-config-conditional-policy-file.adoc[leveloffset=+2]
4056

41-
include::modules/authorization/proc-rbac-ui-delete-role.adoc[leveloffset=+2]
4257

4358

4459
include::modules/authorization/con-user-stats-rhdh.adoc[leveloffset=+1]

‎assemblies/assembly-managing-authorizations-by-using-the-rhdh-web-ui.adoc‎

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
[id='proc-rbac-ui-manage-roles_{context}']
2+
= Managing role-based access controls (RBAC) using the {product} Web UI
3+
4+
Policy administrators can use the {product-short} web interface (Web UI) to allocate specific roles and permissions to individual users or groups. Allocating roles ensures that access to resources and functionalities is regulated across the {product-short}.
5+
6+
With the policy administrator role in {product-short}, you can assign permissions to users and groups. This role allows you to view, create, modify, and delete the roles using {product-short} Web UI.
7+
8+
9+
include::modules/authorization/proc-rbac-ui-create-role.adoc[leveloffset=+1]
10+
11+
12+
include::modules/authorization/proc-rbac-ui-edit-role.adoc[leveloffset=+1]
13+
14+
15+
include::modules/authorization/proc-rbac-ui-delete-role.adoc[leveloffset=+1]

‎assemblies/assembly_about-rhdh.adoc‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
ifdef::context[:parent-context-of-about-rhdh: {context}]
2+
3+
:_mod-docs-content-type: ASSEMBLY
4+
5+
ifndef::context[]
6+
[id="about-rhdh"]
7+
endif::[]
8+
ifdef::context[]
9+
[id="about-rhdh_{context}"]
10+
endif::[]
11+
= About {product}
12+
13+
:context: about-rhdh
14+
15+
{product} is a fully supported, enterprise-grade, open developer platform that you can use to build developer portals. This platform contains a supported and opinionated framework that helps reduce the friction and frustration of developers while boosting productivity. {product} simplifies decision-making by providing a developer experience that presents a selection of internally approved tools, programming languages, and developer resources within a self-managed portal. As a developer, you can use {product} to experience a streamlined development environment. {product} is driven by a centralized software catalog, providing efficiency to your microservices and infrastructure. It enables your product team to deliver quality code without any compromises.
16+

‎modules/authentication/proc-enabling-authentication-with-github.adoc‎

Lines changed: 33 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -159,6 +159,39 @@ auth:
159159
enterpriseInstanceUrl: ${GITHUB_HOST_DOMAIN}
160160
----
161161

162+
[TIP]
163+
====
164+
To enable GitHub integration with a different authentication provider, complete the following configurations:
165+
166+
* Add the GitHub provider to the existing `auth` section.
167+
* Keep the `signInPage` section from your authentication provider configuration.
168+
169+
.`app-config-rhdh.yaml` fragment with mandatory fields to enable GitHub integration and use a different authentication provider
170+
[source,yaml,subs="+quotes"]
171+
----
172+
auth:
173+
environment: production
174+
providers:
175+
github:
176+
production:
177+
clientId: ${AUTH_GITHUB_CLIENT_ID}
178+
clientSecret: ${AUTH_GITHUB_CLIENT_SECRET}
179+
__<your_other_authentication_providers_configuration>__
180+
integrations:
181+
github:
182+
- host: ${GITHUB_HOST_DOMAIN}
183+
apps:
184+
- appId: ${AUTH_GITHUB_APP_ID}
185+
clientId: ${AUTH_GITHUB_CLIENT_ID}
186+
clientSecret: ${GITHUB_CLIENT_SECRET}
187+
webhookUrl: ${GITHUB_WEBHOOK_URL}
188+
webhookSecret: ${GITHUB_WEBHOOK_SECRET}
189+
privateKey: |
190+
${GITHUB_PRIVATE_KEY_FILE}
191+
signInPage: __<your_main_authentication_provider>__
192+
----
193+
====
194+
162195
--
163196

164197
.Verification

‎modules/authorization/con-rbac-config-permission-policies-admin.adoc‎

Lines changed: 0 additions & 36 deletions
This file was deleted.

‎modules/authorization/con-rbac-overview.adoc‎

Lines changed: 0 additions & 6 deletions
This file was deleted.

‎modules/authorization/proc-enabling-the-rbac-plugin.adoc‎

Lines changed: 53 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,53 @@
1+
[id='enabling-and-giving-access-to-rbac']
2+
= Enabling and giving access to the Role-Based Access Control (RBAC) feature
3+
4+
The Role-Based Access Control (RBAC) feature is disabled by default.
5+
Enable the RBAC plugin and declare policy administrators to start using RBAC features.
6+
7+
The permission policies for users and groups in the {product-short} are managed by permission policy administrators. Only permission policy administrators can access the Role-Based Access Control REST API.
8+
9+
.Prerequisites
10+
* You have link:{linkadminguide}#assembly-add-custom-app-file-openshift_admin-rhdh[added a custom {product-short} application configuration], and have sufficient permissions to modify it.
11+
* You have link:{authentication-book-title}[enabled an authentication provider].
12+
13+
.Procedure
14+
. The RBAC plugin is installed but disabled by default.
15+
To enable the `./dynamic-plugins/dist/janus-idp-backstage-plugin-rbac` plugin, edit your `dynamic-plugins.yaml` with the following content.
16+
+
17+
.`dynamic-plugins.yaml` fragment
18+
[source,yaml]
19+
----
20+
plugins:
21+
- package: ./dynamic-plugins/dist/janus-idp-backstage-plugin-rbac
22+
disabled: false
23+
----
24+
+
25+
See link:{installing-and-viewing-dynamic-plugins-url}[{installing-and-viewing-dynamic-plugins-title}].
26+
27+
. Declare policy administrators to enable a select number of authenticated users to configure RBAC policies through the REST API or Web UI, instead of modifying the CSV file directly.
28+
The permissions can be specified in a separate CSV file referenced in the `app-config-rhdh` ConfigMap, or permissions can be created using the REST API or Web UI.
29+
+
30+
To declare users such as _<your_policy_administrator_name>_ as policy administrators, edit your custom {product-short} ConfigMap, such as `app-config-rhdh`, and add following code to the `app-config-rhdh.yaml` content:
31+
+
32+
.`app-config.yaml` fragment
33+
[source,yaml,subs=+quotes]
34+
----
35+
permission:
36+
enabled: true
37+
rbac:
38+
admin:
39+
users:
40+
- name: user:default/__<your_policy_administrator_name>__
41+
----
42+
43+
.Verification
44+
. Sign out from the existing {product} session and log in again using the declared policy administrator account.
45+
. With RBAC enabled, most features are disabled by default.
46+
.. Navigate to the *Catalog* page in {product-very-short}.
47+
The *Create* button is not visible.
48+
You cannot create new components.
49+
.. Navigate to the API page.
50+
The *Register* button is not visible.
51+
52+
.Next steps
53+
* Explicitly enable permissions to resources in {product-short}.

‎modules/authorization/proc-rbac-ui-create-role.adoc‎

Lines changed: 1 addition & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -4,9 +4,7 @@
44
You can create a role in the {product} using the Web UI.
55

66
.Prerequisites
7-
* You have an administrator role in the {product-short}.
8-
* You have installed the `@janus-idp/backstage-plugin-rbac` plugin in {product-short}. For more information, see link:{LinkPluginsGuide}[{NameOfPluginsGuide}].
9-
* You have configured the required permission policies. For more information, see xref:con-rbac-config-permission-policies_{context}[].
7+
* You xref:enabling-and-giving-access-to-rbac[have enabled RBAC and have a policy administrator role in {product-short}].
108

119
.Procedure
1210

0 commit comments

Comments
 (0)