Skip to content

Commit 7d32ecd

Browse files
paigecalvertpaigecalvert
authored
Update team-management-rbac-configuring.md
1 parent baec77d commit 7d32ecd

File tree

1 file changed

+108
-77
lines changed

1 file changed

+108
-77
lines changed

‎docs/vendor/team-management-rbac-configuring.md‎

Lines changed: 108 additions & 77 deletions
Original file line numberDiff line numberDiff line change
@@ -6,12 +6,118 @@ This topic describes how to use role-based access policies (RBAC) to grant or de
66

77
## About RBAC Policies
88

9-
By default, every team has two policies created automatically: **Admin** and **Read Only**. If you have an Enterprise plan, you will also have the **Sales** and **Support** policies created automatically. These default policies are not configurable.
9+
By default, every team has two policies created automatically: **Admin** and **Read Only**. If you have an Enterprise plan, you will also have the **Sales** and **Support** policies created automatically. These default policies are not configurable. For more information, see [Default RBAC Policies](#default-rbac) below.
1010

1111
You can configure custom RBAC policies if you are on the Enterprise pricing plan. Creating custom RBAC policies lets you limit which areas of the Vendor Portal are accessible to team members, and control read and read/write privileges to groups based on their role. For example, you can limit access for the sales team to one application and to specific channels. Or, you can grant only certain users permission to promote releases to your production channels.
1212

1313
You can also create custom RBAC policies in the Vendor Portal to manage user access and permissions in the Replicated collab repository in GitHub. For more information, see [Managing Access to the Collab Repository](team-management-github-username).
1414

15+
## Default RBAC Policies {#default-rbac}
16+
17+
This section describes the default RBAC policies that are included for Vendor Portal teams, depending on the team's Replicated pricing plan.
18+
19+
### Admin
20+
21+
The Admin policy grants read/write permissions to all resources on the team.
22+
23+
:::note
24+
This policy is automatically created for all plans.
25+
:::
26+
27+
```json
28+
{
29+
"v1": {
30+
"name": "Admin",
31+
"resources": {
32+
"allowed": [
33+
"**/*"
34+
],
35+
"denied": []
36+
}
37+
}
38+
}
39+
```
40+
41+
### Read Only
42+
43+
The Read Only policy grants read permission to all resources on the team except for API tokens.
44+
45+
:::note
46+
This policy is automatically created for all plans.
47+
:::
48+
49+
```json
50+
{
51+
"v1": {
52+
"name": "Read Only",
53+
"resources": {
54+
"allowed": [
55+
"**/list",
56+
"**/read"
57+
],
58+
"denied": [
59+
"**/*"
60+
]
61+
}
62+
}
63+
}
64+
```
65+
66+
### Support Engineer
67+
68+
The Support Engineer policy grants read access to release, channels, and application data, and read-write access to customer and license details. It also grants permission to open Replicated support issues and upload support bundles.
69+
70+
:::note
71+
This policy is automatically created for teams with the Enterprise plan only.
72+
:::
73+
74+
```json
75+
{
76+
"v1": {
77+
"name": "Support Engineer",
78+
"resources": {
79+
"allowed": [
80+
"**/read",
81+
"**/list",
82+
"kots/app/*/license/**",
83+
"team/support-issues/read",
84+
"team/support-issues/write"
85+
],
86+
"denied": [
87+
"**/*"
88+
]
89+
}
90+
}
91+
}
92+
```
93+
94+
### Sales
95+
96+
The Sales policy grants read-write access to customers and license details and read-only access to resources necessary to manage licenses (applications, channels, and license fields). No additional access is granted.
97+
98+
:::note
99+
This policy is automatically created for teams with the Enterprise plan only.
100+
:::
101+
102+
```json
103+
{
104+
"v1": {
105+
"name": "Sales",
106+
"resources": {
107+
"allowed": [
108+
"kots/app/*/read",
109+
"kots/app/*/channel/*/read",
110+
"kots/app/*/licensefields/read",
111+
"kots/app/*/license/**"
112+
],
113+
"denied": [
114+
"**/*"
115+
]
116+
}
117+
}
118+
}
119+
```
120+
15121
## Configure a Custom RBAC Policy
16122

17123
To configure a custom RBAC policy:
@@ -76,7 +182,7 @@ Resource names are hierarchical, and support wildcards and globs. For a complete
76182

77183
When a policy document has conflicting rules, the behavior is predictable. For more information about conflicting rules, see [Rule Order](#rule-order).
78184

79-
### Policy Definition Example
185+
### Example: View Specific Application and Channel
80186

81187
The following policy definition example limits any user with this role to viewing a specific application and a specific channel for that application:
82188

@@ -153,78 +259,3 @@ In the following example, a policy grants access to viewing all customers, but n
153259
}
154260
}
155261
```
156-
157-
## Role-based Policy Examples
158-
159-
This section includes examples of RBAC policies designed for specific roles at a company.
160-
161-
### Admin
162-
163-
The Admin policy grants read/write permissions to all resources on the team.
164-
165-
:::note
166-
This policy is automatically created for all plans.
167-
:::
168-
169-
### Read Only
170-
171-
The Read Only policy grants read permission to all resources on the team except for API tokens.
172-
173-
:::note
174-
This policy is automatically created for all plans.
175-
:::
176-
177-
### Support Engineer
178-
179-
The support engineer policy grants read access to release, channels, and application data, and read-write access to customer and license details. It also grants permission to open Replicated support issues and upload support bundles.
180-
181-
:::note
182-
If you have an Enterprise plan, you will already have this policy created.
183-
:::
184-
185-
```json
186-
{
187-
"v1": {
188-
"name": "Support Engineer",
189-
"resources": {
190-
"allowed": [
191-
"**/read",
192-
"**/list",
193-
"kots/app/*/license/**",
194-
"team/support-issues/read",
195-
"team/support-issues/write"
196-
],
197-
"denied": [
198-
"**/*"
199-
]
200-
}
201-
}
202-
}
203-
```
204-
205-
### Sales
206-
207-
The sales policy grants read-write access to customers and license details and read-only access to resources necessary to manage licenses (applications, channels, and license fields). No additional access is granted.
208-
209-
:::note
210-
If you have an Enterprise plan, you will already have this policy created.
211-
:::
212-
213-
```json
214-
{
215-
"v1": {
216-
"name": "Sales",
217-
"resources": {
218-
"allowed": [
219-
"kots/app/*/read",
220-
"kots/app/*/channel/*/read",
221-
"kots/app/*/licensefields/read",
222-
"kots/app/*/license/**"
223-
],
224-
"denied": [
225-
"**/*"
226-
]
227-
}
228-
}
229-
}
230-
```

0 commit comments

Comments
 (0)