You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
@@ -6,12 +6,118 @@ This topic describes how to use role-based access policies (RBAC) to grant or de
6
6
7
7
## About RBAC Policies
8
8
9
-
By default, every team has two policies created automatically: **Admin** and **Read Only**. If you have an Enterprise plan, you will also have the **Sales** and **Support** policies created automatically. These default policies are not configurable.
9
+
By default, every team has two policies created automatically: **Admin** and **Read Only**. If you have an Enterprise plan, you will also have the **Sales** and **Support** policies created automatically. These default policies are not configurable. For more information, see [Default RBAC Policies](#default-rbac) below.
10
10
11
11
You can configure custom RBAC policies if you are on the Enterprise pricing plan. Creating custom RBAC policies lets you limit which areas of the Vendor Portal are accessible to team members, and control read and read/write privileges to groups based on their role. For example, you can limit access for the sales team to one application and to specific channels. Or, you can grant only certain users permission to promote releases to your production channels.
12
12
13
13
You can also create custom RBAC policies in the Vendor Portal to manage user access and permissions in the Replicated collab repository in GitHub. For more information, see [Managing Access to the Collab Repository](team-management-github-username).
14
14
15
+
## Default RBAC Policies {#default-rbac}
16
+
17
+
This section describes the default RBAC policies that are included for Vendor Portal teams, depending on the team's Replicated pricing plan.
18
+
19
+
### Admin
20
+
21
+
The Admin policy grants read/write permissions to all resources on the team.
22
+
23
+
:::note
24
+
This policy is automatically created for all plans.
25
+
:::
26
+
27
+
```json
28
+
{
29
+
"v1": {
30
+
"name": "Admin",
31
+
"resources": {
32
+
"allowed": [
33
+
"**/*"
34
+
],
35
+
"denied": []
36
+
}
37
+
}
38
+
}
39
+
```
40
+
41
+
### Read Only
42
+
43
+
The Read Only policy grants read permission to all resources on the team except for API tokens.
44
+
45
+
:::note
46
+
This policy is automatically created for all plans.
47
+
:::
48
+
49
+
```json
50
+
{
51
+
"v1": {
52
+
"name": "Read Only",
53
+
"resources": {
54
+
"allowed": [
55
+
"**/list",
56
+
"**/read"
57
+
],
58
+
"denied": [
59
+
"**/*"
60
+
]
61
+
}
62
+
}
63
+
}
64
+
```
65
+
66
+
### Support Engineer
67
+
68
+
The Support Engineer policy grants read access to release, channels, and application data, and read-write access to customer and license details. It also grants permission to open Replicated support issues and upload support bundles.
69
+
70
+
:::note
71
+
This policy is automatically created for teams with the Enterprise plan only.
72
+
:::
73
+
74
+
```json
75
+
{
76
+
"v1": {
77
+
"name": "Support Engineer",
78
+
"resources": {
79
+
"allowed": [
80
+
"**/read",
81
+
"**/list",
82
+
"kots/app/*/license/**",
83
+
"team/support-issues/read",
84
+
"team/support-issues/write"
85
+
],
86
+
"denied": [
87
+
"**/*"
88
+
]
89
+
}
90
+
}
91
+
}
92
+
```
93
+
94
+
### Sales
95
+
96
+
The Sales policy grants read-write access to customers and license details and read-only access to resources necessary to manage licenses (applications, channels, and license fields). No additional access is granted.
97
+
98
+
:::note
99
+
This policy is automatically created for teams with the Enterprise plan only.
100
+
:::
101
+
102
+
```json
103
+
{
104
+
"v1": {
105
+
"name": "Sales",
106
+
"resources": {
107
+
"allowed": [
108
+
"kots/app/*/read",
109
+
"kots/app/*/channel/*/read",
110
+
"kots/app/*/licensefields/read",
111
+
"kots/app/*/license/**"
112
+
],
113
+
"denied": [
114
+
"**/*"
115
+
]
116
+
}
117
+
}
118
+
}
119
+
```
120
+
15
121
## Configure a Custom RBAC Policy
16
122
17
123
To configure a custom RBAC policy:
@@ -31,8 +137,8 @@ To configure a custom RBAC policy:
31
137
32
138
33
139
34
-
- For more information and examples of policy definition, see [Policy Definition](#policy-definition) and [Role-based Policy Examples](#role-based-policy-examples).
35
-
- For more information and examples of rule order, see [Rule Order](#rule-order).
140
+
- For more information, see [Policy Definition](#policy-definition).
141
+
- For more information about and examples of rule order, see [Rule Order](#rule-order).
36
142
- For a list of resource names, see [RBAC Resource Names](team-management-rbac-resource-names).
37
143
38
144
1. Click **Create Policy** to create a new policy, or click **Update Policy** to update an existing policy.
@@ -76,7 +182,7 @@ Resource names are hierarchical, and support wildcards and globs. For a complete
76
182
77
183
When a policy document has conflicting rules, the behavior is predictable. For more information about conflicting rules, see [Rule Order](#rule-order).
78
184
79
-
### Policy Definition Example
185
+
### Example: View Specific Application and Channel
80
186
81
187
The following policy definition example limits any user with this role to viewing a specific application and a specific channel for that application:
82
188
@@ -153,62 +259,3 @@ In the following example, a policy grants access to viewing all customers, but n
153
259
}
154
260
}
155
261
```
156
-
157
-
## Role-based Policy Examples
158
-
159
-
This section includes examples of RBAC policies designed for specific roles at a company.
160
-
161
-
### Support Engineer
162
-
163
-
The support engineer policy grants read access to release, channels, and application data, and read-write access to customer and license details. It also grants permission to open Replicated support issues and upload support bundles.
164
-
165
-
:::note
166
-
If you have an Enterprise plan, you will already have this policy created.
167
-
:::
168
-
169
-
```json
170
-
{
171
-
"v1": {
172
-
"name": "Support Engineer",
173
-
"resources": {
174
-
"allowed": [
175
-
"**/read",
176
-
"**/list",
177
-
"kots/app/*/license/**",
178
-
"team/support-issues/read",
179
-
"team/support-issues/write"
180
-
],
181
-
"denied": [
182
-
"**/*"
183
-
]
184
-
}
185
-
}
186
-
}
187
-
```
188
-
189
-
### Sales
190
-
191
-
The sales policy grants read-write access to customers and license details and read-only access to resources necessary to manage licenses (applications, channels, and license fields). No additional access is granted.
192
-
193
-
:::note
194
-
If you have an Enterprise plan, you will already have this policy created.
0 commit comments