Chapter 1. Enabling and giving access to the Role-Based Access Control (RBAC) feature

Procedure

1. The RBAC plugin is installed but disabled by default. To enable the ./dynamic-plugins/dist/backstage-community-plugin-rbac plugin, edit your dynamic-plugins.yaml with the following content.

   dynamic-plugins.yaml fragment

   plugins:
     - package: ./dynamic-plugins/dist/backstage-community-plugin-rbac
       disabled: false

   See Installing and viewing dynamic plugins.

2. Declare policy administrators to enable a select number of authenticated users to configure RBAC policies through the REST API or Web UI, instead of modifying the CSV file directly. The permissions can be specified in a separate CSV file referenced in the app-config-rhdh ConfigMap, or permissions can be created using the REST API or Web UI.

   To declare users such as <your_policy_administrator_name> as policy administrators, edit your custom Developer Hub ConfigMap, such as app-config-rhdh, and add following code to the app-config.yaml content:

   app-config.yaml fragment

   permission:
     enabled: true
     rbac:
       admin:
         users:
           - name: user:default/<your_policy_administrator_name>

3. In order for the Developer Hub Web UI to display available permissions provided by installed plugins, add the corresponding plugin IDs to your custom app-config.yaml Developer Hub configuration file.

   To display available permissions in RBAC UI, edit your custom Developer Hub ConfigMap, such as app-config-rhdh, and add following code to the app-config.yaml content:

   app-config.yaml fragment

   permission:
     enabled: true
     rbac:
       admin:
         users:
           - name: user:default/<your_policy_administrator_name>
       pluginsWithPermission:
         - catalog
         - scaffolder
         - permission

Verification

1. Sign out from the existing Red Hat Developer Hub session and log in again using the declared policy administrator account.

2. With RBAC enabled, most features are disabled by default.

   1. Navigate to the Catalog page in RHDH. The Create button is not visible. You cannot create new components.
   2. Navigate to the API page. The Register button is not visible.