Chapter 19. Using declarative configuration

Procedure

1. Create the permission set by entering the following command. This example creates a permission set named "restricted" and saves it as the permission-set.yaml file. It sets read and write access for the Administration resource and read access to the Access resource.

   $ roxctl declarative-config create permission-set \
   --name="restricted" \
   --description="Restriction permission set that only allows \
   access to Administration and Access resources" \
   --resource-with-access=Administration=READ_WRITE_ACCESS \
   --resource-with-access=Access=READ_ACCESS > permission-set.yaml

2. Create the role that allows access to the Administration and Access resources by entering the following command. This example creates a role named "restricted" and saves it as the role.yaml file.

   $ roxctl declarative-config create role \
   --name="restricted" \
   --description="Restricted role that only allows access to Administration and Access" \
   --permission-set="restricted" \
   --access-scope="Unrestricted" > role.yaml

3. Create a config map from the two YAML files that you created in the earlier steps by entering the following command. This example creates the declarative-configurations config map.

   $ kubectl create configmap declarative-configurations \
   --from-file permission-set.yaml --from-file role.yaml \
   -o yaml --namespace=stackrox > declarative-configs.yaml

4. Apply the config map by entering the following command:

   $ kubectl apply -f declarative-configs.yaml

   After you apply the config map, Central extracts the configuration information and creates the resources.

   Note

   Although the watch interval is 5 seconds, as described in the following paragraph, there can be a delay in propagating changes from the config map to the Central mount.

   You can configure the following intervals to specify how declarative configurations interact with Central:

   • Configuration watch interval: The interval for Central to check for changes is every 5 seconds. You can configure this interval by using the ROX_DECLARATIVE_CONFIG_WATCH_INTERVAL environment variable.

   • Reconciliation interval: By default, declarative configuration reconciliation with Central occurs every 20 seconds. You can configure this interval by using the ROX_DECLARATIVE_CONFIG_RECONCILE_INTERVAL environment variable.

     After creating authentication and authorization resources by using declarative configuration, you can view them in the Access Control page in the RHACS web portal. The Origin field indicates Declarative if you created the resource by using declarative configuration.

     Note

     You cannot edit resources created from declarative configurations in the RHACS web portal. You must edit the configuration files directly to make changes to these resources.

     You can view the status of declarative configurations by navigating to Platform Configuration System Health and scrolling to the Declarative configuration section.