Chapter 4. Role-Based Access Control (RBAC) in Red Hat Developer Hub

Role-Based Access Control is a security paradigm that restricts access to authorized users. This feature includes defining roles with specific permissions and then assigning those roles to the users.

The Red Hat Developer Hub uses RBAC to improve the permission system within the platform. The RBAC feature in Developer Hub introduces an administrator role and leverages the organizational structure including teams, groups, and users by facilitating efficient access control.

4.1. Permission policies configuration

There are two approaches to configure the permission policies in Red Hat Developer Hub, including:

Configuration of permission policies administrators
Configuration of permission policies defined in an external file

4.1.1. Configuration of permission policies administrators

The permission policies for users and groups in the Developer Hub are managed by permission policy administrators. Only permission policy administrators can access the Role-Based Access Control REST API.

The purpose of configuring policy administrators is to enable a specific, restricted number of authenticated users to access the RBAC REST API. The permission policies are defined in a policy.csv file, which is referenced in the app-config-rhdh ConfigMap. OpenShift platform administrators or cluster administrators can perform this task with access to the namespace where Red Hat Developer Hub is deployed.

You can set the credentials of a permission policy administrator in the app-config.yaml file as follows:

permission:
  enabled: true
  rbac:
    admin:
      users:
        - name: user:default/joeuser

permission:
  enabled: true
  rbac:
    admin:
      users:
        - name: user:default/joeuser

Copy to Clipboard

4.1.2. Configuration of permission policies defined in an external file

You can follow this approach of configuring the permission policies before starting the Red Hat Developer Hub. If permission policies are defined in an external file, then you can import the same file in the Developer Hub. The permission policies need to be defined in Casbin rules format. For information about the Casbin rules format, see Basics of Casbin rules.

The following is an example of permission policies configuration:

p, role:default/guests, catalog-entity, read, deny

p, role:default/guests, catalog.entity.create, create, deny

g, user:default/<USER_TO_ROLE>, role:default/guests

If a defined permission does not contain an action associated with it, then add use as a policy. See the following example:

p, role:default/guests, kubernetes.proxy, use, deny

You can define the policy.csv file path in the app-config.yaml file:

permission:
  enabled: true
  rbac:
    policies-csv-file: /some/path/rbac-policy.csv

permission:
  enabled: true
  rbac:
    policies-csv-file: /some/path/rbac-policy.csv

Copy to Clipboard

4.1.2.1. Mounting `policy.csv` file to the Developer Hub Helm Chart

When the Red Hat Developer Hub is deployed with the Helm Chart, then you must define the policy.csv file by mounting it to the Developer Hub Helm Chart.

You can add your policy.csv file to the Developer Hub Helm Chart by creating a configMap and mounting it.

Prerequisites

You are logged in to the OCP using the OpenShift web console.
Red Hat Developer Hub is installed and deployed using Helm Chart.
For more information about installing the Red Hat Developer Hub using Helm Chart, see Chapter 2, Installing Red Hat Developer Hub using Helm Chart.

Procedure

In Red Hat OpenShift, create a ConfigMap to hold the policies as shown in the following example:

Example ConfigMap

kind: ConfigMap
apiVersion: v1
metadata:
  name: rbac-policy
  namespace: rhdh
data:
  rbac-policy.csv: |
    p, role:default/guests, catalog-entity, read, allow
    p, role:default/guests, catalog.entity.create, create, allow

    g, user:default/<YOUR_USER>, role:default/guests

kind: ConfigMap
apiVersion: v1
metadata:
  name: rbac-policy
  namespace: rhdh
data:
  rbac-policy.csv: |
    p, role:default/guests, catalog-entity, read, allow
    p, role:default/guests, catalog.entity.create, create, allow

    g, user:default/<YOUR_USER>, role:default/guests

Copy to Clipboard

In the Developer Hub Helm Chart, go to Root Schema Backstage chart schema Backstage parameters Backstage container additional volume mounts.
Select Add Backstage container additional volume mounts and add the following values:
- mountPath: opt/app-root/src/rbac
- Name: rbac-policy
Add the RBAC policy to the Backstage container additional volumes in the Developer Hub Helm Chart:
- name: rbac-policy
- configMap
  - defaultMode: 420
  - name: rbac-policy

Update the policy path in the app-config.yaml file as follows:

Example app-config.yaml file

permission:
  enabled: true
  rbac:
    policies-csv-file: ./rbac/rbac-policy.csv

permission:
  enabled: true
  rbac:
    policies-csv-file: ./rbac/rbac-policy.csv

Copy to Clipboard

4.1.3. Permission policies in Red Hat Developer Hub

Permission policies in Red Hat Developer Hub are a set of rules to govern access to resources or functionalities. These policies state the authorization level that is granted to users based on their roles. The permission policies are implemented to maintain security and confidentiality within a given environment.

The following permission policies are supported in the Developer Hub:

Catalog permissions

Name	Resource type	Policy	Description
`catalog.entity.read`	`catalog-entity`	read	Allows user or role to read from the catalog
`catalog.entity.create`		create	Allows user or role to create catalog entities, including registering an existing component in the catalog
`catalog.entity.refresh`	`catalog-entity`	update	Allows user or role to refresh a single or multiple entities from the catalog
`catalog.entity.delete`	`catalog-entity`	delete	Allows user or role to delete a single or multiple entities from the catalog
`catalog.location.read`		read	Allows user or role to read a single or multiple locations from the catalog
`catalog.location.create`		create	Allows user or role to create locations within the catalog
`catalog.location.delete`		delete	Allows user or role to delete locations from the catalog

Scaffolder permissions

Name	Resource type	Policy	Description
`scaffolder.action.execute`	`scaffolder-action`		Allows the execution of an action from a template
`scaffolder.template.parameter.read`	`scaffolder-template`	read	Allows user or role to read a single or multiple one parameters from a template
`scaffolder.template.step.read`	`scaffolder-template`	read	Allows user or role to read a single or multiple steps from a template

RBAC permissions

Name	Resource type	Policy	Description
`policy.entity.read`	`policy-entity`	read	Allows user or role to read permission policies and roles
`policy.entity.create`	`policy-entity`	create	Allows user or role to create a single or multiple permission policies and roles
`policy.entity.update`	`policy-entity`	update	Allows user or role to update a single or multiple permission policies and roles
`policy.entity.delete`	`policy-entity`	delete	Allows user or role to delete a single or multiple permission policies and roles

Kubernetes permissions

Name	Resource type	Policy	Description
`kubernetes.proxy`			Allows user or role to access the proxy endpoint

4.2. Role-based Access Control (RBAC) REST API

Red Hat Developer Hub provides RBAC REST API that you can use to manage the permissions and roles in the Developer Hub. This API supports you to facilitate and automate the maintenance of Developer Hub permission policies and roles.

Using the RBAC REST API, you can perform the following actions:

Retrieve information about all permission policies or specific permission policies, or roles
Create, update, or delete a permission policy or a role
Retrieve permission policy information about static plugins

The RBAC REST API requires the following components:

Authorization

The RBAC REST API requires Bearer token authorization for the permitted user role. For development purposes, you can access a web console in a browser. When you refresh a token request in the list of network requests, you find the token in the response JSON.

Authorization: Bearer $token

For example, on the Homepage of the Developer Hub, you can navigate to the Network tab and search for the query?term= network call. Alternatively, you can go to the Catalog page and select any network call with entity-facets to acquire the Bearer token.

HTTP methods

The RBAC REST API supports the following HTTP methods for API requests:

GET: Retrieves specified information from a specified resource endpoint
POST: Creates or updates a resource
PUT: Updates a resource
DELETE: Deletes a resource

Base URL

The base URL for RBAC REST API requests is http://SERVER:PORT/api/permission/policies, such as http://localhost:7007/api/permission/policies.

Endpoints

RBAC REST API endpoints, such as /api/permission/policies/[kind]/[namespace]/[name] for specified kind, namespace, and username, are the URI that you append to the base URL to access the corresponding resource.

Example request URL for /api/permission/policies/[kind]/[namespace]/[name] endpoint is:

http://localhost:7007/api/permission/policies/user/default/johndoe

Note

If at least one permission is assigned to user:default/johndoe, then the example request URL mentioned previously returns a result if sent in a GET response with a valid authorization token. However, if permission is only assigned to roles, then the example request URL does not return an output.

Request data

HTTP POST requests in the RBAC REST API may require a JSON request body with data to accompany the request.

Example POST request URL and JSON request body data for http://localhost:7007/api/permission/policies:

{
    "entityReference": "role:default/test",
    "permission": "catalog-entity",
    "policy": "delete",
    "effect": "allow"
}

{
    "entityReference": "role:default/test",
    "permission": "catalog-entity",
    "policy": "delete",
    "effect": "allow"
}

Copy to Clipboard

HTTP status codes

The RBAC REST API supports the following HTTP status codes to return as responses:

200 OK: The request was successful.
201 Created: The request resulted in a new resource being successfully created.
204 No Content: The request was successful, but there is no additional content to send in the response payload.
400 Bad Request: input error with the request
401 Unauthorized: lacks valid authentication for the requested resource
403 Forbidden: refusal to authorize request
404 Not Found: could not find requested resource
409 Conflict: request conflict with the current state and the target resource

4.2.1. Sending requests with the RBAC REST API using a REST client or curl utility

The RBAC REST API enables you to interact with the permission policies and roles in Developer Hub without using the user interface. You can send RBAC REST API requests using any REST client or curl utility.

Prerequisites

Red Hat Developer Hub is installed and running. For more information about installing Red Hat Developer Hub, see Chapter 2, Installing Red Hat Developer Hub using Helm Chart. .
You have access to the Developer Hub.

Procedure

Identify a relevant API endpoint to which you want to send a request, such as POST /api/permission/policies. Adjust any request details according to your use case.
For REST client:
- Authorization: Enter the generated token from the web console.
- HTTP method: Set to POST.
- URL: Enter the RBAC REST API base URL and endpoint such as http://localhost:7007/api/permission/policies.
For curl utility:
- -X: Set to POST
- -H: Set the following header:
  Content-type: application/json
  Authorization: Bearer $token
  $token is the requested token from the web console in a browser.
- URL: Enter the following RBAC REST API base URL endpoint, such as http://localhost:7007/api/permission/policies
- -d: Add a request JSON body
Example request:
curl -X POST "http://localhost:7007/api/permission/policies" -d '{"entityReference":"role:default/test", "permission": "catalog-entity", "policy": "read", "effect":"allow"}' -H "Content-Type: application/json" -H "Authorization: Bearer $token" -v
Execute the request and review the response.

4.2.2. Supported RBAC REST API endpoints

The RBAC REST API provides the following endpoints for managing permission policies and roles in the Developer Hub and for retrieving information about the policies and roles.

4.2.2.1. Permission policies

The RBAC REST API supports the following endpoints for managing permission policies in the Red Hat Developer Hub.

[GET] /api/permission/policies

Returns permission policies list for all users.

Example response (JSON)

[
  {
    "entityReference": "role:default/test",
    "permission": "catalog-entity",
    "policy": "read",
    "effect": "allow"
  },
  {
    "entityReference": "role:default/test",
    "permission": "catalog.entity.create",
    "policy": "use",
    "effect": "allow"
  },
]

[
  {
    "entityReference": "role:default/test",
    "permission": "catalog-entity",
    "policy": "read",
    "effect": "allow"
  },
  {
    "entityReference": "role:default/test",
    "permission": "catalog.entity.create",
    "policy": "use",
    "effect": "allow"
  },
]

Copy to Clipboard

[GET] /api/permission/policies/{kind}/{namespace}/{name}

Returns permission policies related to the specified entity reference.

Table 4.1. Request parameters
Name	Description	Type	Requirement
`kind`	Kind of the entity	String	Required
`namespace`	Namespace of the entity	String	Required
`name`	Username related to the entity	String	Required

Example response (JSON)

[
  {
    "entityReference": "role:default/test",
    "permission": "catalog-entity",
    "policy": "read",
    "effect": "allow"
  },
  {
    "entityReference": "role:default/test",
    "permission": "catalog.entity.create",
    "policy": "use",
    "effect": "allow"
  }
]

[
  {
    "entityReference": "role:default/test",
    "permission": "catalog-entity",
    "policy": "read",
    "effect": "allow"
  },
  {
    "entityReference": "role:default/test",
    "permission": "catalog.entity.create",
    "policy": "use",
    "effect": "allow"
  }
]

Copy to Clipboard

[POST] /api/permission/policies

Creates a permission policy for a specified entity.

Table 4.2. Request parameters
Name	Description	Type	Requirement
`entityReference`	Reference values of an entity including namespace and name	String	Required
`permission`	Type of the permission	String	Required
`policy`	Read or write policy to the permission	String	Required
`effect`	Indication of allowing or not allowing the policy	String	Required

Example request body (JSON)

{
    "entityReference": "role:default/test",
    "permission": "catalog-entity",
    "policy": "read",
    "effect": "allow"
}

{
    "entityReference": "role:default/test",
    "permission": "catalog-entity",
    "policy": "read",
    "effect": "allow"
}

Copy to Clipboard

Example response

201 Created

201 Created

Copy to Clipboard

[PUT] /api/permission/policies/{kind}/{namespace}/{name}

Updates a permission policy for a specified entity.

Request parameters

The request body contains the oldPolicy and newPolicy objects:

Name	Description	Type	Requirement
`permission`	Type of the permission	String	Required
`policy`	Read or write policy to the permission	String	Required
`effect`	Indication of allowing or not allowing the policy	String	Required

Example request body (JSON)

{
    "oldPolicy": {
        "permission": "catalog-entity",
        "policy": "read",
        "effect": "deny"
    },
    "newPolicy": {
        "permission": "policy-entity",
        "policy": "read",
        "effect": "allow"
    }
}

{
    "oldPolicy": {
        "permission": "catalog-entity",
        "policy": "read",
        "effect": "deny"
    },
    "newPolicy": {
        "permission": "policy-entity",
        "policy": "read",
        "effect": "allow"
    }
}

Copy to Clipboard

Example response

Copy to Clipboard

[DELETE] /api/permission/policies/{kind}/{namespace}/{name}?permission={value1}&policy={value2}&effect={value3}

Deletes a permission policy added to the specified entity.

Table 4.3. Request parameters
Name	Description	Type	Requirement
`kind`	Kind of the entity	String	Required
`namespace`	Namespace of the entity	String	Required
`name`	Username related to the entity	String	Required
`permission`	Type of the permission	String	Required
`policy`	Read or write policy to the permission	String	Required
`effect`	Indication of allowing or not allowing the policy	String	Required

Example response

204 No Content

204 No Content

Copy to Clipboard

[GET] /api/permission/plugins/policies

Returns permission policies for all static plugins.

Example response (JSON)

[
  {
    "pluginId": "catalog",
      "policies": [
        {
          "permission": "catalog-entity",
          "policy": "read"
        },
        {
          "permission": "catalog.entity.create",
          "policy": "create"
        },
        {
          "permission": "catalog-entity",
          "policy": "delete"
        },
        {
          "permission": "catalog-entity",
          "policy": "update"
        },
        {
          "permission": "catalog.location.read",
          "policy": "read"
        },
        {
          "permission": "catalog.location.create",
          "policy": "create"
        },
        {
          "permission": "catalog.location.delete",
          "policy": "delete"
        }
      ]
    },
  ...
]

[
  {
    "pluginId": "catalog",
      "policies": [
        {
          "permission": "catalog-entity",
          "policy": "read"
        },
        {
          "permission": "catalog.entity.create",
          "policy": "create"
        },
        {
          "permission": "catalog-entity",
          "policy": "delete"
        },
        {
          "permission": "catalog-entity",
          "policy": "update"
        },
        {
          "permission": "catalog.location.read",
          "policy": "read"
        },
        {
          "permission": "catalog.location.create",
          "policy": "create"
        },
        {
          "permission": "catalog.location.delete",
          "policy": "delete"
        }
      ]
    },
  ...
]

Copy to Clipboard

4.2.2.2. Roles

The RBAC REST API supports the following endpoints for managing roles in the Red Hat Developer Hub.

[GET] /api/permission/roles

Returns all roles in Developer Hub.

Example response (JSON)

[
  {
    "memberReferences": ["user:default/pataknight"],
    "name": "role:default/guests"
  },
  {
    "memberReferences": [
      "group:default/janus-authors",
      "user:default/matt"
    ],
    "name": "role:default/rbac_admin"
  }
]

[
  {
    "memberReferences": ["user:default/pataknight"],
    "name": "role:default/guests"
  },
  {
    "memberReferences": [
      "group:default/janus-authors",
      "user:default/matt"
    ],
    "name": "role:default/rbac_admin"
  }
]

Copy to Clipboard

[GET] /api/permission/roles/{kind}/{namespace}/{name}

Creates a role in Developer Hub.

Table 4.4. Request parameters
Name	Description	Type	Requirement
`body`	The `memberReferences`, `group`, `namespace`, and `name` the new role to be created.	Request body	Required

Example request body (JSON)

{
  "memberReferences": ["group:default/test"],
  "name": "role:default/test_admin"
}

{
  "memberReferences": ["group:default/test"],
  "name": "role:default/test_admin"
}

Copy to Clipboard

Example response

201 Created

201 Created

Copy to Clipboard

[PUT] /api/permission/roles/{kind}/{namespace}/{name}

Updates memberReferences, kind, namespace, or name for a role in Developer Hub.

Request parameters

The request body contains the oldRole and newRole objects:

Name	Description	Type	Requirement
`body`	The `memberReferences`, `group`, `namespace`, and `name` the new role to be created.	Request body	Required

Example request body (JSON)

{
  "oldRole": {
    "memberReferences": ["group:default/test"],
    "name": "role:default/test_admin"
  },
  "newRole": {
    "memberReferences": ["group:default/test", "user:default/test2"],
    "name": "role:default/test_admin"
  }
}

{
  "oldRole": {
    "memberReferences": ["group:default/test"],
    "name": "role:default/test_admin"
  },
  "newRole": {
    "memberReferences": ["group:default/test", "user:default/test2"],
    "name": "role:default/test_admin"
  }
}

Copy to Clipboard

Example response

200 OK

200 OK

Copy to Clipboard

[DELETE] /api/permission/roles/{kind}/{namespace}/{name}?memberReferences=<VALUE>

Deletes the specified user or group from a role in Developer Hub.

Table 4.5. Request parameters
Name	Description	Type	Requirement
`kind`	Kind of the entity	String	Required
`namespace`	Namespace of the entity	String	Required
`name`	Username related to the entity	String	Required
`memberReferences`	Associated group information	String	Required

Example response

Copy to Clipboard

[DELETE] /api/permission/roles/{kind}/{namespace}/{name}

Deletes a specified role from Developer Hub.

Table 4.6. Request parameters
Name	Description	Type	Requirement
`kind`	Kind of the entity	String	Required
`namespace`	Namespace of the entity	String	Required
`name`	Username related to the entity	String	Required

Example response

Copy to Clipboard

Chapter 4. Role-Based Access Control (RBAC) in Red Hat Developer Hub

4.1. Permission policies configuration

4.1.1. Configuration of permission policies administrators

4.1.2. Configuration of permission policies defined in an external file

4.1.2.1. Mounting `policy.csv` file to the Developer Hub Helm Chart

4.1.3. Permission policies in Red Hat Developer Hub

4.2. Role-based Access Control (RBAC) REST API

4.2.1. Sending requests with the RBAC REST API using a REST client or curl utility

4.2.2. Supported RBAC REST API endpoints

4.2.2.1. Permission policies

4.2.2.2. Roles

Learn

Try, buy, & sell

Communities

About Red Hat Documentation

Making open source more inclusive

About Red Hat

Theme

Red Hat legal and privacy links

Red Hat legal and privacy links

Chapter 4. Role-Based Access Control (RBAC) in Red Hat Developer Hub

4.1. Permission policies configuration

4.1.1. Configuration of permission policies administrators

4.1.2. Configuration of permission policies defined in an external file

4.1.2.1. Mounting policy.csv file to the Developer Hub Helm Chart

4.1.3. Permission policies in Red Hat Developer Hub

4.2. Role-based Access Control (RBAC) REST API

4.2.1. Sending requests with the RBAC REST API using a REST client or curl utility

4.2.2. Supported RBAC REST API endpoints

4.2.2.1. Permission policies

4.2.2.2. Roles

Learn

Try, buy, & sell

Communities

About Red Hat Documentation

Making open source more inclusive

About Red Hat

Theme

Red Hat legal and privacy links

Red Hat legal and privacy links

4.1.2.1. Mounting `policy.csv` file to the Developer Hub Helm Chart