Chapter 6. Managing authorizations by using external files

Procedure

1. Define your policies in a rbac-policies.csv CSV file by using the following format:

   1. Define role permissions:

      p, <role_entity_reference>, <permission>, <action>, <allow_or_deny>

      <role_entity_reference>

      Role entity reference, such as: role:default/guest.

      <permission>

      Permission, such as: bulk.import, catalog.entity.read, or catalog.entity.refresh, or permission resource type, such as: bulk-import or catalog-entity.

      See: Permission policies reference.

      <action>

      Action type, such as: use, read, create, update, delete.

      <allow_or_deny>

      Access granted: allow or deny.

   2. Assign the role to a group or a user:

      g, <group_or_user>, <role_entity_reference>

      <group_or_user>

      Group, such as: user:default/mygroup, or user, such as: user:default/myuser.

      Sample rbac-policies.csv

      p, role:default/guests, catalog-entity, read, allow
      p, role:default/guests, catalog.entity.create, create, allow
      g, user:default/my-user, role:default/guests
      g, group:default/my-group, role:default/guests

2. Define your conditional policies in a rbac-conditional-policies.yaml YAML file by using the following format:

   result: CONDITIONAL
   roleEntityRef: <role_entity_reference>
   pluginId: <plugin_id>
   permissionMapping:
     - read
     - update
     - delete
   conditions: <conditions>

   See: Conditional policies reference.

3. Upload your rbac-policies.csv and rbac-conditional-policies.yaml files to a rbac-policies config map in your OpenShift Container Platform project containing Developer Hub.

   $ oc create configmap rbac-policies \
        --from-file=rbac-policies.csv \
        --from-file=rbac-conditional-policies.yaml

4. Update your Backstage custom resource to mount in the Developer Hub filesystem your files from the rbac-policies config map:

   Backstage custom resource fragment

   apiVersion: rhdh.redhat.com/v1alpha3
   kind: Backstage
   spec:
     application:
       extraFiles:
         mountPath: /opt/app-root/src
         configMaps:
           - name: rbac-policies

5. Update your Developer Hub app-config.yaml configuration file to use the rbac-policies.csv and rbac-conditional-policies.yaml external files:

   app-config.yaml file fragment

   permission:
     enabled: true
     rbac:
       conditionalPoliciesFile: /opt/app-root/src/rbac-conditional-policies.yaml
       policies-csv-file: /opt/app-root/src/rbac-policies.csv
       policyFileReload: true

Procedure

1. Define your policies in a rbac-policies.csv CSV file by using the following format:

   1. Define role permissions:

      p, <role_entity_reference>, <permission>, <action>, <allow_or_deny>

      <role_entity_reference>

      Role entity reference, such as: role:default/guest.

      <permission>

      Permission, such as: bulk.import, catalog.entity.read, or catalog.entity.refresh, or permission resource type, such as: bulk-import or catalog-entity.

      See: Permission policies reference.

      <action>

      Action type, such as: use, read, create, update, delete.

      <allow_or_deny>

      Access granted: allow or deny.

   2. Assign the role to a group or a user:

      g, <group_or_user>, <role_entity_reference>

      <group_or_user>

      Group, such as: user:default/mygroup, or user, such as: user:default/myuser.

      Sample rbac-policies.csv

      p, role:default/guests, catalog-entity, read, allow
      p, role:default/guests, catalog.entity.create, create, allow
      g, user:default/my-user, role:default/guests
      g, group:default/my-group, role:default/guests

2. Define your conditional policies in a rbac-conditional-policies.yaml YAML file by using the following format:

   result: CONDITIONAL
   roleEntityRef: <role_entity_reference>
   pluginId: <plugin_id>
   permissionMapping:
     - read
     - update
     - delete
   conditions: <conditions>

   See: Conditional policies reference.

3. Upload your rbac-policies.csv and rbac-conditional-policies.yaml files to a rbac-policies config map in your OpenShift Container Platform project containing Developer Hub.

   $ oc create configmap rbac-policies \
        --from-file=rbac-policies.csv \
        --from-file=rbac-conditional-policies.yaml

4. Update your Developer Hub Backstage Helm chart to mount in the Developer Hub filesystem your files from the rbac-policies config map:

   1. In the Developer Hub Helm Chart, go to Root Schema Backstage chart schema Backstage parameters Backstage container additional volume mounts.

   2. Select Add Backstage container additional volume mounts and add the following values:

      mountPath

      /opt/app-root/src/rbac

      Name

      rbac-policies

   3. Add the RBAC policy to the Backstage container additional volumes in the Developer Hub Helm Chart:

      name

      rbac-policies

      configMap

      defaultMode

      420

      name

      rbac-policies

5. Update your Developer Hub app-config.yaml configuration file to use the rbac-policies.csv and rbac-conditional-policies.yaml external files:

   app-config.yaml file fragment

   permission:
     enabled: true
     rbac:
       conditionalPoliciesFile: /opt/app-root/src/rbac-conditional-policies.yaml
       policies-csv-file: /opt/app-root/src/rbac-policies.csv
       policyFileReload: true