Chapter 5. Managing access to projects

Procedure

1. Define a Role or ClusterRole object that specifies the permissions you want to grant for workbench resources. Use a Role to scope permissions to a single project namespace, or use a ClusterRole to define a reusable role that can be assigned across multiple projects. Save the following YAML to a file, or prepare it for import in the OpenShift web console.

   The following example creates a namespace-scoped role that allows a user to view workbenches but not modify them:

   apiVersion: rbac.authorization.k8s.io/v1
   kind: Role
   metadata:
     name: <role_name>
     namespace: <project_namespace>
     labels:
       opendatahub.io/dashboard: true
   rules:
     - apiGroups:
         - kubeflow.org
       resources:
         - notebooks
       verbs:
         - get
         - list
         - watch

   To create a ClusterRole instead, set kind: ClusterRole and omit the namespace field:

   apiVersion: rbac.authorization.k8s.io/v1
   kind: ClusterRole
   metadata:
     name: <role_name>
     labels:
       opendatahub.io/dashboard: true
   rules:
     - apiGroups:
         - kubeflow.org
       resources:
         - notebooks
       verbs:
         - get
         - list
         - watch

   where:

   _<role_name>_

   Specifies a descriptive name for the role, such as workbench-reader or workbench-operator.

   _<project_namespace>_

   Specifies the namespace of the OpenShift AI project where the role applies. This field is required for a Role and must be omitted for a ClusterRole.

2. Create the role by using one of the following methods:

   • CLI: Apply the YAML file by running the following command:

     $ oc apply -f <role_file>.yaml

   • OpenShift web console: In the web console, click the Import YAML icon (+) in the top navigation bar. Paste your YAML definition into the editor and click Create.

3. Verify that the role was created and that the required label is present:

   $ oc get roles -n <project_namespace> <role_name> -o yaml

   Confirm that the opendatahub.io/dashboard: 'true' label is output in the metadata.labels section. This label is required for the role to display in the OpenShift AI dashboard.

Verification

1. Log in to the OpenShift AI dashboard.
2. Navigate to the Permissions tab of the project where you created the role.
3. Click Manage Permissions and verify that your custom role appears in the role selection list with an AI role label in the Role type column.

Procedure

1. From the OpenShift AI dashboard, click Projects.

   The Projects page opens.

2. From the list of projects, click the name of the project that you want to grant access to.

   A project details page opens.

3. Click the Permissions tab.

   The Permissions page for the project opens.

4. Click Manage Permissions.
5. From the Subject Kind list, select User or Group.
6. In the search field, enter the name of the user or group to whom you want to grant access. If the subject is not present in the list, enter the name directly.

7. From the role selection list, select one of the following access permission levels:

   • Admin: Subjects with this access level can edit project details and manage access to the project.
   • Contributor: Subjects with this access level can view and edit project components, such as its workbenches, connections, and storage.
8. Review the assignment summary in the confirmation dialog.
9. Click Confirm to apply the access permissions.
10. Optional: To grant access to additional users or groups, repeat this process.

Procedure

1. From the OpenShift AI dashboard, click Projects.

   The Projects page opens.

2. Click the name of the project in which you want to assign custom roles.

   A project details page opens.

3. Click the Permissions tab.

   The Permissions page for the project opens.

4. Click Manage Permissions.
5. From the Subject Kind list, select User or Group.
6. In the search field, enter the name of the user or group to whom you want to assign a role. If the subject is not present in the list, enter the name directly.

7. From the role selection list, select the custom role to assign. The dashboard displays roles that have the opendatahub.io/dashboard: 'true' label with an AI role label in the Role type column, distinguishing them from default OpenShift roles.

   Note

   You can select multiple roles simultaneously for a single subject. The effective permissions are the union of all assigned roles.

8. Review the role assignment summary in the confirmation dialog.
9. Click Confirm to apply the role assignments.

Procedure

1. From the OpenShift AI dashboard, click Projects.

   The Projects page opens.

2. Click the name of the project that you want to change the access permissions of.

   A project details page opens.

3. Click the Permissions tab.

   The Permissions page for the project opens. Each row shows an individual role assignment for a user or group.

4. Locate the role assignment that you want to update and click the action menu (⋮).

5. Click Manage permissions.

   The Manage Permissions dialog opens.

6. From the role selection list, select the updated access permission level or custom role for the subject.
7. Review the updated assignment summary in the confirmation dialog.
8. Click Confirm to apply the updated access permissions.

Procedure

1. From the OpenShift AI dashboard, click Projects.

   The Projects page opens.

2. Click the name of the project that you want to change the access permissions of.

   A project details page opens.

3. Click the Permissions tab.

   The Permissions page for the project opens. Each row shows an individual role assignment for a user or group.

4. Locate the role assignment that you want to remove and click the action menu (⋮).

5. Click Unassign.

   The Unassign role? dialog opens and warns that the user or group will lose the permissions that this role grants.

   Note

   If the role was assigned through OpenShift rather than through the OpenShift AI dashboard, the dialog warns that you cannot reassign the role from OpenShift AI. To reassign this role, you must use the OpenShift web console or CLI.

6. Click Unassign role to confirm.