Chapter 19. Using declarative configuration

Procedure

1. Create the permission set by entering the following command. This example creates a permission set named "restricted" and is saved as the permission-set.yaml file. It sets read and write access for the Administration resource and read access to the Access resource.

   $ roxctl declarative-config create permission-set \
   --name="restricted" \
   --description="Restriction permission set that only allows \
   access to Administration and Access resources" \
   --resource-with-access=Administration=READ_WRITE_ACCESS \
   --resource-with-access=Access=READ_ACCESS > permission-set.yaml

   Copy to Clipboard Toggle word wrap

2. Create the role that allows access to the Administration and Access resources by entering the following command. This example creates a role named "restricted" and is saved as the role.yaml file.

   $ roxctl declarative-config create role \
   --name="restricted" \
   --description="Restricted role that only allows access to Administration and Access" \
   --permission-set="restricted" \
   --access-scope="Unrestricted" > role.yaml

   Copy to Clipboard Toggle word wrap

3. Create a config map from the two YAML files that were created in the earlier steps by entering the following command. This example creates the declarative-configurations config map.

   $ kubectl create configmap declarative-configurations \
   --from-file permission-set.yaml --from-file role.yaml \
   -o yaml --namespace=stackrox > declarative-configs.yaml

   Copy to Clipboard Toggle word wrap

4. Apply the config map by entering the following command:

   $ kubectl apply -f declarative-configs.yaml

   Copy to Clipboard Toggle word wrap

   After you apply the config map, configuration information extracted from Central creates the resources.

   Note

   Although the watch interval is 5 seconds, as described in the following paragraph, there can be a delay in propagating changes from the config map to the Central mount.

   You can configure the following intervals to specify how declarative configurations interact with Central:

   • Configuration watch interval: The interval for Central to check for changes is every 5 seconds. You can configure this interval by using the ROX_DECLARATIVE_CONFIG_WATCH_INTERVAL environment variable.
   • Reconciliation interval: By default, declarative configuration reconciliation with Central occurs every 20 seconds. You can configure this interval by using the ROX_DECLARATIVE_CONFIG_RECONCILE_INTERVAL environment variable.