Ce contenu n'est pas disponible dans la langue sélectionnée.
Chapter 5. Managing authorizations by using external files
To automate Red Hat Developer Hub maintenance, you can configure permissions and roles in external files, before starting Developer Hub.
5.1. Defining authorizations in external files by using the operator
To automate Red Hat Developer Hub maintenance, you can define permissions and roles in external files, before starting Developer Hub. You need to prepare your files, upload them to your OpenShift Container Platform project, and configure Developer Hub to use the external files.
Prerequisites
Procedure
Define your policies in a
rbac-policies.csv
CSV file by using the following format:Define role permissions:
p, <role_entity_reference>, <permission>, <action>, <allow_or_deny>
- <role_entity_reference>
-
Role entity reference, such as:
role:default/guest
. - <permission>
Permission, such as:
bulk.import
,catalog.entity.read
, orcatalog.entity.refresh
, or permission resource type, such as:bulk-import
orcatalog-entity
.- <action>
-
Action type, such as:
use
,read
,create
,update
,delete
. - <allow_or_deny>
-
Access granted:
allow
ordeny
.
Assign the role to a group or a user:
g, <group_or_user>, <role_entity_reference>
- <group_or_user>
Group, such as:
user:default/mygroup
, or user, such as:user:default/myuser
.Sample
rbac-policies.csv
p, role:default/guests, catalog-entity, read, allow p, role:default/guests, catalog.entity.create, create, allow g, user:default/my-user, role:default/guests g, group:default/my-group, role:default/guests
Define your conditional policies in a
rbac-conditional-policies.yaml
YAML file by using the following format:result: CONDITIONAL roleEntityRef: <role_entity_reference> pluginId: <plugin_id> permissionMapping: - read - update - delete conditions: <conditions>
Upload your
rbac-policies.csv
andrbac-conditional-policies.yaml
files to arbac-policies
config map in your OpenShift Container Platform project containing Developer Hub.$ oc create configmap rbac-policies \ --from-file=rbac-policies.csv \ --from-file=rbac-conditional-policies.yaml
Update your Developer Hub
Backstage
custom resource to mount in the Developer Hub filesystem your files from therbac-policies
config map:Backstage
Custom resource fragmentapiVersion: rhdh.redhat.com/v1alpha3 kind: Backstage spec: application: extraFiles: mountPath: /opt/app-root/src configMaps: - name: rbac-policies
Update your Developer Hub
app-config.yaml
configuration file to use therbac-policies.csv
andrbac-conditional-policies.yaml
external files:app-config.yml
fragmentpermission: enabled: true rbac: conditionalPoliciesFile: /opt/app-root/src/rbac-conditional-policies.yaml policies-csv-file: /opt/app-root/src/rbac-policies.csv policyFileReload: true
5.2. Defining authorizations in external files by using Helm
To automate Red Hat Developer Hub maintenance, you can define permissions and roles in external files, before starting Developer Hub. You need to prepare your files, upload them to your OpenShift Container Platform project, and configure Developer Hub to use the external files.
Prerequisites
Procedure
Define your policies in a
rbac-policies.csv
CSV file by using the following format:Define role permissions:
p, <role_entity_reference>, <permission>, <action>, <allow_or_deny>
- <role_entity_reference>
-
Role entity reference, such as:
role:default/guest
. - <permission>
Permission, such as:
bulk.import
,catalog.entity.read
, orcatalog.entity.refresh
, or permission resource type, such as:bulk-import
orcatalog-entity
.- <action>
-
Action type, such as:
use
,read
,create
,update
,delete
. - <allow_or_deny>
-
Access granted:
allow
ordeny
.
Assign the role to a group or a user:
g, <group_or_user>, <role_entity_reference>
- <group_or_user>
Group, such as:
user:default/mygroup
, or user, such as:user:default/myuser
.Sample
rbac-policies.csv
p, role:default/guests, catalog-entity, read, allow p, role:default/guests, catalog.entity.create, create, allow g, user:default/my-user, role:default/guests g, group:default/my-group, role:default/guests
Define your conditional policies in a
rbac-conditional-policies.yaml
YAML file by using the following format:result: CONDITIONAL roleEntityRef: <role_entity_reference> pluginId: <plugin_id> permissionMapping: - read - update - delete conditions: <conditions>
Upload your
rbac-policies.csv
andrbac-conditional-policies.yaml
files to arbac-policies
config map in your OpenShift Container Platform project containing Developer Hub.$ oc create configmap rbac-policies \ --from-file=rbac-policies.csv \ --from-file=rbac-conditional-policies.yaml
Update your Developer Hub
Backstage
Helm chart to mount in the Developer Hub filesystem your files from therbac-policies
config map:-
In the Developer Hub Helm Chart, go to Root Schema
Backstage chart schema Backstage parameters Backstage container additional volume mounts. Select Add Backstage container additional volume mounts and add the following values:
- mountPath
-
/opt/app-root/src
- Name
-
rbac-policies
Add the RBAC policy to the Backstage container additional volumes in the Developer Hub Helm Chart:
- name
-
rbac-policies
- configMap
- defaultMode
-
420
- name
-
rbac-policies
-
In the Developer Hub Helm Chart, go to Root Schema
Update your Developer Hub
app-config.yaml
configuration file to use therbac-policies.csv
andrbac-conditional-policies.yaml
external files:app-config.yml
fragmentpermission: enabled: true rbac: conditionalPoliciesFile: /opt/app-root/src/rbac-conditional-policies.yaml policies-csv-file: /opt/app-root/src/rbac-policies.csv policyFileReload: true