Chapter 7. Delegating role-based access controls (RBAC) access in Red Hat Developer Hub

Procedure

1. Log in to your RHDH instance with administrator credentials.
2. Navigate to Administration RBAC.
3. Click Create Role and define a new role for team leads, such as role:default/team_lead.
4. In the Members section, add the user or group, such as user:default/team_lead.

5. Grant permissions required by team leads, such as:

   • policy.entity.create to allow policy creation.
   • catalog-entity:read to allow catalog access.

6. Apply conditions to limit access as follows:

   • Use the IS_OWNER rule to ensure team leads can only manage resources they own.
7. Click Save to create the role and apply changes.

Procedure

1. Create a new role designated for team leads using the RBAC backend API:

   Example of creating a new role for the team lead using the RBAC backend API

   curl -X POST 'http://localhost:7007/api/permission/roles' \
   --header "Authorization: Bearer $ADMIN_TOKEN" \
   --header "Content-Type: application/json" \
   --data '{
     "memberReferences": ["user:default/team_lead"],
     "name": "role:default/team_lead",
     "metadata": {
       "description": "This is an example team lead role"
     }
   }'

   Copy to Clipboard

2. Allow team leads to read catalog entities and create permissions in the RBAC plugin using the following API request:

   Example of granting the team lead role permission to create RBAC policies and read catalog entities

   curl -X POST 'http://localhost:7007/api/permission/policies' \
   --header "Authorization: Bearer $ADMIN_TOKEN" \
   --header "Content-Type: application/json" \
   --data '[
     {
       "entityReference": "role:default/team_lead",
       "permission": "policy.entity.create",
       "policy": "create",
       "effect": "allow"
     },
     {
       "entityReference": "role:default/team_lead",
       "permission": "catalog-entity",
       "policy": "read",
       "effect": "allow"
     }
   ]'

   Copy to Clipboard

3. To ensure team leads can only manage what they own, use the IS_OWNER conditional rule as follows:

   Example curl of applying a conditional access policy using the IS_OWNER rule for the team lead role

   curl -X POST 'http://localhost:7007/api/permission/roles/conditions' \
   --header "Authorization: Bearer $ADMIN_TOKEN" \
   --header "Content-Type: application/json" \
   --data '{
    "result": "CONDITIONAL",
    "pluginId": "permission",
    "resourceType": "policy-entity",
    "conditions": {
      "rule": "IS_OWNER",
      "resourceType": "policy-entity",
      "params": {
        "owners": [
          "user:default/team_lead"
        ]
      }
    },
    "roleEntityRef": "role:default/team_lead",
    "permissionMapping": [
      "read",
      "update",
      "delete"
    ]
   }'

   Copy to Clipboard

   The previous example of conditional policy limits visibility and control to only owned roles and policies.

4. Log in to RHDH as team lead and verify the following:

   1. Use the following request and verify that you do not see any roles:

      Example curl to retrieve roles visible to the team lead

      curl -X GET 'http://localhost:7007/api/permission/roles' \
      --header "Authorization: Bearer $TEAM_LEAD_TOKEN"

      Copy to Clipboard

   2. Use the following request to create a new role for their team:

      Example curl of team lead creating a new role for their team with ownership assigned

      curl -X POST 'http://localhost:7007/api/permission/roles' \
      --header "Authorization: Bearer $TEAM_LEAD_TOKEN" \
      --header "Content-Type: application/json" \
      --data '{
        "memberReferences": ["user:default/team_member"],
        "name": "role:default/team_a",
        "metadata": {
          "description": "This is an example team_a role",
          "owner": "user:default/team_lead"
        }
      }'

      Copy to Clipboard

      Note

      You can set the ownership during creation, but you can also update the ownership at any time.

   3. Use the following request to assign a permission policy to the new role:

      Example curl for granting read access to catalog entities for the new role

      curl -X POST 'http://localhost:7007/api/permission/policies' \
      --header "Authorization: Bearer $ADMIN_TOKEN" \
      --header "Content-Type: application/json" \
      --data '[
        {
          "entityReference": "role:default/team_a",
          "permission": "catalog-entity",
          "policy": "read",
          "effect": "allow"
        }
      ]'

      Copy to Clipboard

   4. Use the following request to verify that only team-owned roles and policies are visible:

      Example curl to retrieve roles and permission policies visible to the team lead

      curl -X GET 'http://localhost:7007/api/permission/roles' \
      --header "Authorization: Bearer $TEAM_LEAD_TOKEN"
      
      curl -X GET 'http://localhost:7007/api/permission/policies' \
      --header "Authorization: Bearer $TEAM_LEAD_TOKEN"

      Copy to Clipboard