1.6. About Lightspeed and Role Based Access Control (RBAC)

Prerequisites

• You are logged in to the OpenShift Container Platform web console as a user with the cluster-admin role. Alternatively, you are logged in as a user with the ability to grant permissions.
• You have deployed the OpenShift Lightspeed service.
• You have access to the OpenShift CLI (oc).

Procedure

• Run the following command at the command line:

  $ oc adm policy add-cluster-role-to-user \
  lightspeed-operator-query-access <user_name>

  Alternatively, you can use a YAML file when granting access to an individual user by using the following command:

  $ oc adm policy add-cluster-role-to-user lightspeed-operator-query-access <user_name> -o yaml --dry-run

  The terminal returns the following output:

  apiVersion: rbac.authorization.k8s.io/v1
  kind: ClusterRoleBinding
  metadata:
    creationTimestamp: null
    name: lightspeed-operator-query-access
  roleRef:
    apiGroup: rbac.authorization.k8s.io
    kind: ClusterRole
    name: lightspeed-operator-query-access
  subjects:
  - apiGroup: rbac.authorization.k8s.io
    kind: User
    name: <user_name> 

  1

  1

  Enter the actual user name in place of <user_name> before creating the object.

  Save the output as a YAML file, and run the following command to grant user access:

  $ oc create -f <filename>

Prerequisites

• You are logged in to the OpenShift Container Platform web console as a user with the cluster-admin role. Alternatively, you are logged in as a user with the ability to grant permissions.
• You have deployed the OpenShift Lightspeed service.
• You have access to the OpenShift CLI (oc).

Procedure

• Run the following command at the command line:

  $ oc adm policy add-cluster-role-to-group \
  lightspeed-operator-query-access <group_name>

  Alternatively, you can use a YAML file when granting access to a user group by using the following command:

  $ oc adm policy add-cluster-role-to-group lightspeed-operator-query-access <group_name> -o yaml --dry-run

  The terminal returns the following output:

  apiVersion: rbac.authorization.k8s.io/v1
  kind: ClusterRoleBinding
  metadata:
    creationTimestamp: null
    name: lightspeed-operator-query-access
  roleRef:
    apiGroup: rbac.authorization.k8s.io
    kind: ClusterRole
    name: lightspeed-operator-query-access
  subjects:
  - apiGroup: rbac.authorization.k8s.io
    kind: Group
    name: <user_group> 

  1

  1

  Enter the actual user group in place of <user_group> before creating the object.

  Save the output as a YAML file, and run the following command to grant access to the user group:

  $ oc create -f <filename>