Skip to content

Commit 592d29d

Browse files
rm3lthemr0chmanwani-rh
authored
docs(rbac): Document how to mount the RBAC policy CSV file using the Operator [RHIDP-1783] (#499)
Co-authored-by: Fabrice Flore-Thébault <ffloreth@redhat.com> Co-authored-by: Heena Manwani <59050394+hmanwani-rh@users.noreply.github.com>
1 parent db9704c commit 592d29d

File tree

4 files changed

+154
-67
lines changed

4 files changed

+154
-67
lines changed

‎assemblies/assembly-configuring-authorization-in-rhdh.adoc‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -15,6 +15,10 @@ include::modules/admin/con-rbac-config-permission-policies-admin.adoc[leveloffse
1515

1616
include::modules/admin/con-rbac-config-permission-policies-external-file.adoc[leveloffset=+3]
1717

18+
include::modules/admin/proc-mounting-the-policy-csv-file-using-the-operator.adoc[leveloffset=+4]
19+
20+
include::modules/admin/proc-mounting-the-policy-csv-file-using-helm.adoc[leveloffset=+4]
21+
1822

1923
include::modules/admin/con-rbac-conditional-policies-rhdh.adoc[leveloffset=+1]
2024

‎modules/admin/con-rbac-config-permission-policies-external-file.adoc‎

Lines changed: 0 additions & 67 deletions
Original file line numberDiff line numberDiff line change
@@ -64,70 +64,3 @@ permission:
6464
policyFileReload: true
6565
# ...
6666
----
67-
68-
== Mounting `policy.csv` file to the {product-short} Helm chart
69-
70-
When the {product} is deployed with the Helm chart, you must define the `policy.csv` file by mounting it to the {product-short} Helm chart.
71-
72-
You can add your `policy.csv` file to the {product-short} Helm Chart by creating a `configMap` and mounting it.
73-
74-
.Prerequisites
75-
76-
* You are logged in to your {ocp-short} account using the {ocp-short} web console.
77-
* {product} is installed and deployed using Helm Chart.
78-
+
79-
//For more information about installing the {product} on {ocp-short} using Helm Chart, see xref:proc-install-rhdh-ocp-helm_{context}[].
80-
//replace with a link to the installation guide.
81-
82-
.Procedure
83-
84-
. In {ocp-short}, create a ConfigMap to hold the policies as shown in the following example:
85-
+
86-
--
87-
.Example `ConfigMap`
88-
[source,yaml]
89-
----
90-
kind: ConfigMap
91-
apiVersion: v1
92-
metadata:
93-
name: rbac-policy
94-
namespace: rhdh
95-
data:
96-
rbac-policy.csv: |
97-
p, role:default/guests, catalog-entity, read, allow
98-
p, role:default/guests, catalog.entity.create, create, allow
99-
100-
g, user:default/<YOUR_USER>, role:default/guests
101-
----
102-
--
103-
104-
. In the {product-short} Helm Chart, go to *Root Schema -> Backstage chart schema -> Backstage parameters -> Backstage container additional volume mounts*.
105-
. Select *Add Backstage container additional volume mounts* and add the following values:
106-
+
107-
--
108-
* *mountPath*: `opt/app-root/src/rbac`
109-
* *Name*: `rbac-policy`
110-
--
111-
112-
. Add the RBAC policy to the *Backstage container additional volumes* in the {product-short} Helm Chart:
113-
+
114-
--
115-
* *name*: `rbac-policy`
116-
* *configMap*
117-
** *defaultMode*: `420`
118-
** *name*: `rbac-policy`
119-
--
120-
121-
. Update the policy path in the `app-config.yaml` file as follows:
122-
+
123-
--
124-
.Example `app-config.yaml` file
125-
[source,yaml]
126-
----
127-
permission:
128-
enabled: true
129-
rbac:
130-
policies-csv-file: ./rbac/rbac-policy.csv
131-
----
132-
--
133-

‎modules/admin/proc-mounting-the-policy-csv-file-using-helm.adoc‎

Lines changed: 66 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,66 @@
1+
[id='proc-mounting-the-policy-csv-file-using-helm_{context}']
2+
= Mounting `policy.csv` file to the {product-short} Helm chart
3+
4+
When the {product} is deployed with the Helm chart, you must define the `policy.csv` file by mounting it to the {product-short} Helm chart.
5+
6+
You can add your `policy.csv` file to the {product-short} Helm Chart by creating a `configMap` and mounting it.
7+
8+
.Prerequisites
9+
10+
* You are logged in to your {ocp-short} account using the {ocp-short} web console.
11+
* {product} is installed and deployed using Helm Chart.
12+
+
13+
//For more information about installing the {product} on {ocp-short} using Helm Chart, see xref:proc-install-rhdh-ocp-helm_{context}[].
14+
//replace with a link to the installation guide.
15+
16+
.Procedure
17+
18+
. In {ocp-short}, create a ConfigMap to hold the policies as shown in the following example:
19+
+
20+
--
21+
.Example `ConfigMap`
22+
[source,yaml]
23+
----
24+
kind: ConfigMap
25+
apiVersion: v1
26+
metadata:
27+
name: rbac-policy
28+
namespace: rhdh
29+
data:
30+
rbac-policy.csv: |
31+
p, role:default/guests, catalog-entity, read, allow
32+
p, role:default/guests, catalog.entity.create, create, allow
33+
34+
g, user:default/<YOUR_USER>, role:default/guests
35+
----
36+
--
37+
38+
. In the {product-short} Helm Chart, go to *Root Schema -> Backstage chart schema -> Backstage parameters -> Backstage container additional volume mounts*.
39+
. Select *Add Backstage container additional volume mounts* and add the following values:
40+
+
41+
--
42+
* *mountPath*: `opt/app-root/src/rbac`
43+
* *Name*: `rbac-policy`
44+
--
45+
46+
. Add the RBAC policy to the *Backstage container additional volumes* in the {product-short} Helm Chart:
47+
+
48+
--
49+
* *name*: `rbac-policy`
50+
* *configMap*
51+
** *defaultMode*: `420`
52+
** *name*: `rbac-policy`
53+
--
54+
55+
. Update the policy path in the `app-config.yaml` file as follows:
56+
+
57+
--
58+
.Example `app-config.yaml` file
59+
[source,yaml]
60+
----
61+
permission:
62+
enabled: true
63+
rbac:
64+
policies-csv-file: ./rbac/rbac-policy.csv
65+
----
66+
--

‎modules/admin/proc-mounting-the-policy-csv-file-using-the-operator.adoc‎

Lines changed: 84 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,84 @@
1+
[id='proc-mounting-the-policy-csv-file-using-the-operator_{context}']
2+
= Mounting `policy.csv` file using the {product-short} Operator
3+
4+
When the {product} is deployed with the Operator, you can add your `policy.csv` file using the {product-short} Operator by creating a `ConfigMap` and mounting it through your Custom Resource (CR).
5+
6+
.Prerequisites
7+
8+
* You are logged in to your {ocp-short} account using the {ocp-short} web console.
9+
* {product} is installed and deployed using the Operator.
10+
* You have added a custom configuration file to {ocp-short}. For more information, see link:{LinkAdminGuide}[Adding a custom configuration file to {ocp-short}].
11+
+
12+
//For more information about installing the {product} on {ocp-short} using the Operator, see xref:proc-install-rhdh-ocp-operator_{context}[].
13+
//replace with a link to the installation guide.
14+
15+
.Procedure
16+
17+
. In {ocp-short}, create a ConfigMap to hold the policies as shown in the following example:
18+
+
19+
--
20+
.Example `ConfigMap`
21+
[source,yaml]
22+
----
23+
kind: ConfigMap
24+
apiVersion: v1
25+
metadata:
26+
name: rbac-policy
27+
data:
28+
rbac-policy.csv: |
29+
p, role:default/guests, catalog-entity, read, allow
30+
p, role:default/guests, catalog.entity.create, create, allow
31+
32+
g, user:default/<YOUR_USER>, role:default/guests
33+
----
34+
--
35+
36+
. Update the policy path in your custom `app-config.yaml` ConfigMap as follows:
37+
+
38+
--
39+
.Example `app-config.yaml` file
40+
[source,yaml]
41+
----
42+
permission:
43+
enabled: true
44+
rbac:
45+
policies-csv-file: ./rbac-policy.csv
46+
----
47+
--
48+
49+
. From the *Developer* perspective in the {ocp-short} web console, select the *Topology* view.
50+
. Click the overflow menu for the {product} instance that you want to use and select *Edit Backstage* to load the YAML view of the {product} instance.
51+
. In the CR, enter the name of the custom `rbac-policy` ConfigMap as the value for the `spec.application.extraFiles.configMaps` field. For example:
52+
+
53+
.Example custom resource
54+
[source, yaml]
55+
----
56+
apiVersion: v1
57+
kind: ConfigMap
58+
metadata:
59+
name: example
60+
spec:
61+
application:
62+
appConfig:
63+
mountPath: /opt/app-root/src
64+
configMaps:
65+
- name: app-config-rhdh
66+
extraEnvs:
67+
secrets:
68+
- name: secrets-rhdh
69+
extraFiles:
70+
mountPath: /opt/app-root/src
71+
configMaps:
72+
- name: rbac-policy
73+
replicas: 1
74+
route:
75+
enabled: true
76+
database:
77+
enableLocalDb: true
78+
----
79+
. Click *Save*.
80+
81+
.Verification
82+
83+
. Navigate back to the *Topology* view and wait for the {product} pod to start.
84+
. Click the *Open URL* icon to access the {product} platform with the updated configuration settings.

0 commit comments

Comments
 (0)