From d80e85f35337c24f6ba51009126a58203622d22b Mon Sep 17 00:00:00 2001 From: rsriniva Date: Fri, 12 Jul 2024 01:24:17 +0000 Subject: [PATCH] deploy: 6d29be204b690e1dc0b81b346ca13644bf893833 --- devhub-admin/1/chapter1/index.html | 2 +- devhub-admin/1/chapter1/install-helm.html | 2 +- devhub-admin/1/chapter1/install-operator.html | 2 +- devhub-admin/1/chapter1/uninstall.html | 2 +- devhub-admin/1/chapter1/upgrade.html | 2 +- .../chapter2/_images/create-rhdh-secrets.png | Bin 0 -> 147446 bytes .../1/chapter2/_images/edit-backstage-cr.png | Bin 0 -> 204290 bytes .../chapter2/_images/gh-identity-visible.png | Bin 177485 -> 81939 bytes .../1/chapter2/_images/rbac-admin-ui.png | Bin 0 -> 123024 bytes .../_images/rbac-allow-catalog-create.png | Bin 0 -> 139315 bytes .../_images/rbac-confirm-policy-change.png | Bin 0 -> 153442 bytes .../chapter2/_images/rbac-policy-details.png | Bin 0 -> 156598 bytes .../1/chapter2/_images/rbac-token.png | Bin 0 -> 416951 bytes .../1/chapter2/_images/restart-rollout.png | Bin 192977 -> 254098 bytes .../1/chapter2/_images/rhdh-op-resources.png | Bin 0 -> 286184 bytes .../1/chapter2/_images/sign-in-github.png | Bin 62832 -> 42763 bytes .../1/chapter2/_images/view-gh-profile.png | Bin 28776 -> 81268 bytes .../1/chapter2/_images/view-kind-groups.png | Bin 295711 -> 76486 bytes .../1/chapter2/_images/view-kind-users.png | Bin 338011 -> 162460 bytes devhub-admin/1/chapter2/basic-config.html | 184 +++++++++---- devhub-admin/1/chapter2/git-auth.html | 253 +++++++++++------- devhub-admin/1/chapter2/index.html | 2 +- devhub-admin/1/chapter2/rbac.html | 240 +++++++++-------- devhub-admin/1/index.html | 2 +- 24 files changed, 435 insertions(+), 256 deletions(-) create mode 100644 devhub-admin/1/chapter2/_images/create-rhdh-secrets.png create mode 100644 devhub-admin/1/chapter2/_images/edit-backstage-cr.png create mode 100644 devhub-admin/1/chapter2/_images/rbac-admin-ui.png create mode 100644 devhub-admin/1/chapter2/_images/rbac-allow-catalog-create.png create mode 100644 devhub-admin/1/chapter2/_images/rbac-confirm-policy-change.png create mode 100644 devhub-admin/1/chapter2/_images/rbac-policy-details.png create mode 100644 devhub-admin/1/chapter2/_images/rbac-token.png create mode 100644 devhub-admin/1/chapter2/_images/rhdh-op-resources.png diff --git a/devhub-admin/1/chapter1/index.html b/devhub-admin/1/chapter1/index.html index 293156a..9bc976a 100644 --- a/devhub-admin/1/chapter1/index.html +++ b/devhub-admin/1/chapter1/index.html @@ -75,7 +75,7 @@

Red Hat Developer Hub AdministrationBasic Configuration
  • -

    In the Helm Releases page, select the Upgrade option for the rhdh helm chart.

    +

    Click Create to create the ConfigMap.

  • -

    Expand Root Schema → Backstage Chart Schema → Backstage Parameters → Extra App Configuration files to inline into command arguments, and then click Add Extra app configuration files to inline into command arguments.

    +

    The custom application configuration file contains a sensitive environment variable, named BACKEND_SECRET. This variable contains a mandatory backend authentication key that Developer Hub uses to reference an environment variable defined in an OpenShift Container Platform secret. You must create a secret, named secrets-rhdh, and reference it in the Developer Hub CR. Click Secrets > Create Key/value secret.

  • -

    Add app-config-rhdh in the configMapRef field, and app-config-rhdh.yaml in the filename field.

    +

    In the Create key/value secret page, enter secrets-rhdh in the Secret name field, enter BACKEND_SECRET in the Key field. For the Value field, open a new command line terminal and generate a base64 encoded string using the following command:

    +
    +
    +
    $ node -p 'require("crypto").randomBytes(24).toString("base64")'
    +
    +
  • -

    Click Upgrade to redeploy the RHDH container. It may take a few minutes for the RHDH container to be redeployed with the new configuration.

    +

    Copy the randomly generated string to the Value field, and then click Create to create the secret.

    +
    +
    +create rhdh secrets +
    +
    Figure 3. Create a new secret
    +
  • - +
  • +

    Now that you have created your own custom configuration file with an embedded secret, you need to reference the new custom configuration file in the backstage custom resource (CR) and restart the RHDH container for the changes to take effect. Click on Topology in the left sidebar, and then expand the hamburger menu (three vertical dots) next to the rhdh Backstage custom resource (CR) to select the Edit Backstage option

    +
    +
    +edit backstage cr
    -
    -

    Throughout the rest of the course, you will edit the app-config-rhdh ConfigMap to configure and enable plugins for RHDH.

    +
    Figure 4. Edit Backstage CR
    +
    +
  • +
  • +

    Reference the app-config-rhdh ConfigMap and the rhdh-secrets secret in the CR:

    +
    +
    +
    apiVersion: rhdh.redhat.com/v1alpha1
    +kind: Backstage
    +metadata:
    +...
    +spec:
    +  application:
    +    appConfig:
    +      mountPath: /opt/app-root/src
    +      configMaps:
    +         - name: app-config-rhdh
    +    extraEnvs:
    +      secrets:
    +         - name: secrets-rhdh
    +    extraFiles:
    +      mountPath: /opt/app-root/src
    +    replicas: 1
    +    route:
    +      enabled: true
    +  database:
    +    enableLocalDb: true
    +...
    -
    -

    Whenever you change the configuration in the app-config-rhdh ConfigMap, or create/edit any new secrets, you can force RHDH to re-read the configuration by clicking on the RHDH pod in the Topology page and then selecting Restart rollout in the Action drop-down:

    +
  • +
  • +

    Click Save to save the changes to the Backstage CR.

    +
  • +
  • +

    Switch to the Topology view, and expand the menu next to the backstage-rhdh pod. Click Restart rollout to restart the RHDH pod.

    restart rollout
    -
    Figure 2. Restart RHDH Rollout to re-read configuration value changes
    +
    Figure 5. Restart RHDH pod to re-read configuration value changes
    +
    +
  • + + +
    +

    Wait for the RHDH pod to restart (It may take a few minutes). Ensure that the pod is restarted without any errors. To troubleshoot failed startup, click on the backstage-rhdh pod, and then click the Resources tab. Click View logs to view the pod logs. Ensure that you correctly indent the CR yaml file when referencing the secret and ConfigMap. Incorrect indentation may cause the pod restart to fail.

    -

    You can also scale down the RHDH pod to zero (0), and then scale it up back to one or more to reload the configuration.

    +

    Throughout the rest of the course, you will edit the app-config-rhdh ConfigMap to configure and enable plugins for RHDH.

    -
    - - - - - -
    - - -One advantage of using helm charts to deploy and manage RHDH is versioned deployments. If for some reason, your configuration causes RHDH to fail deployment, you can rollback to previous releases and recover your old configuration. Correct your configuration file errors and retry the deployment. -
    +
    +

    Whenever you change the configuration in the app-config-rhdh ConfigMap, or create/edit any new secrets, you can force RHDH to re-read the configuration by clicking on the RHDH pod in the Topology page and then selecting Restart rollout.

    +
    +
    +

    You can also scale down the RHDH pod to zero (0), and then scale it up back to one or more to reload the configuration.

    @@ -355,7 +435,7 @@

    References

    diff --git a/devhub-admin/1/chapter2/git-auth.html b/devhub-admin/1/chapter2/git-auth.html index 72c72a2..0204fbf 100644 --- a/devhub-admin/1/chapter2/git-auth.html +++ b/devhub-admin/1/chapter2/git-auth.html @@ -75,7 +75,7 @@

    Red Hat Developer Hub AdministrationBasic Configuration
  • -

    Edit the app-config-rhdh ConfigMap and configure RHDH to use the GitHub App for authentication. To prevent storing credentials in plain text in the ConfigMap, you will embed the credentials for GitHub in a secret, and then refer the secret in the app-config-rhdh ConfigMap.

    +

    Edit the app-config-rhdh ConfigMap and configure RHDH to use the GitHub App for authentication. To prevent storing credentials in plain text in the ConfigMap, you will embed the credentials for GitHub in a secret, and then refer the secret keys in the app-config-rhdh ConfigMap.

  • @@ -209,19 +212,19 @@

    https://rhdh-developer-hub-devhub.apps.cluster-<GUID>.dynamic.redhatworkshops.io (Your RHDH Route URL)

    +

    Homepage URL: https://backstage-rhdh-devhub.apps.cluster-<GUID>.dynamic.redhatworkshops.io (Your RHDH Route URL)

  • -

    Callback URL: https://rhdh-developer-hub-devhub.apps.cluster-<GUID>.dynamic.redhatworkshops.io/api/auth/github/handler/frame

    +

    Callback URL: https://backstage-rhdh-devhub.apps.cluster-<GUID>.dynamic.redhatworkshops.io/api/auth/github/handler/frame

  • -

    Webhook URL: https://rhdh-developer-hub-devhub.apps.cluster-<GUID>.dynamic.redhatworkshops.io

    +

    Webhook URL: https://backstage-rhdh-devhub.apps.cluster-<GUID>.dynamic.redhatworkshops.io

  • Webhook secret: 5up3rS3cret (Provide a strong secret)

  • -

    Under Permissions, expand Repository Permissions and ensure that you provide appropriate access (Read-Only, Read-Write etc) to the GitHub features you would like to integrate from RHDH. At a minimum, toggle the following permissions:

    +

    Under Permissions, expand Repository Permissions and ensure that you provide appropriate access (Read-Only, Read and Write etc) to the GitHub features you would like to integrate from RHDH. At a minimum, toggle the following permissions. Read-only permissions should be enough. Toggle Read and write permissions only if you are sure you will make changes via the GitHub API:

    +
    + + + + + + + + + + + + + + + + + +
    1Marking the environment as production hides the Guest login in the RHDH home page
    2Add configuration for the GitHub auth provider
    3Generic integration plugin for GitHub. This is used by various GitHub plugins to integrate with the GitHub API
    4Enable log in using GitHub credentials in the RHDH front end
    +
  • @@ -404,57 +434,112 @@

    1. -

      To enable GitHub Organization member discovery, add the following YAML configuration at the same indentation level as the enabled attribute:

      +

      To enable GitHub Organization member discovery, add the following YAML configuration at the same indentation level as the app attribute, and below the signInPage attribute:

      -
          enabled:
      -      github: true
      -      githubOrg: true
      -    catalog:
      -      providers:
      -        githubOrg:
      -          default:
      -            id: development
      -            orgUrl: ${GITHUB_ORG_URL}
      -
      +
      catalog:
      +  providers:
      +    github: (1)
      +      providerId:
      +        organization: "${GITHUB_ORGANIZATION}"
      +        schedule: (2)
      +          frequency:
      +            minutes: 30
      +          initialDelay:
      +            seconds: 15
      +          timeout:
      +            minutes: 15
      +    githubOrg:
      +      githubUrl: "${GITHUB_URL}"
      +      orgs: [ "${GITHUB_ORGANIZATION}" ]
      +      schedule: (2)
      +        frequency:
      +          minutes: 30
      +        initialDelay:
      +          seconds: 15
      +        timeout:
      +          minutes: 15
      +
      + +
      + + + + + + + + + +
      1Configuration for GitHub plugin to periodically scan GitHub repositories and import into the RHDH catalog
      2Scheduled polling of Git repositories and Organization
      -
    2. -
    3. +

      Click Save.

      +
    -

    Upgrade RHDH Helm Chart

    +

    Enable the GitHub Plugins

    -

    The final step is to inject the secret you created with the GitHub App credentials into the RHDH container. You do this by editing the helm chart configuration and refer to the rhdh-secrets. You will also enable the GitHub Organization discovery dynamic plugin.

    +

    The final step is to enable the GitHub and GitHub Organization discovery dynamic plugins.

    1. -

      Edit the rhdh helm chart, toggle Form view, and expand Root Schema > global > Dynamic plugins configuration > List of dynamic plugins that should be installed in the backstage application. Add the value ./dynamic-plugins/dist/backstage-plugin-catalog-backend-module-github-org-dynamic to the Package specification…​ field. This value enables the dynamic plugin for GitHub Organization discovery.

      -
      +

      You need to create a new ConfigMap named dynamic-plugins-rhdh-local and enable the GitHub related plugins. You will enable other plugins in the upcoming courses to enable other RHDH functionality. Create a new ConfigMap using the following YAML snippet:

      +
      -9 gh auth +
      kind: ConfigMap
      +apiVersion: v1
      +metadata:
      +  name: dynamic-plugins-rhdh-local
      +  namespace: devhub
      +data:
      +  dynamic-plugins.yaml: |
      +    includes:
      +      - dynamic-plugins.default.yaml
      +    plugins: (1)
      +      - package: './dynamic-plugins/dist/backstage-plugin-catalog-backend-module-github-dynamic'
      +        disabled: false
      +      - package: './dynamic-plugins/dist/backstage-plugin-catalog-backend-module-github-org-dynamic'
      +        disabled: false
      -
      Figure 3. Enable the GitHub Org Discovery Dynamic Plugin
      +
      +
      + + + + + +
      1Plugin definition and enable or disable on a per-plugin basis
    2. -

      Next, expand Root Schema > Backstage chart schema > Backstage parameters > Backstage container environment variables from existing Secrets and add rhdh-secrets to refer to the secret you created earlier.

      -
      +

      Edit the Backstage custom resource (CR) by clicking Topology and then expanding the Backstage instance menu (Blue badge marked 'B') and then selecting Edit Backstage. Add a new attribute named dynamicPluginsConfigMapName under spec.application as follows and reference the new ConfigMap for the dynamic plugin configuration.

      +
      -3 gh auth +
      ...
      +spec:
      +  application:
      +    appConfig:
      +      configMaps:
      +        - name: app-config-rhdh
      +      mountPath: /opt/app-root/src
      +    dynamicPluginsConfigMapName: dynamic-plugins-rhdh-local
      +    extraEnvs:
      +      secrets:
      +        - name: rhdh-secrets
      +...
      -
      Figure 4. Reference the Secret
      +
      +
      +

      Click Save when done.

    3. -

      Click Upgrade.

      -
    4. -
    5. -

      Wait for a few minutes while the helm chart is upgraded, and the RHDH pod is re-created with the new configuration.

      +

      Restart the RHDH pod by selecting the Restart rollout option in the Topology view. Wait for a few minutes and verify that the pod is restarted without any errors. If there are errors, check the pod logs for missing attributes in the YAML files, or wrong indentation.

    @@ -469,7 +554,7 @@

    guest sign out

    -
    Figure 5. Guest Sign out
    +
    Figure 3. Guest Sign out
  • @@ -478,7 +563,7 @@

    sign in github -
    Figure 6. GitHub Sign in
    +
    Figure 4. GitHub Sign in

  • @@ -487,7 +572,7 @@

    4 gh auth -
    Figure 7. GitHub Allow Access Prompt
    +
    Figure 5. GitHub Allow Access Prompt

  • @@ -496,49 +581,37 @@

    gh identity visible -
    Figure 8. GitHub Identity in Settings Page
    +
    Figure 6. GitHub Identity in Settings Page

  • -

    Click on the logged in User Entity in the Settings page to view the detail imported from GitHub.

    +

    Click on the logged in User Entity in the Settings page to view the detail imported from GitHub. Notice that the plugin has fetched the details of the logged in user from GitHub.

    view gh profile
    -
    Figure 9. View Profile Data
    -
    -
    - - - - - -
    - - -There is a known issue in the RHDH 1.0 version, where it may take more than 30 minutes for the GitHub Organization member discovery plugin to fetch data from GitHub. The schedule is unfortunately fixed and hard-coded in the plugin. This issue will be fixed in a future dot release of the product. -
    +
    Figure 7. View Profile Data
  • -

    Click on the RHDH Catalog in the sidebar. Select the Kind drop-down, and note that two new entities called User and Group are now visible. You may have to wait for 20-30 minutes while the data is fetched from GitHub.

    +

    Click on the RHDH Catalog in the sidebar. Select the Kind drop-down, and note that two new entities called User and Group are now visible. You may have to wait for a few minutes while the data is fetched from GitHub.

  • -

    Select Group in the Kind drop-down to view the teams (mapped into RHDH Groups) imported from the GitHub organization. If you have not created teams in GitHub, then do so now before proceeding. You may have to wait for 20-30 minutes while the data is fetched from GitHub.

    +

    Select Group in the Kind drop-down to view the teams (mapped into RHDH Groups) imported from the GitHub organization. If you have not created teams in GitHub, then do so now before proceeding. You may have to wait for a few minutes while the data is fetched from GitHub.

    view kind groups
    -
    Figure 10. View Groups (Teams) from GitHub
    +
    Figure 8. View Groups (Teams) from GitHub
  • -

    Select User in the Kind drop-down to view the users imported from the GitHub organization. If you have not invited users to your organization in GitHub, then do so now before proceeding. You may have to wait for 20-30 minutes while the data is fetched from GitHub.

    +

    Select User in the Kind drop-down to view the users imported from the GitHub organization. If you have not invited users to your organization in GitHub, then do so now before proceeding. You may have to wait for a few minutes while the data is fetched from GitHub.

    view kind users
    -
    Figure 11. View Users Imported from GitHub
    +
    Figure 9. View Users Imported from GitHub
  • @@ -572,7 +645,7 @@

    References

    Backstage Security Threat Model

  • -

    Set up GitHub Authentication

    +

    Set up GitHub Authentication

  • Required GitHub App Permissions

    diff --git a/devhub-admin/1/chapter2/index.html b/devhub-admin/1/chapter2/index.html index 3674e5d..573a494 100644 --- a/devhub-admin/1/chapter2/index.html +++ b/devhub-admin/1/chapter2/index.html @@ -75,7 +75,7 @@

    Red Hat Developer Hub AdministrationBasic Configuration

  • -

    Sign out from the existing RHDH session and login again using the GitHub ID of the declared policy administrator.

    +

    Restart rollout of the RHDH pod from the Topology view.

  • -

    Navigate to the Catalog page in RHDH, and click CREATE. Note that you are not allowed to create new components.

    +

    Sign out from the existing RHDH session and log in again using the GitHub ID of the declared policy administrator.

  • -

    Next, try navigating to the API page and click on REGISTER EXISTING API. You will be shown an ERROR 404 page. With RBAC enabled, most features are disabled by default. You need to explicitly enable permissions to resources in RHDH.

    -
    -
    -404 error rbac -
    -
    Figure 1. Not allowed to register APIs
    -
    +

    Navigate to the Catalog page in RHDH. Note that the Create button is not visible. You are not allowed to create new components.

    +
  • +
  • +

    Next, try navigating to the API page. The Register button is not visible. With RBAC enabled, most features are disabled by default. You need to explicitly enable permissions to resources in RHDH.

  • -

    Lab: Declarative Policy Definition in CSV Files

    +

    Lab: RBAC Administration UI

    -

    To selectively allow RHDH features, you need to declare roles with allowed policies, and then assign these roles to users or groups.

    -
    -
    -
      -
    1. -

      Edit the app-config-rhdh ConfigMap, and add a reference to the policy CSV file under the rbac attribute that you enabled previously:

      -
      -
      -
      catalog:
      -      providers:
      -        githubOrg:
      -          default:
      -            id: development
      -            orgUrl: ${GITHUB_ORG_URL}
      -permission:
      -      enabled: true
      -      rbac:
      -        policies-csv-file: ./rbac/rbac-policy.csv
      -        admin:
      -          users:
      -            - name: user:default/rsriniva
      -
      -
      -
    2. -
    3. -

      You will create a new ConfigMap to store the contents of the CSV policy file. Create a new ConfigMap named rhdh-rbac-policy with the following content. These policies allow the user with the admins role to read, create and update components, but fetching catalog information from remote locations is denied:

      -
      -
      -
      kind: ConfigMap
      -apiVersion: v1
      -metadata:
      -  name: rhdh-rbac-policy
      -  namespace: devhub
      -immutable: false
      -data:
      -  rbac-policy.csv: |-
      -    p, role:default/admins, catalog-entity, read, allow
      -    p, role:default/admins, catalog.entity.create, create, allow
      -    p, role:default/admins, catalog.entity.refresh, update, allow
      -    p, role:default/admins, catalog.location.create, create, deny
      -    p, role:default/admins, catalog.location.read, read, deny
      -    g, user:default/rsriniva, role:default/admins
      +

      To selectively allow RHDH features, you need to declare roles with allowed policies, and then assign these roles to users or groups. Previous versions of RHDH allowed you to do this using CSV files stored in ConfigMaps. Recent versions of RHDH have introduced a convienient web based UI to manage policies.

      +
      +

      This section covers the RBAC Admin UI. Consult the product documentation for the process to manually specify policies using CSV files.

      -
    4. -
    5. -

      To mount the contents of the RBAC policy CSV file into the RHDH container, edit the rhdh helm chart in Form View and follow the instructions as outlined in https://access.redhat.com/documentation/en-us/red_hat_developer_hub/1.0/html-single/administration_guide_for_red_hat_developer_hub/index#mounting-literal-policy-csv-literal-file-to-the-developer-hub-helm-chart. Ensure that the paths and name of ConfigMap match your set up.

      @@ -319,79 +290,63 @@

      -Exercise caution when adding new volume mounts and new volumes in the helm chart form view. Do NOT delete the existing volume mounts, otherwise various features and functionality in RHDH will be broken +It is recommended to keep the RBAC system disabled when trying out features and functionality of RHDH like Software Templates, plugins, Search, and more. Turn it back on only if you know what you are doing, and you fully understand the impact of policies.
      +
      +
        +
      1. +

        After you have enabled the RBAC dynamic plugin and add users to the rbac.admin.users list in the app-config-rhdh ConfigMap, log in to RHDH and then click Administration in the bottom of the left sidebar.

        +
      2. +
      3. +

        Notice that a new tab called RBAC is now enabled. There is a single role named rbac_admin declared with the users you declared in the rbac.admin.users list assigned to this role.

        -container vol mounts +rbac admin ui
        -
        Figure 2. Container Volume Mounts Configuration
        +
        Figure 1. RBAC Admin UI
        +
      4. +
      5. +

        Click on the role:default/rbac_admin link. The policy details page lists the users assigned to this role in the left column, and the list of permitted policies on the right.

        -container volumes -
        -
        Figure 3. Container Volumes Configuration
        +rbac policy details
        -
        -
        -rbac configmap +
        Figure 2. RBAC Policy Mapping
        -
        Figure 4. RBAC ConfigMap Configuration
        +
        +

        This user is allowed to create, edit, update and delete RBAC policies and view catalog items. With RBAC enabled, you need to explicitly allow users to create catalog items.

      6. -

        Re-deploy the helm chart to re-read the new configuration.

        +

        Switch back the RBAC Administration page. Click Create to add a new policy.

      7. -

        Sign out and sign in again as the user (the user who was assigned the admins role) you mentioned in the policy CSV file. Navigate to the Catalog page, and click CREATE. Note that you are now allowed to create new components.

        +

        In the Create Role screen, enter allow-catalog-create-policy as the policy name, and enter a brief description. Click Next.

      8. -

        Click API and note that you are now allowed to register new APIs.

        +

        In the Add users and groups screen, select users and groups that should be assigned to this role and click Next.

      9. -

        Try and register a new API or component by entering https://github.com/backstage/backstage/blob/master/catalog-info.yaml into the Select URL field, and then click ANALYZE. Note that the deny policy for catalog.location in your RBAC prevents RHDH from fetching the metadata about the component. You will see an error:

        -
        +

        In the Add permission policies screen, select catalog in the Plugin field, and catalog.entity.create in the Resource type field. Ensure Create is selected in the actions and click Next.

        +
      10. +
      11. +

        Review your choices and click Create to create the policy.

        +
        -
        {"error":{"name":"NotAllowedError","message":""},"request":{"method":"POST","url":"/locations?dryRun=true"},"response":{"statusCode":403}}
        +rbac allow catalog create
        +
        Figure 3. RBAC Policy to allow creation of catalog items
      12. -

        Change the rhdh-rbac-policy ConfigMap to allow create and read actions for the catalog.location resource and re-deploy your helm chart. You should now be able to create new components and the metadata fetches from remote Git repositories should work as before.

        -
      13. -
      14. -

        You can experiment with enabling and disabling various components of RHDH by following the permissions guide at https://github.com/janus-idp/backstage-plugins/blob/main/plugins/rbac-backend/docs/permissions.md. Some plugins and their features can be controlled using RBAC.

        +

        You should get a confirmation message that the policy creation was successful. Log out and log in as the user to whom you assigned the policy. Navigate to the Catalog page. Verify that a Create button is now visible. Similarly, click APIs and verify that you can see a Register Existing API button. This user is now allowed to create catalog items. You can assign permissions to delete and update catalog items in a similar manner using the RBAC Admin UI.

      -
      - - - - - -
      - - -There is a bug in the RBAC system when database persistence is enabled for RBAC. Do not enable the database attribute in the rbac permission block in app-config-rhdh! -
      -
      -
      - - - - - -
      - - -You may encounter inconsistencies and bugs with RBAC, and policy examples are scarcely documented. There are plans to introduce a web based UI for policy management in future releases of RHDH. It is recommended to keep the RBAC system disabled when you trying out features and functionality of RHDH like Software Templates, plugins, Search, and more. Turn it back on only if you know what you are doing and you fully understand the impact of policy files. -
      -
    @@ -434,18 +389,89 @@

    RBAC REST A

    +

    Lab: RBAC REST API

    +
    +
    +
      +
    1. +

      To send requests to the RBAC API, you need a JWT token from RHDH to authenticate yourself. In RHDH, log in as a user who can access RBAC policies, and navigate to the Catalog page. Open the browser’s developer tools pane (for example, on Chrome Ctrl+Shift+C), and click the Network tab. Look for HTTP requests like entity-facets?facet=kind and click on that entry. In the Request Headers section look for the Authorization entry. Copy the token value to the clipboard.

      +
      +
      +rbac token +
      +
      Figure 4. Get the Bearer token for the logged in RHDH user
      +
      +
    2. +
    3. +

      Save the token value and RHDH URL to environment variables:

      +
      +
      +
      $ export token=<your token value>
      +$ export RHDH_URL=https://backstage-rhdh-devhub.apps.cluster-<guid>.dynamic.redhatworkshops.io
      +
      +
      +
    4. +
    5. +

      Use the curl and jq CLI tools, or a REST API client, to invoke the RBAC REST API. For example, to list the policies existing in the current RHDH instance:

      +
      +
      +
      $ curl $RHDH_URL/api/permission/roles \
      +  -H "Content-Type: application/json" \
      +  -H "Authorization: Bearer $token" \
      +  -k -s | jq .
      +[
      +  {
      +    "memberReferences": [
      +      "user:default/rsriniva"
      +    ],
      +    "name": "role:default/rbac_admin",
      +    "metadata": {
      +      "source": "configuration",
      +      "description": "The default permission policy for the admin role allows for the creation, deletion, updating, and reading of roles and permission policies.",
      +      "author": "application configuration",
      +      "modifiedBy": "application configuration",
      +      "createdAt": "2024-06-28T11:17:50.000Z",
      +      "lastModified": "2024-07-11T11:00:02.000Z"
      +    }
      +  },
      +  {
      +    "memberReferences": [
      +      "user:default/rsriniva"
      +    ],
      +    "name": "role:default/allow-catalog-create-policy",
      +    "metadata": {
      +      "source": "rest",
      +      "description": "This policy allows users to create catalog items",
      +      "author": "user:default/rsriniva",
      +      "modifiedBy": "user:default/rsriniva",
      +      "createdAt": "2024-07-11T12:03:27.000Z",
      +      "lastModified": "2024-07-11T12:03:27.000Z"
      +    }
      +  }
      +]
      +
      +
      +
      +

      Consult the RBAC REST API product documentation to send other queries (POST, PUT etc) to add, modify, update and delete policies.

      +
      +
    6. +
    +
    +
    +
    + diff --git a/devhub-admin/1/index.html b/devhub-admin/1/index.html index f4788bf..401525e 100644 --- a/devhub-admin/1/index.html +++ b/devhub-admin/1/index.html @@ -74,7 +74,7 @@

    Red Hat Developer Hub Administration< Basic Configuration