Skip to content

Commit 1aa0469

Browse files
authored
Merge pull request #80127 from eromanova97/OBSDOCS-1079
OBSDOCS-1079: Create a table listing and describing all RBAC permissi…
2 parents 4f67b8a + 27032d1 commit 1aa0469

7 files changed

+111
-33
lines changed

modules/monitoring-granting-user-permissions-using-the-cli.adoc

Lines changed: 16 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,12 @@
66
[id="granting-user-permissions-using-the-cli_{context}"]
77
= Granting user permissions by using the CLI
88

9-
You can grant users permissions to monitor their own projects, by using the OpenShift CLI (`oc`).
9+
You can grant users permissions for the `openshift-monitoring` project or their own projects, by using the OpenShift CLI (`oc`).
10+
11+
[IMPORTANT]
12+
====
13+
Whichever role or cluster role you choose, you must bind it against a specific project as a cluster administrator.
14+
====
1015

1116
.Prerequisites
1217

@@ -16,17 +21,18 @@ You can grant users permissions to monitor their own projects, by using the Open
1621
1722
.Procedure
1823

19-
* Assign a monitoring role to a user for a project:
24+
* To assign a monitoring role to a user for a project, enter the following command:
2025
+
2126
[source,terminal]
2227
----
23-
$ oc policy add-role-to-user <role> <user> -n <namespace> <1>
28+
$ oc adm policy add-role-to-user <role> <user> -n <namespace> --role-namespace <namespace> <1>
2429
----
25-
<1> Substitute `<role>` with `monitoring-rules-view`, `monitoring-rules-edit`, or `monitoring-edit`.
26-
+
27-
[IMPORTANT]
28-
====
29-
Whichever role you choose, you must bind it against a specific project as a cluster administrator.
30-
====
30+
<1> Substitute `<role>` with the wanted monitoring role, `<user>` with the user to whom you want to assign the role, and `<namespace>` with the project where you want to grant the access.
31+
32+
* To assign a monitoring cluster role to a user for a project, enter the following command:
3133
+
32-
As an example, substitute `<role>` with `monitoring-edit`, `<user>` with `johnsmith`, and `<namespace>` with `ns1`. This assigns the user `johnsmith` permission to set up metrics collection and to create alerting rules in the `ns1` namespace.
34+
[source,terminal]
35+
----
36+
$ oc adm policy add-cluster-role-to-user <cluster-role> <user> -n <namespace> <1>
37+
----
38+
<1> Substitute `<cluster-role>` with the wanted monitoring cluster role, `<user>` with the user to whom you want to assign the cluster role, and `<namespace>` with the project where you want to grant the access.

modules/monitoring-granting-user-permissions-using-the-web-console.adoc

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@
66
[id="granting-user-permissions-using-the-web-console_{context}"]
77
= Granting user permissions by using the web console
88

9-
You can grant users permissions to monitor their own projects, by using the {product-title} web console.
9+
You can grant users permissions for the `openshift-monitoring` project or their own projects, by using the {product-title} web console.
1010

1111
.Prerequisites
1212

@@ -15,20 +15,20 @@ You can grant users permissions to monitor their own projects, by using the {pro
1515
1616
.Procedure
1717

18-
. In the *Administrator* perspective within the {product-title} web console, navigate to *User Management* -> *RoleBindings* -> *Create binding*.
18+
. In the *Administrator* perspective of the {product-title} web console, go to *User Management* -> *RoleBindings* -> *Create binding*.
1919

20-
. In the *Binding Type* section, select the "Namespace Role Binding" type.
20+
. In the *Binding Type* section, select the *Namespace Role Binding* type.
2121

2222
. In the *Name* field, enter a name for the role binding.
2323

24-
. In the *Namespace* field, select the user-defined project where you want to grant the access.
24+
. In the *Namespace* field, select the project where you want to grant the access.
2525
+
2626
[IMPORTANT]
2727
====
28-
The monitoring role will be bound to the project that you apply in the *Namespace* field. The permissions that you grant to a user by using this procedure will apply only to the selected project.
28+
The monitoring role or cluster role permissions that you grant to a user by using this procedure apply only to the project that you select in the *Namespace* field.
2929
====
3030

31-
. Select `monitoring-rules-view`, `monitoring-rules-edit`, or `monitoring-edit` in the *Role Name* list.
31+
. Select a monitoring role or cluster role from the *Role Name* list.
3232

3333
. In the *Subject* section, select *User*.
3434

modules/monitoring-granting-users-permission-to-monitor-user-defined-projects.adoc

Lines changed: 35 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -10,24 +10,48 @@ As a cluster administrator, you can monitor all core {product-title} and user-de
1010

1111
You can also grant developers and other users different permissions:
1212

13-
* To monitor user-defined projects.
14-
* To configure the components that monitor user-defined projects.
15-
* To configure alert routing for user-defined projects.
13+
* Monitoring user-defined projects
14+
* Configuring the components that monitor user-defined projects
15+
* Configuring alert routing for user-defined projects
16+
* Managing alerts and silences for user-defined projects
1617
17-
You can grant the permissions by assigning one of the following monitoring roles:
18+
You can grant the permissions by assigning one of the following monitoring roles or cluster roles:
1819

20+
.Monitoring roles
1921
|===
20-
|Role name |Description
22+
|Role name |Description |Project
2123

22-
|`monitoring-rules-view` | Users with this cluster role have read access to `PrometheusRule` custom resources for a user-defined project. They can also view the alerts in the *Developer* perspective of the {product-title} web console.
24+
|`user-workload-monitoring-config-edit`
25+
|Users with this role can edit the `user-workload-monitoring-config` `ConfigMap` object to configure Prometheus, Prometheus Operator, Alertmanager, and Thanos Ruler for user-defined workload monitoring.
26+
|`openshift-user-workload-monitoring`
2327

24-
|`monitoring-rules-edit` | Users with this cluster role can create, modify, and delete `PrometheusRule` custom resources for a user-defined project. They can also create and silence alerts in the *Developer* perspective of the {product-title} web console.
28+
|`monitoring-alertmanager-api-reader`
29+
|Users with this role have read access to the user-defined Alertmanager API for all projects, if the user-defined Alertmanager is enabled.
30+
|`openshift-user-workload-monitoring`
2531

26-
|`monitoring-edit` | Users with this cluster role have the same privileges as users with the `monitoring-rules-edit` cluster role. Additionally, users can create, modify, and delete `ServiceMonitor` and `PodMonitor` resources to scrape metrics from services and pods.
32+
|`monitoring-alertmanager-api-writer`
33+
|Users with this role have read and write access to the user-defined Alertmanager API for all projects, if the user-defined Alertmanager is enabled.
34+
|`openshift-user-workload-monitoring`
35+
|===
36+
37+
.Monitoring cluster roles
38+
|===
39+
|Cluster role name |Description |Project
40+
41+
|`monitoring-rules-view`
42+
|Users with this cluster role have read access to `PrometheusRule` custom resources (CRs) for user-defined projects. They can also view the alerts and silences in the *Developer* perspective of the {product-title} web console.
43+
|Can be bound with `RoleBinding` to any user project.
44+
45+
|`monitoring-rules-edit`
46+
|Users with this cluster role can create, modify, and delete `PrometheusRule` CRs for user-defined projects. They can also manage alerts and silences in the *Developer* perspective of the {product-title} web console.
47+
|Can be bound with `RoleBinding` to any user project.
2748

28-
|`user-workload-monitoring-config-edit` | This role is given in the `openshift-user-workload-monitoring` project. Users with this role can edit the `user-workload-monitoring-config` `ConfigMap` object to configure Prometheus, Prometheus Operator, Alertmanager, and Thanos Ruler for user-defined workload monitoring.
49+
|`monitoring-edit`
50+
|Users with this cluster role have the same privileges as users with the `monitoring-rules-edit` cluster role. Additionally, users can create, read, modify, and delete `ServiceMonitor` and `PodMonitor` resources to scrape metrics from services and pods.
51+
|Can be bound with `RoleBinding` to any user project.
2952

30-
|`alert-routing-edit` | Users with this cluster role can create, update, and delete `AlertmanagerConfig` custom resources for a user-defined project.
53+
|`alert-routing-edit`
54+
|Users with this cluster role can create, update, and delete `AlertmanagerConfig` CRs for user-defined projects.
55+
|Can be bound with `RoleBinding` to any user project.
3156
|===
3257

33-
The following sections provide details on how to assign these roles by using the {product-title} web console or the CLI.
Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
// Module included in the following assemblies:
2+
//
3+
// * observability/monitoring/configuring-the-monitoring-stack.adoc
4+
5+
:_mod-docs-content-type: CONCEPT
6+
[id="granting-users-permissions-for-core-platform-monitoring_{context}"]
7+
= Granting users permissions for core platform monitoring
8+
9+
As a cluster administrator, you can monitor all core {product-title} and user-defined projects.
10+
11+
You can also grant developers and other users different permissions for core platform monitoring. You can grant the permissions by assigning one of the following monitoring roles or cluster roles:
12+
13+
|===
14+
|Name |Description |Project
15+
16+
|`cluster-monitoring-metrics-api`
17+
|Users with this role have the ability to access Thanos Querier API endpoints. Additionally, it grants access to the core platform Prometheus API and user-defined Thanos Ruler API endpoints.
18+
|`openshift-monitoring`
19+
20+
|`cluster-monitoring-operator-alert-customization`
21+
|Users with this role can manage `AlertingRule` and `AlertRelabelConfig` resources for core platform monitoring. These permissions are required for the alert customization feature.
22+
|`openshift-monitoring`
23+
24+
|`monitoring-alertmanager-edit`
25+
|Users with this role can manage the Alertmanager API for core platform monitoring. They can also manage alert silences in the *Administrator* perspective of the {product-title} web console.
26+
|`openshift-monitoring`
27+
28+
|`monitoring-alertmanager-view`
29+
|Users with this role can monitor the Alertmanager API for core platform monitoring. They can also view alert silences in the *Administrator* perspective of the {product-title} web console.
30+
|`openshift-monitoring`
31+
32+
|`cluster-monitoring-view`
33+
|Users with this cluster role have the same access rights as `cluster-monitoring-metrics-api` role, with additional permissions, providing access to the `/federate` endpoint for the user-defined Prometheus.
34+
|Must be bound with `ClusterRoleBinding` to gain access to the `/federate` endpoint for the user-defined Prometheus.
35+
|===
36+

observability/monitoring/configuring-the-monitoring-stack.adoc

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -74,6 +74,19 @@ include::modules/monitoring-creating-user-defined-workload-monitoring-configmap.
7474
* xref:../../observability/monitoring/enabling-monitoring-for-user-defined-projects.adoc#enabling-monitoring-for-user-defined-projects[Enabling monitoring for user-defined projects]
7575
endif::openshift-dedicated,openshift-rosa[]
7676

77+
ifndef::openshift-dedicated,openshift-rosa[]
78+
// Granting users permissions for core platform monitoring
79+
include::modules/monitoring-granting-users-permissions-for-core-platform-monitoring.adoc[leveloffset=+1]
80+
81+
[role="_additional-resources"]
82+
.Additional resources
83+
* xref:../../observability/monitoring/enabling-monitoring-for-user-defined-projects.adoc#granting-user-permissions-using-the-web-console_enabling-monitoring-for-user-defined-projects[Granting user permissions by using the web console]
84+
* xref:../../observability/monitoring/enabling-monitoring-for-user-defined-projects.adoc#granting-user-permissions-using-the-cli_enabling-monitoring-for-user-defined-projects[Granting user permissions by using the CLI]
85+
* xref:../../observability/monitoring/accessing-third-party-monitoring-apis.adoc#resources-reference-for-the-cluster-monitoring-operator[Resources reference for the {cmo-full}]
86+
* xref:../../observability/monitoring/accessing-third-party-monitoring-apis.adoc#cmo-services-resources[CMO services resources]
87+
88+
endif::openshift-dedicated,openshift-rosa[]
89+
7790
// Configuring the monitoring stack
7891
include::modules/monitoring-configuring-the-monitoring-stack.adoc[leveloffset=+1]
7992

observability/monitoring/enabling-monitoring-for-user-defined-projects.adoc

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -22,6 +22,11 @@ include::modules/monitoring-enabling-monitoring-for-user-defined-projects.adoc[l
2222
2323
// Granting users permission to monitor user-defined projects
2424
include::modules/monitoring-granting-users-permission-to-monitor-user-defined-projects.adoc[leveloffset=+1]
25+
26+
[role="_additional-resources"]
27+
.Additional resources
28+
* xref:../../observability/monitoring/accessing-third-party-monitoring-apis.adoc#cmo-services-resources[CMO services resources]
29+
2530
include::modules/monitoring-granting-user-permissions-using-the-web-console.adoc[leveloffset=+2]
2631
include::modules/monitoring-granting-user-permissions-using-the-cli.adoc[leveloffset=+2]
2732

observability/monitoring/managing-alerts.adoc

Lines changed: 0 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -15,12 +15,6 @@ In {product-title} {product-version}, the Alerting UI enables you to manage aler
1515
[NOTE]
1616
====
1717
The alerts, silences, and alerting rules that are available in the Alerting UI relate to the projects that you have access to. For example, if you are logged in as a user with the `cluster-admin` role, you can access all alerts, silences, and alerting rules.
18-
19-
If you are a non-administrator user, you can create and silence alerts if you are assigned the following user roles:
20-
21-
* The `cluster-monitoring-view` cluster role, which allows you to access Alertmanager
22-
* The `monitoring-alertmanager-edit` role, which permits you to create and silence alerts in the *Administrator* perspective in the web console
23-
* The `monitoring-rules-edit` cluster role, which permits you to create and silence alerts in the *Developer* perspective in the web console
2418
====
2519

2620
// Accessing the Alerting UI in the Administrator and Developer perspectives

0 commit comments

Comments
 (0)