Chapter 5. Managing authorizations by using external files To automate Red Hat Developer Hub maintenance, you can configure permissions and roles in external files, before starting Developer Hub. 5.1. Defining authorizations in external files by using the operator To automate Red Hat Developer Hub maintenance, you can define permissions and roles in external files, before starting Developer Hub. You need to prepare your files, upload them to your OpenShift Container Platform project, and configure Developer Hub to use the external files. Prerequisites You enabled the RBAC feature . Procedure Define your policies in a rbac-policies.csv CSV file by using the following format: Define role permissions: p, <role_entity_reference> , <permission> , <action> , <allow_or_deny> <role_entity_reference> Role entity reference, such as: role:default/guest . <permission> Permission, such as: bulk.import , catalog.entity.read , or catalog.entity.refresh , or permission resource type, such as: bulk-import or catalog-entity . See: Permission policies reference . <action> Action type, such as: use , read , create , update , delete . <allow_or_deny> Access granted: allow or deny . Assign the role to a group or a user: g, <group_or_user> , <role_entity_reference> <group_or_user> Group, such as: user:default/mygroup , or user, such as: user:default/myuser . Sample rbac-policies.csv p, role:default/guests, catalog-entity, read, allow p, role:default/guests, catalog.entity.create, create, allow g, user:default/my-user, role:default/guests g, group:default/my-group, role:default/guests Define your conditional policies in a rbac-conditional-policies.yaml YAML file by using the following format: result: CONDITIONAL roleEntityRef: <role_entity_reference> pluginId: <plugin_id> permissionMapping: - read - update - delete conditions: <conditions> See: Conditional policies reference . Upload your rbac-policies.csv and rbac-conditional-policies.yaml files to a rbac-policies config map in your OpenShift Container Platform project containing Developer Hub. USD oc create configmap rbac-policies \ --from-file=rbac-policies.csv \ --from-file=rbac-conditional-policies.yaml Update your Backstage custom resource to mount in the Developer Hub filesystem your files from the rbac-policies config map: Backstage custom resource fragment apiVersion: rhdh.redhat.com/v1alpha3 kind: Backstage spec: application: extraFiles: mountPath: /opt/app-root/src configMaps: - name: rbac-policies Update your Developer Hub app-config.yaml configuration file to use the rbac-policies.csv and rbac-conditional-policies.yaml external files: app-config.yml fragment permission: enabled: true rbac: conditionalPoliciesFile: /opt/app-root/src/rbac-conditional-policies.yaml policies-csv-file: /opt/app-root/src/rbac-policies.csv policyFileReload: true 5.2. Defining authorizations in external files by using Helm To automate Red Hat Developer Hub maintenance, you can define permissions and roles in external files, before starting Developer Hub. You need to prepare your files, upload them to your OpenShift Container Platform project, and configure Developer Hub to use the external files. Prerequisites You enabled the RBAC feature . Procedure Define your policies in a rbac-policies.csv CSV file by using the following format: Define role permissions: p, <role_entity_reference> , <permission> , <action> , <allow_or_deny> <role_entity_reference> Role entity reference, such as: role:default/guest . <permission> Permission, such as: bulk.import , catalog.entity.read , or catalog.entity.refresh , or permission resource type, such as: bulk-import or catalog-entity . See: Permission policies reference . <action> Action type, such as: use , read , create , update , delete . <allow_or_deny> Access granted: allow or deny . Assign the role to a group or a user: g, <group_or_user> , <role_entity_reference> <group_or_user> Group, such as: user:default/mygroup , or user, such as: user:default/myuser . Sample rbac-policies.csv p, role:default/guests, catalog-entity, read, allow p, role:default/guests, catalog.entity.create, create, allow g, user:default/my-user, role:default/guests g, group:default/my-group, role:default/guests Define your conditional policies in a rbac-conditional-policies.yaml YAML file by using the following format: result: CONDITIONAL roleEntityRef: <role_entity_reference> pluginId: <plugin_id> permissionMapping: - read - update - delete conditions: <conditions> See: Conditional policies reference . Upload your rbac-policies.csv and rbac-conditional-policies.yaml files to a rbac-policies config map in your OpenShift Container Platform project containing Developer Hub. USD oc create configmap rbac-policies \ --from-file=rbac-policies.csv \ --from-file=rbac-conditional-policies.yaml Update your Developer Hub Backstage Helm chart to mount in the Developer Hub filesystem your files from the rbac-policies config map: In the Developer Hub Helm Chart, go to Root Schema Backstage chart schema Backstage parameters Backstage container additional volume mounts . Select Add Backstage container additional volume mounts and add the following values: mountPath /opt/app-root/src/rbac Name rbac-policies Add the RBAC policy to the Backstage container additional volumes in the Developer Hub Helm Chart: name rbac-policies configMap defaultMode 420 name rbac-policies Update your Developer Hub app-config.yaml configuration file to use the rbac-policies.csv and rbac-conditional-policies.yaml external files: app-config.yml fragment permission: enabled: true rbac: conditionalPoliciesFile: /opt/app-root/src/rbac-conditional-policies.yaml policies-csv-file: /opt/app-root/src/rbac-policies.csv policyFileReload: true

Commands:
p, <role_entity_reference> , <permission> , <action> , <allow_or_deny>
g, <group_or_user> , <role_entity_reference>
p, role:default/guests, catalog-entity, read, allow p, role:default/guests, catalog.entity.create, create, allow g, user:default/my-user, role:default/guests g, group:default/my-group, role:default/guests
result: CONDITIONAL roleEntityRef: <role_entity_reference> pluginId: <plugin_id> permissionMapping: - read - update - delete conditions: <conditions>
oc create configmap rbac-policies --from-file=rbac-policies.csv --from-file=rbac-conditional-policies.yaml
apiVersion: rhdh.redhat.com/v1alpha3 kind: Backstage spec: application: extraFiles: mountPath: /opt/app-root/src configMaps: - name: rbac-policies
permission: enabled: true rbac: conditionalPoliciesFile: /opt/app-root/src/rbac-conditional-policies.yaml policies-csv-file: /opt/app-root/src/rbac-policies.csv policyFileReload: true
p, <role_entity_reference> , <permission> , <action> , <allow_or_deny>
g, <group_or_user> , <role_entity_reference>
p, role:default/guests, catalog-entity, read, allow p, role:default/guests, catalog.entity.create, create, allow g, user:default/my-user, role:default/guests g, group:default/my-group, role:default/guests
result: CONDITIONAL roleEntityRef: <role_entity_reference> pluginId: <plugin_id> permissionMapping: - read - update - delete conditions: <conditions>
oc create configmap rbac-policies --from-file=rbac-policies.csv --from-file=rbac-conditional-policies.yaml
permission: enabled: true rbac: conditionalPoliciesFile: /opt/app-root/src/rbac-conditional-policies.yaml policies-csv-file: /opt/app-root/src/rbac-policies.csv policyFileReload: true