Skip to content

Commit d9836d1

Browse files
mjangADubhlaoich
mjang
and
ADubhlaoich
authored
feature: Describe use of XC-based RBAC (nginx#248)
* feature: Describe use of roles in N1C * Add default roles page * More * Update content/nginx-one/rbac/rbac-api.md * Apply suggestions from code review Co-authored-by: Alan Dooley <a.dooley@f5.com> --------- Co-authored-by: Alan Dooley <a.dooley@f5.com>
1 parent ae1f162 commit d9836d1

File tree

6 files changed

+99
-3
lines changed

6 files changed

+99
-3
lines changed

‎content/includes/security/rbac-intro.md

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
---
2+
files:
3+
- content/nginx-one/rbac/overview.md
4+
- content/nim/admin-guide/rbac/overview-rbac.md
5+
docs: DOCS-000
6+
---
7+
Role-based access control (RBAC) is a security system that governs access to resources within a software application. By assigning specific roles to users or groups, RBAC ensures that only authorized individuals have the ability to perform certain actions or access particular areas.
8+
9+
The value of RBAC lies in its ability to provide clear and structured control over what users can see and do. This makes it easier to maintain security, streamline user management, and ensure compliance with internal policies or regulations. By giving users only the permissions they need to fulfill their roles, RBAC reduces the risk of unauthorized access and fosters a more efficient and secure operating environment.

‎content/nginx-one/rbac/_index.md

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
---
2+
title: Role-based access control
3+
description:
4+
weight: 300
5+
url: /nginx-one/rbac
6+
---

‎content/nginx-one/rbac/overview.md

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
---
2+
title: "Role-based access control overview"
3+
weight: 400
4+
toc: true
5+
type: reference
6+
product: NGINX One
7+
docs: DOCS-000
8+
---
9+
10+
{{< include "security/rbac-intro.md" >}}
11+
12+
The NGINX One Console uses the **[F5 Distributed Cloud User Management](https://docs.cloud.f5.com/docs-v2/administration/how-tos/user-mgmt)** system for access controls and user permissions.
13+
General information can be found on the User Management documentation for **[F5 Distributed Cloud](https://docs.cloud.f5.com/docs-v2/administration/how-tos/user-mgmt)**. This document provides guidance and reference material for utilizing those features to grant and restrict access within the NGINX One Console.

‎content/nginx-one/rbac/rbac-api.md

Lines changed: 45 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,45 @@
1+
---
2+
title: "Custom roles and API groups"
3+
weight: 500
4+
toc: true
5+
type: reference
6+
product: NGINX One
7+
docs: DOCS-000
8+
---
9+
10+
Beyond [Default roles]({{< relref "/nginx-one/rbac/roles.md" >}}), you may need to set up custom roles. For convenience, we include a list of API groups that you could use to specify permissions for custom roles.
11+
12+
These are not NGINX One APIs.
13+
14+
## F5 API groups for NGINX One
15+
16+
The following table lists the **[F5 XC roles](https://docs.cloud.f5.com/docs-v2/administration/how-tos/user-mgmt/roles)** that you can use. These are narrowly scoped API Groups that align with all the features and functionality within the NGINX One Console. These groups can help you create custom roles tailored to your specific needs.
17+
18+
{{< note >}}If you create custom roles using the more granular API Groups, users may not have access until you add the corresponding API Groups to their roles.{{< /note >}}
19+
20+
| API Group Name | Level of Access | Description |
21+
|-----------------------------------------|-----------------|-------------------------------------------------------------------------------------------------------------------------------|
22+
| f5xc-nginx-one-application-monitor | Read | View all features and data. |
23+
| f5xc-nginx-one-application-settings | Write | View and update settings. |
24+
| f5xc-nginx-one-application-write | Write | View and edit all features except settings. |
25+
| f5xc-nginx-one-custom-all-instances-metric-read | Read | View metrics for all Instances. Required to see the Overview dashboard. |
26+
| f5xc-nginx-one-custom-instance-list | Read | View list of all Instances. Also view summarized information such as certificate status and CVEs. |
27+
| f5xc-nginx-one-custom-all-instances-manage | Write | View and delete all Instances. |
28+
| f5xc-nginx-one-custom-instance-manage | Write | View and edit Instance details. |
29+
| f5xc-nginx-one-custom-instance-read | Read | View Instance and configuration details. |
30+
| f5xc-nginx-one-custom-certificate-manage | Write | View TSL/SSL certificate details. Create, update, and delete any managed certificates. |
31+
| f5xc-nginx-one-custom-certificate-read | Read | View TLS/SSL certificates. |
32+
| f5xc-nginx-one-custom-all-certificates-manage | Write | View all TLS/SSL certificates. Delete managed certificates. |
33+
| f5xc-nginx-one-custom-data-plane-key-manage | Write | View, create, update, and delete any Data Plane Keys. Note: The actual Data Plane Key is shown _only_ when created. |
34+
| f5xc-nginx-one-custom-data-plane-key-read | Read | View Data Plane Key Details. Note: The actual Data Plane Key is shown _only_ when created. |
35+
| f5xc-nginx-one-custom-all-data-plane-keys-manage | Write | View and delete Data Plane Keys. |
36+
| f5xc-nginx-one-custom-cve-read | Read | View NGINX CVEs. |
37+
| f5xc-nginx-one-custom-config-sync-group-manage | Write | View, create, update, and delete Config Sync Groups. |
38+
| f5xc-nginx-one-custom-config-sync-group-read | Read | View Config Sync Groups with details. |
39+
| f5xc-nginx-one-custom-all-config-sync-groups-manage | Write | View and delete Config Sync Groups. |
40+
| f5xc-nginx-one-custom-settings-manage | Write | View and update NGINX One Console Settings. |
41+
| f5xc-nginx-one-custom-settings-read | Read | View NGINX One Console Settings. |
42+
| f5xc-nginx-one-custom-event-read | Read | View NGINX One Events. |
43+
| f5xc-nginx-one-custom-ai-assistant | Write | Interact with the NGINX One AI Assistant. |
44+
| f5xc-nginx-one-custom-staged-config-manage | Write | View, create, update, and delete Staged Configs. |
45+
| f5xc-nginx-one-custom-staged-config-read | Read | View Staged Configs. |

‎content/nginx-one/rbac/roles.md

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
---
2+
title: "Default roles"
3+
weight: 500
4+
toc: true
5+
type: reference
6+
product: NGINX One
7+
docs: DOCS-000
8+
---
9+
10+
## Default roles
11+
12+
We provide three default **[roles](https://docs.cloud.f5.com/docs-v2/administration/how-tos/user-mgmt/roles)** that can be used for providing various access levels to the NGINX One Console. These roles will be automatically updated as new features are added to the NGINX One Console. Default roles can be scoped to specific namespaces.
13+
14+
### Admin
15+
16+
The Admin role, identified as <code>f5xc-nginx-one-admin</code>, provides full read and write access to all endpoints and features within the NGINX One Console.
17+
18+
### User
19+
20+
Our standard User role, listed as <code>f5xc-nginx-one-user</code> in the role list, provides read and write access to all endpoints and features, save for those considered to be administrator level. An example of an administrator level feature would be **[Instance Settings](https://docs.nginx.com/nginx-one/how-to/nginx-configs/clean-up-unavailable-instances/)** where unavailable instance clean up logic is set.
21+
22+
### Monitor
23+
24+
Our read only or Monitor role, <code>f5xc-nginx-one-monitor</code>, grants read only access to all non-administrator features and endpoints within the NGINX One Console.
25+

‎content/nim/admin-guide/rbac/overview-rbac.md

Lines changed: 1 addition & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -9,9 +9,7 @@ docs: DOCS-919
99

1010
## Overview
1111

12-
Role-Based Access Control (RBAC) is a security system that governs access to resources within a software application. By assigning specific roles to users or groups, RBAC ensures that only authorized individuals have the ability to perform certain actions or access particular areas.
13-
14-
The value of RBAC lies in its ability to provide clear and structured control over what users can see and do. This makes it easier to maintain security, streamline user management, and ensure compliance with internal policies or regulations. By giving users only the permissions they need to fulfill their roles, RBAC reduces the risk of unauthorized access and fosters a more efficient and secure operating environment.
12+
{{< include "security/rbac-intro.md" >}}
1513

1614
The following are essential concepts related to RBAC:
1715

0 commit comments

Comments
 (0)