Docs: Revoke access to App Plugins (#52542)
* Docs: Revoke access to App Plugins * Describe role and permission * Adding a 'Managing app plugins access' section to plugin management
This commit is contained in:
Gabriel MABILLE
@@ -43,6 +43,16 @@ Apps can also add custom pages for things like control panels.
|
||||
|
||||
Use app plugins when you want to create an custom out-of-the-box monitoring experience.
|
||||
|
||||
### Managing app plugins access
|
||||
|
||||
With [RBAC]({{< relref "../roles-and-permissions/access-control/#about-rbac" >}}), it is now possible to customize access to app plugins.
|
||||
|
||||
By default, Viewers, Editors and Admins have access to all App Plugins that their organization role allows them to access, thanks to the `fixed:plugins.app:reader` role.
|
||||
|
||||
> **Note:** Revoking this RBAC role from some users, will prevent them from accessing app plugins. But granting this RBAC role to users will only allow them to see app plugins their organization role allows them to see.
|
||||
|
||||
To prevent users from seeing an app plugin, refer to [this permissions scenarios]({{< relref "../roles-and-permissions/access-control/plan-rbac-rollout-strategy#prevent-viewers-from-accessing-an-app-plugin" >}}).
|
||||
|
||||
## Plugin catalog
|
||||
|
||||
The Plugin catalog allows you to browse and manage plugins from within Grafana. Only Grafana server administrators and organization administrators can access and use the plugin catalog. The following access rules apply depending on the user role:
|
||||
|
||||
+1
@@ -88,6 +88,7 @@ The following list contains role-based access control actions.
|
||||
| `orgs:delete` | `orgs:*` <br> `orgs:id:*` | Delete one or more organizations. |
|
||||
| `orgs:read` | `orgs:*` <br> `orgs:id:*` | Read one or more organizations. |
|
||||
| `orgs:write` | `orgs:*` <br> `orgs:id:*` | Update one or more organizations. |
|
||||
| `plugins.app:access` | `plugins:*` <br> `plugins:id:*` | Access one or more application plugins (still enforcing the organization role) |
|
||||
| `provisioning:reload` | `provisioners:*` | Reload provisioning files. To find the exact scope for specific provisioner, see [Scope definitions]({{< relref "#scope-definitions" >}}). |
|
||||
| `reports:create` | n/a | Create reports. |
|
||||
| `reports:write` | `reports:*` <br> `reports:id:*` | Update reports. |
|
||||
|
||||
+50
@@ -239,3 +239,53 @@ roles:
|
||||
```
|
||||
|
||||
- Or use [RBAC HTTP API]({{< relref "../../../developers/http_api/access_control/#update-a-role" >}}).
|
||||
|
||||
### Prevent Viewers from accessing an App Plugin
|
||||
|
||||
By default, Viewers, Editors and Admins have access to all App Plugins that their organization role allows them to access.
|
||||
To change this default behavior and prevent Viewers from accessing an App plugin, you must [update a basic role's permissions]({{< relref "./manage-rbac-roles/#update-basic-role-permissions" >}}).
|
||||
|
||||
In this example, three App plugins have been installed and enabled:
|
||||
| Name | ID | Required Org role |
|
||||
|--------------------|-----------------------------|-------------------|
|
||||
| On Call | grafana-oncall-app | Viewer |
|
||||
| Kentik Connect Pro | kentik-connect-app | Viewer |
|
||||
| Enterprise logs | grafana-enterprise-logs-app | Admin |
|
||||
|
||||
By default, Viewers will hence be able to see both, On Call and Kentik Connect Pro App plugins.
|
||||
If you want to revoke their access to the On Call App plugin, you need to:
|
||||
|
||||
1. Remove the permission to access all application plugins:
|
||||
| Action | Scope |
|
||||
|----------------------|-------------|
|
||||
| `plugins.app:access` | `plugins:*` |
|
||||
1. Grant the permission to access the Kentik Connect Pro App plugin only:
|
||||
| Action | Scope |
|
||||
|----------------------|---------------------------------|
|
||||
| `plugins.app:access` | `plugins:id:kentik-connect-app` |
|
||||
|
||||
Here are two ways to achieve this:
|
||||
|
||||
- Use the `role > from` list and `permission > state` option of your provisioning file:
|
||||
|
||||
```yaml
|
||||
---
|
||||
apiVersion: 2
|
||||
|
||||
roles:
|
||||
- name: 'basic:viewer'
|
||||
version: 8
|
||||
global: true
|
||||
from:
|
||||
- name: 'basic:viewer'
|
||||
global: true
|
||||
permissions:
|
||||
- action: 'plugins.app:access'
|
||||
scope: 'plugins:*'
|
||||
state: 'absent'
|
||||
- action: 'plugins.app:access'
|
||||
scope: 'plugins:id:kentik-connect-app'
|
||||
state: 'present'
|
||||
```
|
||||
|
||||
- Or use [RBAC HTTP API]({{< relref "../../../developers/http_api/access_control/#update-a-role" >}}).
|
||||
|
||||
+2
-1
@@ -20,7 +20,7 @@ The following tables list permissions associated with basic and fixed roles.
|
||||
| Grafana Admin | `fixed:roles:reader`<br>`fixed:roles:writer`<br>`fixed:users:reader`<br>`fixed:users:writer`<br>`fixed:org.users:reader`<br>`fixed:org.users:writer`<br>`fixed:ldap:reader`<br>`fixed:ldap:writer`<br>`fixed:stats:reader`<br>`fixed:settings:reader`<br>`fixed:settings:writer`<br>`fixed:provisioning:writer`<br>`fixed:organization:reader`<br>`fixed:organization:maintainer`<br>`fixed:licensing:reader`<br>`fixed:licensing:writer` | Default [Grafana server administrator]({{< relref "../#grafana-server-administrators" >}}) assignments. |
|
||||
| Admin | `fixed:reports:reader`<br>`fixed:reports:writer`<br>`fixed:datasources:reader`<br>`fixed:datasources:writer`<br>`fixed:organization:writer`<br>`fixed:datasources.permissions:reader`<br>`fixed:datasources.permissions:writer`<br>`fixed:teams:writer`<br>`fixed:dashboards:reader`<br>`fixed:dashboards:writer`<br>`fixed:dashboards.permissions:reader`<br>`fixed:dashboards.permissions:writer`<br>`fixed:folders:reader`<br>`fixes:folders:writer`<br>`fixed:folders.permissions:reader`<br>`fixed:folders.permissions:writer`<br>`fixed:alerting:writer`<br>`fixed:apikeys:reader`<br>`fixed:apikeys:writer`<br>`fixed:alerting.provisioning:writer` | Default [Grafana organization administrator]({{< relref "../#organization-users-and-permissions" >}}) assignments. |
|
||||
| Editor | `fixed:datasources:explorer`<br>`fixed:dashboards:creator`<br>`fixed:folders:creator`<br>`fixed:annotations:writer`<br>`fixed:teams:creator` if the `editors_can_admin` configuration flag is enabled<br>`fixed:alerting:writer` | Default [Editor]({{< relref "../#organization-users-and-permissions" >}}) assignments. |
|
||||
| Viewer | `fixed:datasources:id:reader`<br>`fixed:organization:reader`<br>`fixed:annotations:reader`<br>`fixed:annotations.dashboard:writer`<br>`fixed:alerting:reader` | Default [Viewer]({{< relref "../#organization-users-and-permissions" >}}) assignments. |
|
||||
| Viewer | `fixed:datasources:id:reader`<br>`fixed:organization:reader`<br>`fixed:annotations:reader`<br>`fixed:annotations.dashboard:writer`<br>`fixed:alerting:reader`<br>`fixed:plugins.app:reader` | Default [Viewer]({{< relref "../#organization-users-and-permissions" >}}) assignments. |
|
||||
|
||||
## Fixed role definitions
|
||||
|
||||
@@ -65,6 +65,7 @@ The following tables list permissions associated with basic and fixed roles.
|
||||
| `fixed:organization:maintainer` | All permissions from `fixed:organization:reader` and <br> `orgs:write`<br>`orgs:create`<br>`orgs:delete`<br>`orgs.quotas:write` | Create, read, write, or delete an organization. Read or write its quotas. This role needs to be assigned globally. |
|
||||
| `fixed:organization:reader` | `orgs:read`<br>`orgs.quotas:read` | Read an organization and its quotas. |
|
||||
| `fixed:organization:writer` | All permissions from `fixed:organization:reader` and <br> `orgs:write`<br>`orgs.preferences:read`<br>`orgs.preferences:write` | Read an organization, its quotas, or its preferences. Update organization properties, or its preferences. |
|
||||
| `fixed:plugins.app:reader` | `plugins.app:access` | Access application plugins (still enforcing the organization role). |
|
||||
| `fixed:provisioning:writer` | `provisioning:reload` | Reload provisioning. |
|
||||
| `fixed:reports:reader` | `reports:read`<br>`reports:send`<br>`reports.settings:read` | Read all reports and shared report settings. |
|
||||
| `fixed:reports:writer` | All permissions from `fixed:reports:reader` and <br>`reports:create`<br>`reports:write`<br>`reports:delete`<br>`reports.settings:write` | Create, read, update, or delete all reports and shared report settings. |
|
||||
|
||||
Reference in New Issue
Block a user