From 8e929163a89487936023ef167a83ae4285ad1daa Mon Sep 17 00:00:00 2001 From: Gabriel MABILLE Date: Thu, 1 Dec 2022 09:41:40 +0100 Subject: [PATCH] RBAC: Add config option to reset basic roles on start up (#59598) * RBAC: add config option to reset basic roles on start up Co-authored-by: Jguer * Update docs Co-authored-by: Jguer * Add to sample.ini as well Co-authored-by: Jguer Co-authored-by: Jguer --- conf/defaults.ini | 4 +++ conf/sample.ini | 5 ++++ .../access-control/configure-rbac/index.md | 1 + .../access-control/manage-rbac-roles/index.md | 26 +++++++++++++++++-- pkg/setting/setting.go | 3 +++ 5 files changed, 37 insertions(+), 2 deletions(-) diff --git a/conf/defaults.ini b/conf/defaults.ini index 1892554a067..c5977c38db9 100644 --- a/conf/defaults.ini +++ b/conf/defaults.ini @@ -717,6 +717,10 @@ managed_identity_client_id = # If enabled, cache permissions in a in memory cache permission_cache = true +# Reset basic roles permissions on boot +# Warning left to true, basic roles permissions will be reset on every boot +reset_basic_roles = false + #################################### SMTP / Emailing ##################### [smtp] enabled = false diff --git a/conf/sample.ini b/conf/sample.ini index 8f880bd1ebc..c3820a13193 100644 --- a/conf/sample.ini +++ b/conf/sample.ini @@ -703,6 +703,11 @@ #################################### Role-based Access Control ########### [rbac] ;permission_cache = true + +# Reset basic roles permissions on boot +# Warning left to true, basic roles permissions will be reset on every boot +#reset_basic_roles = false + #################################### SMTP / Emailing ########################## [smtp] ;enabled = false diff --git a/docs/sources/administration/roles-and-permissions/access-control/configure-rbac/index.md b/docs/sources/administration/roles-and-permissions/access-control/configure-rbac/index.md index 05f9e61cbce..3de508026a2 100644 --- a/docs/sources/administration/roles-and-permissions/access-control/configure-rbac/index.md +++ b/docs/sources/administration/roles-and-permissions/access-control/configure-rbac/index.md @@ -18,6 +18,7 @@ The table below describes all RBAC configuration options. Like any other Grafana | ------------------------------- | -------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------- | | `permission_cache` | No | Enable to use in memory cache for loading and evaluating users' permissions. | `true` | | `permission_validation_enabled` | No | Grafana enforces validation for permissions when a user creates or updates a role. The system checks the internal list of scopes and actions for each permission to determine they are valid. By default, if a scope or action is not recognized, Grafana logs a warning message. When set to `true`, Grafana returns an error. | `false` | +| `reset_basic_roles` | No | Reset Grafana's basic roles' (Viewer, Editor, Admin, Grafana Admin) permissions to their default. Warning, if this configuration option is left to `true` this will be done on every reboot. | `true` | ## Example RBAC configuration diff --git a/docs/sources/administration/roles-and-permissions/access-control/manage-rbac-roles/index.md b/docs/sources/administration/roles-and-permissions/access-control/manage-rbac-roles/index.md index 125390be437..1bc77408b09 100644 --- a/docs/sources/administration/roles-and-permissions/access-control/manage-rbac-roles/index.md +++ b/docs/sources/administration/roles-and-permissions/access-control/manage-rbac-roles/index.md @@ -309,7 +309,29 @@ You can also change basic roles' permissions using the API. Refer to the [RBAC H ## Reset basic roles to their default -This section describes how to reset the basic roles to their default: +This section describes how to reset the basic roles to their default. + +You have two options to reset the basic roles permissions to their default. + +### Use the configuration option + +> **Note**: Available as of Grafana Enterprise 9.4. + +> Warning: If this option is left to true, permissions will be reset on every boot. + +Use the [reset_basic_roles]({{< relref "../configure-rbac/#configure-rbac-in-grafana" >}}) option to reset +basic roles permissions to their default on Grafana instance boot up. + +1. Open you configuration file and update the rbac section as follow: + +```bash +[rbac] +reset_basic_roles = true +``` + +### Use the http endpoint + +An alternative to the configuration option is to use the HTTP endpoint. 1. Open the YAML configuration file and locate the `roles` section. @@ -327,7 +349,7 @@ This section describes how to reset the basic roles to their default: permissions: # Permission allowing to reset basic roles - action: 'roles:write' - scope: 'permissions:type:escalate' + scope: 'permissions:type:escalate' ``` 1. As a `Grafana Admin`, call the API endpoint to reset the basic roles to their default. Refer to the [RBAC HTTP API]({{< relref "../../../../developers/http_api/access_control/#reset-basic-roles-to-their-default" >}}) for more details. diff --git a/pkg/setting/setting.go b/pkg/setting/setting.go index bc993a3e07d..e79354ccdb5 100644 --- a/pkg/setting/setting.go +++ b/pkg/setting/setting.go @@ -482,6 +482,8 @@ type Cfg struct { RBACPermissionCache bool // Enable Permission validation during role creation and provisioning RBACPermissionValidationEnabled bool + // Reset basic roles permissions on start-up + RBACResetBasicRoles bool // GRPC Server. GRPCServerNetwork string GRPCServerAddress string @@ -1447,6 +1449,7 @@ func readAccessControlSettings(iniFile *ini.File, cfg *Cfg) { cfg.RBACEnabled = rbac.Key("enabled").MustBool(true) cfg.RBACPermissionCache = rbac.Key("permission_cache").MustBool(true) cfg.RBACPermissionValidationEnabled = rbac.Key("permission_validation_enabled").MustBool(false) + cfg.RBACResetBasicRoles = rbac.Key("reset_basic_roles").MustBool(false) } func readUserSettings(iniFile *ini.File, cfg *Cfg) error {