From f72401e23b7d650c727fb6f31de558618aef4c7a Mon Sep 17 00:00:00 2001 From: Ieva Date: Mon, 16 Sep 2024 10:14:52 +0100 Subject: [PATCH] Docs: Add a doc page for RBAC for app plugins (#93274) add a doc page for RBAC for app plugins --- .../administration/plugin-management/index.md | 2 +- .../access-control/_index.md | 2 +- .../custom-role-actions-scopes/index.md | 32 -------- .../access-control/manage-rbac-roles/index.md | 2 - .../rbac-for-app-plugins/index.md | 82 +++++++++++++++++++ .../access-control/troubleshooting/index.md | 2 +- 6 files changed, 85 insertions(+), 37 deletions(-) create mode 100644 docs/sources/administration/roles-and-permissions/access-control/rbac-for-app-plugins/index.md diff --git a/docs/sources/administration/plugin-management/index.md b/docs/sources/administration/plugin-management/index.md index 38d155c65c1..510c488b9ff 100644 --- a/docs/sources/administration/plugin-management/index.md +++ b/docs/sources/administration/plugin-management/index.md @@ -56,7 +56,7 @@ Use app plugins when you want an out-of-the-box monitoring experience. ### Managing access for app plugins -Customize access to app plugins with [RBAC]({{< relref "../roles-and-permissions/access-control/#about-rbac" >}}). +Customize access to app plugins with [RBAC]({{< relref "../roles-and-permissions/access-control/rbac-for-app-plugins" >}}). By default, the Viewer, Editor and Admin roles have access to all app plugins that their Organization role allows them to access. Access is granted by the `fixed:plugins.app:reader` role. diff --git a/docs/sources/administration/roles-and-permissions/access-control/_index.md b/docs/sources/administration/roles-and-permissions/access-control/_index.md index 668f2a84701..888006f4ac7 100644 --- a/docs/sources/administration/roles-and-permissions/access-control/_index.md +++ b/docs/sources/administration/roles-and-permissions/access-control/_index.md @@ -190,8 +190,8 @@ Assign fixed roles when the basic roles do not meet your permission requirements - [Provisioning](/docs/grafana//administration/provisioning/) - [Reports](ref:dashboards-create-reports) - [Roles](ref:roles-and-permissions) -- [Settings](/docs/grafana//setup-grafana/configure-grafana/settings-updates-at-runtime/) - [Service accounts](ref:service-accounts) +- [Settings](/docs/grafana//setup-grafana/configure-grafana/settings-updates-at-runtime/) - [Teams](/docs/grafana//administration/team-management/) - [Users](/docs/grafana//administration/user-management/) diff --git a/docs/sources/administration/roles-and-permissions/access-control/custom-role-actions-scopes/index.md b/docs/sources/administration/roles-and-permissions/access-control/custom-role-actions-scopes/index.md index b6bf833aa0f..6f2d43f3522 100644 --- a/docs/sources/administration/roles-and-permissions/access-control/custom-role-actions-scopes/index.md +++ b/docs/sources/administration/roles-and-permissions/access-control/custom-role-actions-scopes/index.md @@ -181,38 +181,6 @@ The following list contains role-based access control actions. { .no-spacing-list } -### Grafana OnCall action definitions (beta) - -The following list contains role-based access control actions used by Grafana OnCall application plugin. - -| Action | Applicable scopes | Description | -| ------------------------------------------------ | ----------------- | ------------------------------------------------- | -| `grafana-oncall-app.alert-groups:read` | None | Read OnCall alert groups. | -| `grafana-oncall-app.alert-groups:write` | None | Create, edit and delete OnCall alert groups. | -| `grafana-oncall-app.integrations:read` | None | Read OnCall integrations. | -| `grafana-oncall-app.integrations:write` | None | Create, edit and delete OnCall integrations. | -| `grafana-oncall-app.integrations:test` | None | Test OnCall integrations. | -| `grafana-oncall-app.escalation-chains:read` | None | Read OnCall escalation chains. | -| `grafana-oncall-app.escalation-chains:write` | None | Create, edit and delete OnCall escalation chains. | -| `grafana-oncall-app.schedules:read` | None | Read OnCall schedules. | -| `grafana-oncall-app.schedules:write` | None | Create, edit and delete OnCall schedules. | -| `grafana-oncall-app.schedules:export` | None | Export OnCall schedules. | -| `grafana-oncall-app.chatops:read` | None | Read OnCall ChatOps. | -| `grafana-oncall-app.chatops:write` | None | Edit OnCall ChatOps. | -| `grafana-oncall-app.chatops:update-settings` | None | Edit OnCall ChatOps settings. | -| `grafana-oncall-app.maintenance:read` | None | Read OnCall maintenance. | -| `grafana-oncall-app.maintenance:write` | None | Edit OnCall maintenance. | -| `grafana-oncall-app.api-keys:read` | None | Read OnCall API keys. | -| `grafana-oncall-app.api-keys:write` | None | Create, edit and delete OnCall API keys. | -| `grafana-oncall-app.notifications:read` | None | Receive OnCall notifications. | -| `grafana-oncall-app.notification-settings:read` | None | Read OnCall notification settings. | -| `grafana-oncall-app.notification-settings:write` | None | Edit OnCall notification settings. | -| `grafana-oncall-app.user-settings:read` | None | Read user's own OnCall user settings. | -| `grafana-oncall-app.user-settings:write` | None | Edit user's own OnCall user settings. | -| `grafana-oncall-app.user-settings:admin` | None | Read and edit all users' OnCall user settings. | -| `grafana-oncall-app.other-settings:read` | None | Read OnCall settings. | -| `grafana-oncall-app.other-settings:write` | None | Edit OnCall settings. | - ### Grafana Adaptive Metrics action definitions The following list contains role-based access control actions used by Grafana Adaptive Metrics. diff --git a/docs/sources/administration/roles-and-permissions/access-control/manage-rbac-roles/index.md b/docs/sources/administration/roles-and-permissions/access-control/manage-rbac-roles/index.md index ab631eb44c2..5594ec08ef7 100644 --- a/docs/sources/administration/roles-and-permissions/access-control/manage-rbac-roles/index.md +++ b/docs/sources/administration/roles-and-permissions/access-control/manage-rbac-roles/index.md @@ -74,8 +74,6 @@ refs: Available in [Grafana Enterprise](/docs/grafana//introduction/grafana-enterprise/) and [Grafana Cloud](/docs/grafana-cloud). {{% /admonition %}} -{{< table-of-contents >}} - This section includes instructions for how to view permissions associated with roles, create custom roles, and update and delete roles. The following example includes the base64 username:password Basic Authorization. You cannot use authorization tokens in the request. diff --git a/docs/sources/administration/roles-and-permissions/access-control/rbac-for-app-plugins/index.md b/docs/sources/administration/roles-and-permissions/access-control/rbac-for-app-plugins/index.md new file mode 100644 index 00000000000..020bf9c982c --- /dev/null +++ b/docs/sources/administration/roles-and-permissions/access-control/rbac-for-app-plugins/index.md @@ -0,0 +1,82 @@ +--- +aliases: + - ../../../enterprise/access-control/rbac-for-app-plugins/ +description: Learn about how to configure access to app plugins using RBAC +labels: + products: + - cloud +menuTitle: RBAC for app plugins +title: RBAC for app plugins +weight: 90 +refs: + manage-rbac-roles-update-basic-role-permissions: + - pattern: /docs/grafana/ + destination: /docs/grafana//administration/roles-and-permissions/access-control/manage-rbac-roles/#update-basic-role-permissions + - pattern: /docs/grafana-cloud/ + destination: /docs/grafana-cloud/account-management/authentication-and-permissions/access-control/manage-rbac-roles/#update-basic-role-permissions + restrict-access-to-app-plugin-example: + - pattern: /docs/grafana/ + destination: /docs/grafana//administration/roles-and-permissions/access-control/plan-rbac-rollout-strategy/#prevent-viewers-from-accessing-an-app-plugin + - pattern: /docs/grafana-cloud/ + destination: /docs/grafana-cloud/account-management/authentication-and-permissions/access-control/plan-rbac-rollout-strategy/#prevent-viewers-from-accessing-an-app-plugin + adaptive-metrics-permissions: + - pattern: /docs/grafana/ + destination: /docs/grafana//administration/roles-and-permissions/access-control/custom-role-actions-scopes/#grafana-adaptive-metrics-action-definitions + - pattern: /docs/grafana-cloud/ + destination: /docs/grafana-cloud/account-management/authentication-and-permissions/access-control/custom-role-actions-scopes/#grafana-adaptive-metrics-action-definitions + rbac-role-definitions: + - pattern: /docs/grafana/ + destination: /docs/grafana//administration/roles-and-permissions/access-control/rbac-fixed-basic-role-definitions/ + - pattern: /docs/grafana-cloud/ + destination: /docs/grafana-cloud/account-management/authentication-and-permissions/access-control/rbac-fixed-basic-role-definitions/ +--- + +# RBAC for app plugins + +{{% admonition type="note" %}} +Available in [Grafana Cloud](/docs/grafana-cloud). +{{% /admonition %}} + +RBAC can be used to manage access to [app plugins](https://grafana.com/docs/grafana/latest/administration/plugin-management/#app-plugins). +Each app plugin grants the basic Viewer, Editor and Admin organization roles a default set of plugin permissions. +You can use RBAC to restrict which app plugins a basic organization role has access to. +Some app plugins have fine-grained RBAC support, which allows you to grant additional access to these app plugins to teams and users regardless of their basic organization roles. + +## Restricting access to app plugins + +By default, Viewers, Editors and Admins have access to all App Plugins that their organization role allows them to access. +To change this default behavior and prevent a basic organization role from accessing an App plugin, you must [update the basic role's permissions](ref:manage-rbac-roles-update-basic-role-permissions). +See an example of [preventing Viewers from accessing an app plugin](ref:restrict-access-to-app-plugin-example) to learn more. +To grant access to a limited set of app plugins, you will need plugin IDs. You can find them in `plugin.json` files or in the URL when you open the app plugin in the Grafana Cloud UI. + +Note that unless an app plugin has fine-grained RBAC support, it is not possible to grant access to this app plugin for a user whose organization role does not have access to that app plugin. + +## Fine-grained access to app plugins + +Plugins with fine-grained RBAC support allow you to manage access to plugin features at a more granular level. +For instance, you can grant admin access to an app plugin to a user with Viewer organization role. Or restrict the Editor organization role from being able to edit plugin resources. + +Please refer to plugin documentation to see what RBAC permissions the plugin has and what default access the plugin grants to Viewer, Editor and Admin organization roles. + +The following list contains app plugins that have fine-grained RBAC support. + +| App plugin | App plugin ID | App plugin permission documentation | +| ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------ | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | +| [Access policies](https://grafana.com/docs/grafana-cloud/account-management/authentication-and-permissions/access-policies/) | `grafana-auth-app` | n/a | +| [Adaptive metrics](https://grafana.com/docs/grafana-cloud/cost-management-and-billing/reduce-costs/metrics-costs/control-metrics-usage-via-adaptive-metrics/adaptive-metrics-plugin/) | `grafana-adaptive-metrics-app` | [RBAC actions for Adaptive Metrics](ref:adaptive-metrics-permissions) | +| [Incident](https://grafana.com/docs/grafana-cloud/alerting-and-irm/irm/incident/) | `grafana-incident-app` | n/a | +| [OnCall](https://grafana.com/docs/grafana-cloud/alerting-and-irm/irm/oncall/) | `grafana-oncall-app` | [Configure RBAC for OnCall](https://grafana.com/docs/grafana-cloud/alerting-and-irm/irm/oncall/manage/user-and-team-management/#manage-users-and-teams-for-grafana-oncall) | +| [Performance Testing (K6)](https://grafana.com/docs/grafana-cloud/testing/k6/) | `k6-app` | [Configure RBAC for K6](https://grafana.com/docs/grafana-cloud/testing/k6/projects-and-users/configure-rbac/) | +| [Private data source connect (PDC)](https://grafana.com/docs/grafana-cloud/connect-externally-hosted/private-data-source-connect/) | `grafana-pdc-app` | n/a | +| [Service Level Objective (SLO)](https://grafana.com/docs/grafana-cloud/alerting-and-irm/slo/) | `grafana-slo-app` | [Configure RBAC for SLO](https://grafana.com/docs/grafana-cloud/alerting-and-irm/slo/set-up/rbac/) | + +### Revoke fine-grained access from app plugins + +To list all the permissions granted to a basic role, use the [HTTP API endpoint to query for the role](https://grafana.com/docs/grafana/latest/developers/http_api/access_control/#get-a-role). +Basic role UIDs are listed in [RBAC role definitions list](ref:rbac-role-definitions). +To remove the undesired plugin permissions from a basic role, you must [update the basic role's permissions](ref:manage-rbac-roles-update-basic-role-permissions). + +### Grant additional access to app plugins + +To grant access to app plugins, you can use the predefined [fixed plugin roles](https://grafana.com/docs/grafana/latest/administration/roles-and-permissions/access-control/#fixed-roles) or create [custom roles](https://grafana.com/docs/grafana/latest/administration/roles-and-permissions/access-control/#custom-roles) with specific plugin permissions. +To learn about how to assign an RBAC role, refer to [the documentation on assigning RBAC roles](https://grafana.com/docs/grafana/latest/administration/roles-and-permissions/access-control/assign-rbac-roles/#assign-rbac-roles). diff --git a/docs/sources/administration/roles-and-permissions/access-control/troubleshooting/index.md b/docs/sources/administration/roles-and-permissions/access-control/troubleshooting/index.md index 207c47ac66b..81120f03b63 100644 --- a/docs/sources/administration/roles-and-permissions/access-control/troubleshooting/index.md +++ b/docs/sources/administration/roles-and-permissions/access-control/troubleshooting/index.md @@ -8,7 +8,7 @@ labels: - enterprise menuTitle: Troubleshooting RBAC title: Troubleshooting RBAC -weight: 80 +weight: 100 --- # Troubleshooting RBAC