You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
* Update access-control.md
Updated with new AND rules
* Update access rules
Updated content and screenshots to reflect ABAC AND and OR
* Update screenshots and content
Updated screenshots and content for account management overview topic
* Update access-control.md
* Update access-control.md
*[Configure Single Sign-On (SSO)]({{site.baseurl}}/docs/administration/single-sign-on/)
15
+
* Get [audit logs]({{site.baseurl}}/docs/administration/account-user-management/audit/) for runtimes (hosted or private)
16
+
* Learn [which IP addresses]({{site.baseurl}}/docs/administration/platform-ip-addresses/) are used for SAAS runtimes
17
+
18
+
<!--- For on-premises environments, see [On-premises account and user setup]({{site.baseurl}}/docs/installation/on-premises/on-prem-configuration/). -->
Copy file name to clipboardExpand all lines: _docs/administration/account-user-management/access-control.md
+49-40Lines changed: 49 additions & 40 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -19,8 +19,8 @@ You can then create rules that combine roles, attributes, and CRUD (Create/Read/
19
19
[Role-based access](#role-based-access-for-users-and-administrators) restricts access based on the _who (the kind of user)_. Access is granted based on the user's job responsibilities or position within an organization. Codefresh administrators can access UI functionality that you would deny to other users. For example, only account administrators can create and modify integrations with Git providers and cloud services, while other users can create, run, and modify pipelines.
20
20
21
21
***Attribute-based access control (ABAC)**
22
-
Access control via attributes, restricts access to entities based on the _what (the type of access)_. Assigning attributes, or tags as in Codefresh to entities makes it easy to enforce a more flexible and secure form of access control.
23
-
For example, add tags to projects, and then enforce access control for pipelines through project tags, instead of relying on pipeline-level tags. So you can add tags to projects with pipelines that all teams can view and run (Read), but only the platform team can Create/Edit/Delete.
22
+
Access control via attributes, restricts access to entities based on the _what (the type of access)_. Assigning attributes or tags as they are also referred to, to Codefresh entities makes it easy to enforce a more flexible and secure form of access control.
23
+
For example, by adding tags to projects, you can enforce access control for pipelines through project tags, instead of relying on pipeline-level tags. So you can add tags to projects with pipelines that all teams can view and run (Read), but only the platform team can Create/Edit/Delete.
24
24
See [ABAC for entities with tags and rules](#abac-for-entities-with-tags-and-rules).
25
25
26
26
***YAML source and Git-repository access**
@@ -32,7 +32,8 @@ Let's review the different access mechanisms in more detail, including privilege
32
32
33
33
Role-based access is usually defined when you [add teams]({{site.baseurl}}/docs/administration/account-user-management/add-users/#teams-in-codefresh). Role-based access means assigning either a user or an administrator role.
34
34
35
-
> Only a user with an administrator role can add other users, and assign or change user roles.
35
+
>**NOTE:**
36
+
Only a user with an administrator role can add other users, and assign or change user roles.
36
37
37
38
38
39
{% include
@@ -73,14 +74,18 @@ The table below lists the functionality available for the `Admin` and `User` rol
73
74
## ABAC for entities with tags and rules
74
75
75
76
ABAC (Attribute-Based Access Control), allows fine-grained access to all entities, Kubernetes clusters, Codefresh pipelines, projects, and additional resources through the use of tags and rules.
76
-
For more information on ABAC, see [ABAC on Wikipedia](https://en.wikipedia.org/wiki/Attribute-based_access_control){:target="\_blank"}.
77
+
For general information on ABAC, see [ABAC on Wikipedia](https://en.wikipedia.org/wiki/Attribute-based_access_control){:target="\_blank"}.
77
78
78
-
Using tags, you can allocate entities and resources to teams. Define which team has access to which entities and resources, and also the type of access.
79
-
Tag names are arbitrary, and can be anything you choose that matches your company process. Tags can be product names, software lifecycle phases, department names, or names that help define security policies.
79
+
**Tags**
80
+
Tags give you the flexibility to assign entities and resources to specific teams while determining the type of access each team has. Tags serve as labels that help organize and control access to these entities and resources.
80
81
81
-
You can then define rules combining teams, privileges, and tags and for fine-grained access control.
82
+
Tag names are entirely customizable and can align with your company's processes and requirements. They can encompass a wide range of categories, including product names, software lifecycle phases, departmental designations, or labels designed to enforce security policies.
82
83
83
-
### Define tags for entities
84
+
**Rules**
85
+
Rules combine teams (who), privileges (what), and tags (where) to create fine-grained access control policies.
86
+
Codefresh supports ABAC with the flexibility to use both OR and AND operations for tags.
87
+
88
+
### Tags for entities
84
89
85
90
#### Assign tags to Kubernetes clusters and Git contexts
86
91
@@ -125,7 +130,7 @@ After integrating Kubernetes clusters/Git providers in Codefresh, you can add on
125
130
126
131
Add tags to projects for filtering and defining permissions.
127
132
128
-
>TIP:
133
+
>**TIP**:
129
134
If [**Auto-create projects for teams**]({{site.baseurl}}/docs/pipelines/configuration/pipeline-settings/#auto-create-projects-for-teams) is enabled in global pipeline settings for your account, then creating the team also creates a project and tag for the project, both with the same name as the team name.
130
135
131
136
@@ -177,17 +182,18 @@ Shared configuration can be environment variables, Helm values, encrypted secret
177
182
<br><br>
178
183
179
184
### Rules for access control
180
-
Define rules using the *who, what, where* pattern to control access to entities and resources.
185
+
Define rules using the *who, what, where* pattern to control access to entities and resources. Rules can be based on OR or AND relationships.
181
186
182
187
For each rule, select:
183
188
1. The team the rule applies to
184
189
1. The CRUD (*Create/Delete/Read/Update*) privileges the team has to the entity/resource
185
190
* For almost all entities, the Create privilege requires a separate rule.
186
191
* The other privileges can be defined in the same rule.
187
-
1. The tags that control access to the entity/resource
188
-
* All tags, (implicitly includes No tags)
189
-
* No tags
190
-
* Named tags
192
+
1. The tags that control access to the entity/resource:
193
+
* Any tags (`any`): Grants access to entity as long as it has a tag. The tag name is not relevant.
194
+
* All named tags (`all of these`): **AND** logic between list of defined tags. Grants access only to the entities with _all_ the tags defined in the list.
195
+
* Any named tag (`any of these`): **OR** logic between list of defined tags. Grants access to the entity with _at least one_ of the tags defined.
196
+
* No tags (`no`): Grants access to the entity _without_ any tags.
191
197
192
198
193
199
The examples in this section illustrate how to control access to projects and to pipelines through project tags:
@@ -209,19 +215,21 @@ Make sure you have:
209
215
1. For each entity, do the following to define a rule:
210
216
1. Select the team to which assign the rule.
211
217
1. Select the privileges to assign to the team for that entity.
212
-
>You cannot select the **Create** privilege together with the other privileges. The **Create** privilege requires a separate rule.
218
+
>**NOTE:**
219
+
You cannot select the **Create** privilege together with the other privileges. The **Create** privilege requires a separate rule.
213
220
**Any** indicates no privileges are selected.
214
-
1. To assign tags, select one of the following:
215
-
***All tags**: Allows access only to entities with or without tags, regardless of the actual tag names.
216
-
***Without tags**: Allows access only to entities that do not have tags assigned to them.
217
-
***Named tags**: Allows access only to those entities with the same tag names.
221
+
1. To determine tags, select one of the following:
222
+
***Any**: Allows access to entities _with_ any tag, regardless of the actual tag names.
223
+
***All of these tags**: Allows access only to those entities _with all_ the tags defined in the list (_AND_ relationship between the tags). Access is denied if the entity does not all the tag names.
224
+
***Any of these tags**: Allows access only to those entities _with any_ of the tags defined in the list. Access is allowed if the entity has at one of the tag names.
225
+
***No tags**: Allows access only to entities that do not have tags assigned to them.
0 commit comments