From 71c64ca52004ff445f52f0cb04727845fd7e14c1 Mon Sep 17 00:00:00 2001 From: Rohil Surana Date: Fri, 17 Jul 2026 11:41:09 +0530 Subject: [PATCH] docs(reconcile): show scopes in the Role example and explain when export omits it --- docs/content/docs/reconcile.mdx | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/docs/content/docs/reconcile.mdx b/docs/content/docs/reconcile.mdx index 6c54302fb..26d95b670 100644 --- a/docs/content/docs/reconcile.mdx +++ b/docs/content/docs/reconcile.mdx @@ -116,10 +116,14 @@ spec: permissions: - compute_order_get - compute_order_update + scopes: # resource types this role can attach to + - compute/order - name: app_project_viewer # predefined role: override only the fields you list permissions: - app_project_get - resource_aoi_get + scopes: # override the scope too, if you need to + - app/project - name: old_role delete: true ``` @@ -150,6 +154,13 @@ takes those permissions away on the next apply. Permission references accept any form the server knows: the slug (`compute_order_get`), `service/resource:verb`, or `service.resource.verb`. +`scopes` is the list of resource types a role can attach to (`app/organization`, +`app/project`, `compute/order`, and so on). Note how it shows up in an export: a custom +role lists its scopes in full, but a predefined role lists `scopes` only when they differ +from the shipped default. So a predefined role whose scope already matches the default +won't show a `scopes` line — the scope is still enforced, it just isn't repeated. The same +goes for `title`: it appears only when you have changed it. + ## The Preference kind `Preference` manages platform settings, like whether new organizations can be created or