DOC-2123: Update Console ACL UI references for new atomic-ACL design#1689
Open
DOC-2123: Update Console ACL UI references for new atomic-ACL design#1689
Conversation
Refresh single-sourced ACL/RBAC content and self-managed Console references ahead of Console's new Security page (atomic 1-row=1-ACL model, role-inherited ACLs shown inline, regex filter on lists). - acl.adoc: add [[manage-acls]] and [[create-first-acl]] anchors so Console empty-state CTAs can deep-link; rewrite the manage-via-UI bullet to describe the new atomic ACL form; add a regex filter tip. - rbac-list-role/rbac-describe-role partials: explain that the filter input accepts a regex, with an example. - quick-start.adoc: replace the stale "Access control page" wording with "Security > Roles". - console/pages/index.adoc: rewrite the "Visual ACL management" bullet to mention atomic ACL editing and inline role-inherited permissions; add a separate RBAC bullet. - deploy-kafka-connect.adoc: "Security tab" -> "Security > Users". Inline // TODO DOC-2123 comments mark spots that need final confirmation from Jan/Martin once the new Security page ships. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
✅ Deploy Preview for redpanda-docs-preview ready!
To edit notification comments on pull requests, go to your Netlify project configuration. |
Contributor
📝 WalkthroughWalkthroughThe pull request updates documentation across six files to clarify Redpanda Console's user interface navigation paths and filtering capabilities. Changes reflect UI restructuring from generic "Access control" tab references to explicit "Security" menu navigation (e.g., Security → ACLs, Security → Users). Additionally, role and ACL filtering documentation is updated to specify that input fields accept regular expressions, with concrete examples (e.g., Estimated code review effort🎯 2 (Simple) | ⏱️ ~12 minutes Possibly related PRs
Suggested reviewers
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In `@modules/manage/pages/security/authorization/acl.adoc`:
- Around line 35-44: The text in the "Create ACL" UI bullet is ambiguous about
what the top-of-list filter targets (it says "ACLs by name" but the example
`^prod-` describes matching resource patterns); update the UI bullet under the
[[create-first-acl]] section so the filter description precisely names the
targeted column (e.g., "resource pattern" or "ACL name") and adjust the example
to match (or change the example to one that matches names), referencing the
"Create ACL" UI step and the filter example `^prod-` so readers are not confused
about whether the filter applies to ACL names or resource patterns.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
Run ID: 0c6c32f5-c01c-4e93-97ee-c34810e302f0
📒 Files selected for processing (6)
modules/console/pages/index.adocmodules/deploy/pages/kafka-connect/deploy-kafka-connect.adocmodules/get-started/pages/quick-start.adocmodules/manage/pages/security/authorization/acl.adocmodules/manage/partials/rbac-describe-role.adocmodules/manage/partials/rbac-list-role.adoc
Open
5 tasks
…alone Previous commit assumed a standalone /security/acls list page based on URL extrapolation; the shipped Console build (per Jan's recorded demo) has only Users / Roles / Permissions tabs. ACLs are managed from a principal's detail page. Rewrite the manage-via-UI bullet in acl.adoc to: - describe the per-principal flow (open a user or role, find the ACLs section on the detail page, one row per rule) - name the three actual actions: + Add ACL, Allow all operations, Delete selected (bulk) - drop the wrong "Security > ACLs, Create ACL" path - drop the regex filter tip (filtering happens on the Users/Roles list, not on a standalone ACLs view) The [[create-first-acl]] anchor stays so Console can still deep-link. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
The Security page has three tabs: Users / Roles / Permissions. Two of the things I had wrong: 1. ACL creation is also reachable from the Permissions tab, which is the cluster-wide unified view at /security/permissions-list. Expanding a principal's row shows direct ACLs followed by sections labeled "VIA ROLE: <role-name>" for each role they inherit from. Deny rules are highlighted in red. 2. Role creation is no longer a single bundled form. The Create role modal asks only for the name; after submit, the role's detail page opens with empty ACLs and Principals sections that you populate afterwards (same + Add ACL / Allow all operations / Add a principal pattern as the user detail page). Update acl.adoc and rbac-create-role.adoc accordingly. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
The new Security page has no Edit / Update flow. On a user's or role's
detail page, you interact with sections directly:
- Roles section uses an "Assign a role..." autocomplete to add and a
trash icon per row to remove. Same pattern on the role detail page
for Principals ("Add a principal...").
- ACLs section uses + Add ACL / Allow all operations / Delete selected
(bulk via row checkboxes). Changes apply immediately.
Update the rbac-edit-role, rbac-assign-role, rbac-unassign-role,
rbac-delete-role, gbac-assign-group-role, and gbac-create-group-acl
partials to match. Also update the quick-start to walk the unbundled
"create role, then add ACL on detail page, then assign principal"
flow.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Preview-only playbook change so the docs Netlify preview renders content from cloud-docs PR #568 instead of cloud-docs main. This lets reviewers see the ADP Cloud-only pages in their final form before either PR merges. REVERT (set cloud-docs branches back to `main`) before merge. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Per Redpanda style guide, em dashes should be replaced with colons, parentheses, or sentence breaks. Also align the "Allow all operations caveat" wording across acl.adoc, rbac-create-role, and the cloud-docs What's New entry so reviewers see one consistent phrasing. - acl.adoc: replace 3 em dashes with colons / split sentences. - rbac-edit-role.adoc: split em-dashed sentence into two. - rbac-create-role.adoc: drop sentence-leading "Or", replace short caveat with the standard "Use this for testing only; it is too broad for production." phrasing. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Refresh single-sourced ACL/RBAC content and self-managed Console references ahead of Console's redesigned Security page. The shipped layout (per Jan's recorded demo) is Users / Roles / Permissions — three tabs, no standalone ACLs page. ACLs are managed per principal from the user or role detail page (
+ Add ACLfor one rule,Allow all operationsfor a wildcard shortcut, row-checkbox bulk delete). The cloud-docs companion PR is at redpanda-data/cloud-docs#568.Single-sourced (these flow through to cloud-docs via
tag::single-source[])acl.adoc: add[[manage-acls]]+[[create-first-acl]]anchors so Console can deep-link from a principal's empty ACLs section. Rewrite the manage-via-UI bullet to describe two entry paths (Permissionstab for cluster-wide view;Users/Rolestab for per-principal management) and the three detail-page actions (+ Add ACL,Allow all operations,Delete selected). Cover theVIA ROLE: <role-name>inheritance grouping on the expanded Permissions row and the Deny-rule indicator.rbac-create-role.adoc: split the old bundled "name + permissions + principals in one form" flow into the new "Create modal asks for the name only, then add ACLs and principals on the role detail page" flow.rbac-edit-role.adoc,rbac-assign-role.adoc,rbac-unassign-role.adoc,rbac-delete-role.adoc: drop the oldClick Edit/Click Updatemodal pattern. The new UI applies changes immediately via autocomplete-add and trash-icon-remove on Roles and Principals, and the same three actions on ACLs.rbac-list-role.adoc,rbac-describe-role.adoc: explain that the principal-list filter input accepts a regex.gbac-assign-group-role.adoc,gbac-create-group-acl.adoc: update for the same in-place editing pattern usingGroup:<name>principals.Self-managed-only
quick-start.adoc: walk the unbundled flow (create role → add ACL on detail page → assign principal). Drop the stale "Access control page" wording.console/pages/index.adoc: rewrite the access-control bullets for atomic ACL editing and inline role inheritance.deploy-kafka-connect.adoc:Security tab→Security > Users.Build plumbing
local-antora-playbook.yml: temporarily point thecloud-docssource at the sibling PR branch so this preview renders the cloud-docs PR content. Must be reverted before merge (called out in the test plan).Inline
// TODO DOC-2123comments mark spots that still need final confirmation from Jan/Martin once we walk against a build.Context
Open questions for Jan/Martin (cc once in review)
Final microcopy for the post-create-user "What's next?" modal — going with Mali's wording?— confirmed via screenshot: titleWhat's next?, bodyThis user has no permissions yet. Assign roles or create ACLs to grant access to cluster resources., CTAsGo to user details+Done. Quickstart updated to match.Empty-state docs deep-link target—[[create-first-acl]]anchor reserved onacl.adoc. The empty-state on a user's ACLs section is the natural deep-link target; confirm whether you want Console to wire it up.// TODOin the What's New blurb.)data-testidselectors inquick-start.adoc(create-user-button,create-user-name,password-input-toggle) survive both the new Security page work and console#2424?Delete rolevsDelete?mainso we can capture screenshots from a real build and resolve the remaining TODOs?Preview pages
Self-Managed (this PR):
Cloud (rendered from cloud-docs PR #568 via the temp playbook override):
Test plan
npm run build && npm run servepasses locallyacl.adocand the RBAC partials viatag::single-source[](verify on cloud-docs preview)schema-reg-contexts.adocxref errors are unrelated)modules/console/images/user.png// TODO DOC-2123comment before mergelocal-antora-playbook.yml— set theredpanda-data/cloud-docsbranch back tomain(currently points atDOC-2123-console-acl-ui-refreshfor cross-PR preview of cloud-docs PR Add 3 new permissions to Customer Managed GCP Redpanda Agent Service Accoun t #568)🤖 Generated with Claude Code