docs: add the Enterprise Portal security-settings RBAC resources - #4407
Draft
Bishibop wants to merge 1 commit into
Draft
docs: add the Enterprise Portal security-settings RBAC resources#4407Bishibop wants to merge 1 commit into
Bishibop wants to merge 1 commit into
Conversation
Adds kots/app/[:appid]/enterprise-portal/security-settings/read and /update, which gate the Security Center display settings in the Enterprise Portal Portal Features section. Both are enforced today in handlers/vendor-api/replv3/enterprise_portal/security_settings.go:122,193 and defined in pkg/policy/resources.go:777-782, but neither appeared on this page, so a vendor could not write a policy granting them. Placed alphabetically between instances/read and service-accounts/read. Descriptions follow the page's existing voice.
✅ Deploy Preview for replicated-docs ready!
To edit notification comments on pull requests, go to your Netlify project configuration. |
✅ Deploy Preview for replicated-docs-upgrade ready!
To edit notification comments on pull requests, go to your Netlify project configuration. |
replicated-ci
added
type::docs
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Adds two missing entries to the RBAC resource names reference:
kots/app/[:appid]/enterprise-portal/security-settings/readkots/app/[:appid]/enterprise-portal/security-settings/updateBoth are enforced today —
handlers/vendor-api/replv3/enterprise_portal/security_settings.go:122and:193callpolicy.CheckAccessOrAbortwith them, andpkg/policy/resources.go:777-782defines the strings. Neither appeared on this page, so a vendor reading it could not write a policy granting either one.Placed alphabetically between
instances/readandservice-accounts/read. Descriptions follow the page's existing "Grants the holder permission to … for the specified application" voice.Vale: 0 errors, warnings 141 -> 143. The two added warnings are the sentence-case alert that every one of this page's 158 resource headings already trips.
Why this matters beyond tidiness
Raised in review on #4391, which documents the Portal Features settings. Those settings split across two permissions, and #4391 now carries a table naming the resource strings directly because linking readers to this page for the security-settings permission was a dead end. Once this lands, that table has a reference behind it.
Draft, because it is the small half of a bigger problem
While measuring this I compared
pkg/policy/resources.goagainst this page. 10 of the 39 Enterprise Portal resources are undocumented, not 2:enterprise-portal/security-settings/read,/updateenterprise-portal/custom-instructions/read,/create,/update,/deleteenterprise-portal/email-history/readenterprise-portal/update-attempts/readenterprise-portal/buildenterprise-portal/publishNothing is stale in the other direction: every documented entry still exists in code. The drift is entirely one-directional, which is what you would expect from a hand-maintained index — it does not accumulate dead links, it just never hears about new resources.
Two things worth deciding separately from this PR:
Left as a draft so the narrow fix does not imply the broader gap is closed. The remaining 6 live resources each need a handler traced for an accurate description, and
build/publishare arguably a vandoor cleanup rather than a docs addition — documenting permissions that gate nothing would be worse than omitting them.