mirror of
https://github.com/openshift/openshift-docs.git
synced 2026-02-05 12:46:18 +01:00
68 lines
3.8 KiB
Plaintext
68 lines
3.8 KiB
Plaintext
// Module included in the following assemblies:
|
|
// * observability/logging/logging-6.2/log6x-loki-6.2.adoc
|
|
|
|
|
|
:_mod-docs-content-type: REFERENCE
|
|
[id="loki-rbac-rules-permissions_{context}"]
|
|
= Authorizing LokiStack rules RBAC permissions
|
|
|
|
Administrators can allow users to create and manage their own alerting and recording rules by binding cluster roles to usernames.
|
|
Cluster roles are defined as `ClusterRole` objects that contain necessary role-based access control (RBAC) permissions for users.
|
|
|
|
The following cluster roles for alerting and recording rules are available for LokiStack:
|
|
|
|
[options="header"]
|
|
|===
|
|
|Rule name |Description
|
|
|
|
|`alertingrules.loki.grafana.com-v1-admin`
|
|
|Users with this role have administrative-level access to manage alerting rules. This cluster role grants permissions to create, read, update, delete, list, and watch `AlertingRule` resources within the `loki.grafana.com/v1` API group.
|
|
|
|
|`alertingrules.loki.grafana.com-v1-crdview`
|
|
|Users with this role can view the definitions of Custom Resource Definitions (CRDs) related to `AlertingRule` resources within the `loki.grafana.com/v1` API group, but do not have permissions for modifying or managing these resources.
|
|
|
|
|`alertingrules.loki.grafana.com-v1-edit`
|
|
|Users with this role have permission to create, update, and delete `AlertingRule` resources.
|
|
|
|
|`alertingrules.loki.grafana.com-v1-view`
|
|
|Users with this role can read `AlertingRule` resources within the `loki.grafana.com/v1` API group. They can inspect configurations, labels, and annotations for existing alerting rules but cannot make any modifications to them.
|
|
|
|
|`recordingrules.loki.grafana.com-v1-admin`
|
|
|Users with this role have administrative-level access to manage recording rules. This cluster role grants permissions to create, read, update, delete, list, and watch `RecordingRule` resources within the `loki.grafana.com/v1` API group.
|
|
|
|
|`recordingrules.loki.grafana.com-v1-crdview`
|
|
|Users with this role can view the definitions of Custom Resource Definitions (CRDs) related to `RecordingRule` resources within the `loki.grafana.com/v1` API group, but do not have permissions for modifying or managing these resources.
|
|
|
|
|`recordingrules.loki.grafana.com-v1-edit`
|
|
|Users with this role have permission to create, update, and delete `RecordingRule` resources.
|
|
|
|
|`recordingrules.loki.grafana.com-v1-view`
|
|
|Users with this role can read `RecordingRule` resources within the `loki.grafana.com/v1` API group. They can inspect configurations, labels, and annotations for existing alerting rules but cannot make any modifications to them.
|
|
|
|
|===
|
|
|
|
[id="loki-rbac-rules-permissions-examples_{context}"]
|
|
== Examples
|
|
|
|
To apply cluster roles for a user, you must bind an existing cluster role to a specific username.
|
|
|
|
Cluster roles can be cluster or namespace scoped, depending on which type of role binding you use.
|
|
When a `RoleBinding` object is used, as when using the `oc adm policy add-role-to-user` command, the cluster role only applies to the specified namespace.
|
|
When a `ClusterRoleBinding` object is used, as when using the `oc adm policy add-cluster-role-to-user` command, the cluster role applies to all namespaces in the cluster.
|
|
|
|
The following example command gives the specified user create, read, update and delete (CRUD) permissions for alerting rules in a specific namespace in the cluster:
|
|
|
|
.Example cluster role binding command for alerting rule CRUD permissions in a specific namespace
|
|
[source,terminal]
|
|
----
|
|
$ oc adm policy add-role-to-user alertingrules.loki.grafana.com-v1-admin -n <namespace> <username>
|
|
----
|
|
|
|
The following command gives the specified user administrator permissions for alerting rules in all namespaces:
|
|
|
|
.Example cluster role binding command for administrator permissions
|
|
[source,terminal]
|
|
----
|
|
$ oc adm policy add-cluster-role-to-user alertingrules.loki.grafana.com-v1-admin <username>
|
|
----
|