|
| 1 | +--- |
| 2 | +title:"Access control for GitOps" |
| 3 | +description:"Restrict access to GitOps entities through ABAC" |
| 4 | +toc:true |
| 5 | +--- |
| 6 | + |
| 7 | +>This feature is currently in Beta. |
| 8 | +
|
| 9 | +Control access to entities in GitOps through ABAC (Attribute-Based Access Control). ABAC allows fine-grained access to application entities through the use of rules. |
| 10 | +For GitOps, you can currently define ABAC for application entities in the Codefresh UI or programmatically via Terraform. |
| 11 | +For more information on ABAC, see[ABAC on Wikipedia](https://en.wikipedia.org/wiki/Attribute-based_access_control){:target="\_blank"}. |
| 12 | + |
| 13 | + |
| 14 | +Rules define the*who*,*what*, and*where* control access to GitOps applications, through the following elements: |
| 15 | +* Teams |
| 16 | + Teams control the_who_ part of the rule. |
| 17 | + |
| 18 | +* Actions |
| 19 | + Actions control the_what_ part of the rule. You need to select at least one action. |
| 20 | + |
| 21 | +* Attributes |
| 22 | + Attributes control the_where_ part of the rule. |
| 23 | + Attributes are a combination of standard Kubernetes and Codefresh-specific attributes. You have Kubernetes attributes such as clusters, namespaces, and labels, and attributes unique to Codefresh such as Runtimes and Git Sources. |
| 24 | + |
| 25 | + |
| 26 | +##Creating a rule in Codefresh UI |
| 27 | +For each rule, you must select or define: |
| 28 | +* The team or teams the rule applies to, with at least one team being mandatory |
| 29 | +* The action or actions permitted for the entity, with at least one action being mandatory |
| 30 | +* The attribute or attributes determining where access is permitted |
| 31 | + |
| 32 | +**How to** |
| 33 | + |
| 34 | +1. In the Codefresh UI, on the toolbar, click the**Settings** icon. |
| 35 | +1. On the sidebar, from Access & Collaboration, select[**GitOps Permissions**](https://g.codefresh.io/account-admin/permissions/teams){:target="\_blank"}. |
| 36 | +1. To create a rule, click**Add** and define the**Teams**,**Actions**, and**Attributes** for the rule. |
| 37 | +1. To confirm, click**Add** once again. |
| 38 | + |
| 39 | + {% include |
| 40 | + image.html |
| 41 | + lightbox="true" |
| 42 | + file="/images/administration/access-control/gitops/gitops-add-rule.png" |
| 43 | + url="/images/administration/access-control/gitops/gitops-add-rule.png" |
| 44 | + alt="Add rule for GitOps applications" |
| 45 | + caption="Add rule for GitOps applications" |
| 46 | + max-width="50%" |
| 47 | + %} |
| 48 | + |
| 49 | +The rule you added for the entity is displayed in the GitOps Permissions page. Edit or delete the rule by clicking the respective icons. |
| 50 | + |
| 51 | +##Creating a rule programmatically via Terraform |
| 52 | +You can also create rules enforcing ABAC for GitOps via Terraform. |
| 53 | +See the documentation for[codefresh_abac_rules](https://registry.terraform.io/providers/codefresh-io/codefresh/latest/docs/resources/abac_rules){:target="\_blank"}. |
| 54 | + |
| 55 | + |
| 56 | + |
| 57 | +##GitOps Applications rule elements |
| 58 | + |
| 59 | +{: .table .table-bordered .table-hover} |
| 60 | +| Rule Element| Description| |
| 61 | +| --------------| --------------| |
| 62 | +|Teams| The team or teams to which to give access to the Application Entity. See[Adding users and teams]({{site.baseurl}}/docs/administration/account-user-management/add-users/).| |
| 63 | +|Actions | The actions permitted for the application entity, and can be any or all of the following: {::nomarkdown} <ul><li><b>Refresh</b>: Allow users to manually regular refresh or hard refresh. The Refresh action is automatically disabled on selecting the Sync action which takes precedence. See <a href="https://codefresh.io/docs/docs/deployments/gitops/manage-application/#refreshhard-refresh-applications">Refresh/Hard Refresh applications</a>.</li><li><b>Sync</b>: Allow users to manually sync an application on-demand, and define the options for manual sync.<br>Selecting Sync automatically disables the Refresh action as Sync takes precedence over it. <br> See <a href="https://codefresh.io/docs/docs/deployments/gitops/manage-application/#manually-synchronize-an-application">Manually synchronize an application</a>.</li><li><b>Terminate Sync</b>: Allow users to manually stop an ongoing sync for an application. See <a href="https://codefresh.io/docs/docs/deployments/gitops/manage-application/#terminate-on-going-application-sync">Terminate on-going application sync</a></li><li><b>Rollback application</b>: Allow users to rollback the current release of an application to a previous deployment version or release in Codefresh. See <a href="https://codefresh.io/docs/docs/deployments/gitops/manage-application/#rollback-gitops-applications">Rollback GitOps applications</a>.</li><li><b>Pause rollout</b> and <b>Resume rollout</b>: Allow users to pause an ongoing rollout and resume a paused rollout either directly from the Timeline tab of the application, or through the controls in the Rollout Player. <br>See <a href="https://codefresh.io/docs/docs/deployments/gitops/manage-application/#pauseresume-ongoing-rollouts">Pause/resume ongoing rollouts</a> and <a href="https://codefresh.io/docs/docs/deployments/gitops/manage-application/#manage-an-ongoing-rollout-with-the-rollout-player">Managing an ongoing rollout with the Rollout Player</a>.</li><li><b>Promote full rollout</b>: Allow users to use the Promote Full button in the Rollout Player to skip the remaining steps in the rollout and promote to deployment. See <a href="https://codefresh.io/docs/docs/deployments/gitops/manage-application/#manage-an-ongoing-rollout-with-the-rollout-player">Managing an ongoing rollout with the Rollout Player</a>.</li><li><b>Skip current step in rollout</b>: Allow users to use the Skip Step button in the Rollout Player to skip executing the current step in the rollout. <br>See <a href="https://codefresh.io/docs/docs/deployments/gitops/manage-application/#manage-an-ongoing-rollout-with-the-rollout-player">Managing an ongoing rollout with the Rollout Player</a>.</li><b>Delete resource</b>: Allow users to delete an application resource from the Current State tab. See <a href="https://codefresh.io/docs/docs/deployments/gitops/manage-application/#delete-an-application">Delete an application</a>.</li></ul>{:/} | |
| 64 | +|Attributes |Adding attributes, either individually or in combination, allow more fine-grained access control to enforce the _where_ policies for teams and actions. <br>Single attributes are useful to grant or deny access based on a specific property. For example, allow access to application entities on a cluster or within a namespace. <br>Combinations of attributes help enforce more complex access control. For example, require both a Runtime and a Label attribute to grant access to an application entity.<br>You can also add multiple instances of the same attribute with different values. For example, multiple Label attibutes with different values to sync application entities.{::nomarkdown} <ul><li><b>Cluster</b>: Allow access to all application entities in the cluster, regardless of the namespace, Runtime, and Git Sources of specific applications.</li><li><b>Namespace</b>: Allow access to application entities only within the namespace. If users have multiple accounts on different clusters with the same namespace, they can access applications in all those namespaces.</li><li><b>Runtime</b>: Allow access to application entities associated with the defined Runtime.</li><li><b>Git Source</b>: Allow access to application entities only in the defined Git Source. A Git Source is always associated with a Runtime.</li><li><b>Label</b>: Allow access only to application entities that share the same label.</li></ul>{:/} | |
| 65 | + |
| 66 | + |
| 67 | + |
| 68 | + |
| 69 | + |
| 70 | +##Examples of rules for application entities |
| 71 | + |
| 72 | +###Rule: Cluster-based access to all actions |
| 73 | +This rule grants the DevOps team permission to perform all actions for application entities on the production cluster, regardless of namespaces, Runtimes, Git Sources and labels. |
| 74 | + |
| 75 | +**Rule elements** |
| 76 | +* Team:`DevOps` |
| 77 | +* Actions:`All` |
| 78 | +* Attributes:`Cluster: production-cluster` |
| 79 | + |
| 80 | + |
| 81 | + |
| 82 | +###Rule: Cluster- and namespace-based access to all actions |
| 83 | +This rule grants two different teams permissions to perform all actions for application entities deployed on a specific cluster but within a specific namespace. |
| 84 | + |
| 85 | +**Rule elements** |
| 86 | +* Teams:`Product`,`Docs` |
| 87 | +* Actions:`All` |
| 88 | +* Attributes: |
| 89 | +*`Cluster: development` |
| 90 | +*`Namespace: product-sandbox` |
| 91 | + |
| 92 | + |
| 93 | +###Rule: Namespace- and label-based access to specific actions |
| 94 | +This rule grants the Support team permission to manually sync application entities or manually terminate on-going syncs for application entities deployed in a specific namespace, but only for those entities that share the same label. |
| 95 | + |
| 96 | +**Rule elements** |
| 97 | +* Team:`Customer Support` |
| 98 | +* Actions:`Sync`,`Terminate Sync` |
| 99 | +* Attributes: |
| 100 | +*`Namespace: poc` |
| 101 | +*`Label: customer=AcmePoc` |
| 102 | + |
| 103 | + |
| 104 | +##Related articles |
| 105 | +[Codefresh Provider for Terraform](https://registry.terraform.io/providers/codefresh-io/codefresh/latest/docs){:target="\_blank"} |
| 106 | +[Access control for pipelines]({{site.baseurl}}/docs/administration/account-user-management/access-control/) |