forked from github-starred/komodo
87 lines
30 KiB
HTML
87 lines
30 KiB
HTML
<!doctype html>
|
||
<html lang="en" dir="ltr" class="docs-wrapper plugin-docs plugin-id-default docs-version-current docs-doc-page docs-doc-id-resources/permissioning" data-has-hydrated="false">
|
||
<head>
|
||
<meta charset="UTF-8">
|
||
<meta name="generator" content="Docusaurus v3.8.1">
|
||
<title data-rh="true">Permissioning | Komodo</title><meta data-rh="true" name="viewport" content="width=device-width,initial-scale=1"><meta data-rh="true" name="twitter:card" content="summary_large_image"><meta data-rh="true" property="og:image" content="https://komo.do/img/monitor-lizard.png"><meta data-rh="true" name="twitter:image" content="https://komo.do/img/monitor-lizard.png"><meta data-rh="true" property="og:url" content="https://komo.do/docs/resources/permissioning"><meta data-rh="true" property="og:locale" content="en"><meta data-rh="true" name="docusaurus_locale" content="en"><meta data-rh="true" name="docsearch:language" content="en"><meta data-rh="true" name="docusaurus_version" content="current"><meta data-rh="true" name="docusaurus_tag" content="docs-default-current"><meta data-rh="true" name="docsearch:version" content="current"><meta data-rh="true" name="docsearch:docusaurus_tag" content="docs-default-current"><meta data-rh="true" property="og:title" content="Permissioning | Komodo"><meta data-rh="true" name="description" content="Komodo has a granular, layer-based permissioning system to provide non-admin users access only to intended Resources."><meta data-rh="true" property="og:description" content="Komodo has a granular, layer-based permissioning system to provide non-admin users access only to intended Resources."><link data-rh="true" rel="icon" href="/img/favicon.ico"><link data-rh="true" rel="canonical" href="https://komo.do/docs/resources/permissioning"><link data-rh="true" rel="alternate" href="https://komo.do/docs/resources/permissioning" hreflang="en"><link data-rh="true" rel="alternate" href="https://komo.do/docs/resources/permissioning" hreflang="x-default"><script data-rh="true" type="application/ld+json">{"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Resources","item":"https://komo.do/docs/resources/"},{"@type":"ListItem","position":2,"name":"Permissioning","item":"https://komo.do/docs/resources/permissioning"}]}</script><link rel="stylesheet" href="/assets/css/styles.ec6293c3.css">
|
||
<script src="/assets/js/runtime~main.1c858ed3.js" defer="defer"></script>
|
||
<script src="/assets/js/main.c0fc3d5e.js" defer="defer"></script>
|
||
</head>
|
||
<body class="navigation-with-keyboard">
|
||
<svg xmlns="http://www.w3.org/2000/svg" style="display: none;"><defs>
|
||
<symbol id="theme-svg-external-link" viewBox="0 0 24 24"><path fill="currentColor" d="M21 13v10h-21v-19h12v2h-10v15h17v-8h2zm3-12h-10.988l4.035 4-6.977 7.07 2.828 2.828 6.977-7.07 4.125 4.172v-11z"/></symbol>
|
||
</defs></svg>
|
||
<script>!function(){var t="light";var e=function(){try{return new URLSearchParams(window.location.search).get("docusaurus-theme")}catch(t){}}()||function(){try{return window.localStorage.getItem("theme")}catch(t){}}();document.documentElement.setAttribute("data-theme",e||t),document.documentElement.setAttribute("data-theme-choice",e||t)}(),function(){try{const c=new URLSearchParams(window.location.search).entries();for(var[t,e]of c)if(t.startsWith("docusaurus-data-")){var a=t.replace("docusaurus-data-","data-");document.documentElement.setAttribute(a,e)}}catch(t){}}()</script><div id="__docusaurus"><link rel="preload" as="image" href="/img/komodo-512x512.png"><div role="region" aria-label="Skip to main content"><a class="skipToContent_fXgn" href="#__docusaurus_skipToContent_fallback">Skip to main content</a></div><nav aria-label="Main" class="theme-layout-navbar navbar navbar--fixed-top"><div class="navbar__inner"><div class="theme-layout-navbar-left navbar__items"><button aria-label="Toggle navigation bar" aria-expanded="false" class="navbar__toggle clean-btn" type="button"><svg width="30" height="30" viewBox="0 0 30 30" aria-hidden="true"><path stroke="currentColor" stroke-linecap="round" stroke-miterlimit="10" stroke-width="2" d="M4 7h22M4 15h22M4 23h22"></path></svg></button><a class="navbar__brand" href="/"><div class="navbar__logo"><img src="/img/komodo-512x512.png" alt="monitor lizard" class="themedComponent_mlkZ themedComponent--light_NVdE" width="34px"><img src="/img/komodo-512x512.png" alt="monitor lizard" class="themedComponent_mlkZ themedComponent--dark_xIcU" width="34px"></div><b class="navbar__title text--truncate">Komodo</b></a><a aria-current="page" class="navbar__item navbar__link navbar__link--active" href="/docs/intro">docs</a></div><div class="theme-layout-navbar-right navbar__items navbar__items--right"><a href="https://opencollective.com/komodo" target="_blank" rel="noopener noreferrer" class="navbar__item navbar__link">Donate<svg width="13.5" height="13.5" aria-hidden="true" class="iconExternalLink_nPIU"><use href="#theme-svg-external-link"></use></svg></a><a href="https://docs.rs/komodo_client/latest/komodo_client" target="_blank" rel="noopener noreferrer" class="navbar__item navbar__link">Docs.rs<svg width="13.5" height="13.5" aria-hidden="true" class="iconExternalLink_nPIU"><use href="#theme-svg-external-link"></use></svg></a><a href="https://github.com/moghtech/komodo" target="_blank" rel="noopener noreferrer" class="navbar__item navbar__link">Github<svg width="13.5" height="13.5" aria-hidden="true" class="iconExternalLink_nPIU"><use href="#theme-svg-external-link"></use></svg></a><div class="toggle_vylO colorModeToggle_DEke"><button class="clean-btn toggleButton_gllP toggleButtonDisabled_aARS" type="button" disabled="" title="system mode" aria-label="Switch between dark and light mode (currently system mode)"><svg viewBox="0 0 24 24" width="24" height="24" aria-hidden="true" class="toggleIcon_g3eP lightToggleIcon_pyhR"><path fill="currentColor" d="M12,9c1.65,0,3,1.35,3,3s-1.35,3-3,3s-3-1.35-3-3S10.35,9,12,9 M12,7c-2.76,0-5,2.24-5,5s2.24,5,5,5s5-2.24,5-5 S14.76,7,12,7L12,7z M2,13l2,0c0.55,0,1-0.45,1-1s-0.45-1-1-1l-2,0c-0.55,0-1,0.45-1,1S1.45,13,2,13z M20,13l2,0c0.55,0,1-0.45,1-1 s-0.45-1-1-1l-2,0c-0.55,0-1,0.45-1,1S19.45,13,20,13z M11,2v2c0,0.55,0.45,1,1,1s1-0.45,1-1V2c0-0.55-0.45-1-1-1S11,1.45,11,2z M11,20v2c0,0.55,0.45,1,1,1s1-0.45,1-1v-2c0-0.55-0.45-1-1-1C11.45,19,11,19.45,11,20z M5.99,4.58c-0.39-0.39-1.03-0.39-1.41,0 c-0.39,0.39-0.39,1.03,0,1.41l1.06,1.06c0.39,0.39,1.03,0.39,1.41,0s0.39-1.03,0-1.41L5.99,4.58z M18.36,16.95 c-0.39-0.39-1.03-0.39-1.41,0c-0.39,0.39-0.39,1.03,0,1.41l1.06,1.06c0.39,0.39,1.03,0.39,1.41,0c0.39-0.39,0.39-1.03,0-1.41 L18.36,16.95z M19.42,5.99c0.39-0.39,0.39-1.03,0-1.41c-0.39-0.39-1.03-0.39-1.41,0l-1.06,1.06c-0.39,0.39-0.39,1.03,0,1.41 s1.03,0.39,1.41,0L19.42,5.99z M7.05,18.36c0.39-0.39,0.39-1.03,0-1.41c-0.39-0.39-1.03-0.39-1.41,0l-1.06,1.06 c-0.39,0.39-0.39,1.03,0,1.41s1.03,0.39,1.41,0L7.05,18.36z"></path></svg><svg viewBox="0 0 24 24" width="24" height="24" aria-hidden="true" class="toggleIcon_g3eP darkToggleIcon_wfgR"><path fill="currentColor" d="M9.37,5.51C9.19,6.15,9.1,6.82,9.1,7.5c0,4.08,3.32,7.4,7.4,7.4c0.68,0,1.35-0.09,1.99-0.27C17.45,17.19,14.93,19,12,19 c-3.86,0-7-3.14-7-7C5,9.07,6.81,6.55,9.37,5.51z M12,3c-4.97,0-9,4.03-9,9s4.03,9,9,9s9-4.03,9-9c0-0.46-0.04-0.92-0.1-1.36 c-0.98,1.37-2.58,2.26-4.4,2.26c-2.98,0-5.4-2.42-5.4-5.4c0-1.81,0.89-3.42,2.26-4.4C12.92,3.04,12.46,3,12,3L12,3z"></path></svg><svg viewBox="0 0 24 24" width="24" height="24" aria-hidden="true" class="toggleIcon_g3eP systemToggleIcon_QzmC"><path fill="currentColor" d="m12 21c4.971 0 9-4.029 9-9s-4.029-9-9-9-9 4.029-9 9 4.029 9 9 9zm4.95-13.95c1.313 1.313 2.05 3.093 2.05 4.95s-0.738 3.637-2.05 4.95c-1.313 1.313-3.093 2.05-4.95 2.05v-14c1.857 0 3.637 0.737 4.95 2.05z"></path></svg></button></div><div class="navbarSearchContainer_Bca1"></div></div></div><div role="presentation" class="navbar-sidebar__backdrop"></div></nav><div id="__docusaurus_skipToContent_fallback" class="theme-layout-main main-wrapper mainWrapper_z2l0"><div class="docsWrapper_hBAB"><button aria-label="Scroll back to top" class="clean-btn theme-back-to-top-button backToTopButton_sjWU" type="button"></button><div class="docRoot_UBD9"><aside class="theme-doc-sidebar-container docSidebarContainer_YfHR"><div class="sidebarViewport_aRkj"><div class="sidebar_njMd"><nav aria-label="Docs sidebar" class="menu thin-scrollbar menu_SIkG"><ul class="theme-doc-sidebar-menu menu__list"><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-1 menu__list-item"><a class="menu__link" href="/docs/intro">What is Komodo?</a></li><li class="theme-doc-sidebar-item-category theme-doc-sidebar-item-category-level-1 menu__list-item menu__list-item--collapsed"><div class="menu__list-item-collapsible"><a class="menu__link menu__link--sublist" href="/docs/setup">Setup</a><button aria-label="Expand sidebar category 'Setup'" aria-expanded="false" type="button" class="clean-btn menu__caret"></button></div></li><li class="theme-doc-sidebar-item-category theme-doc-sidebar-item-category-level-1 menu__list-item"><div class="menu__list-item-collapsible"><a class="menu__link menu__link--sublist menu__link--active" href="/docs/resources">Resources</a><button aria-label="Collapse sidebar category 'Resources'" aria-expanded="true" type="button" class="clean-btn menu__caret"></button></div><ul class="menu__list"><li class="theme-doc-sidebar-item-category theme-doc-sidebar-item-category-level-2 menu__list-item menu__list-item--collapsed"><div class="menu__list-item-collapsible"><a class="menu__link menu__link--sublist" tabindex="0" href="/docs/build-images">Build Images</a><button aria-label="Expand sidebar category 'Build Images'" aria-expanded="false" type="button" class="clean-btn menu__caret"></button></div></li><li class="theme-doc-sidebar-item-category theme-doc-sidebar-item-category-level-2 menu__list-item menu__list-item--collapsed"><div class="menu__list-item-collapsible"><a class="menu__link menu__link--sublist" tabindex="0" href="/docs/resources/deploy-containers">Deploy Containers</a><button aria-label="Expand sidebar category 'Deploy Containers'" aria-expanded="false" type="button" class="clean-btn menu__caret"></button></div></li><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-2 menu__list-item"><a class="menu__link" tabindex="0" href="/docs/resources/docker-compose">Docker Compose</a></li><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-2 menu__list-item"><a class="menu__link" tabindex="0" href="/docs/resources/auto-update">Automatic Updates</a></li><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-2 menu__list-item"><a class="menu__link" tabindex="0" href="/docs/resources/variables">Variables and Secrets</a></li><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-2 menu__list-item"><a class="menu__link" tabindex="0" href="/docs/resources/procedures">Procedures and Actions</a></li><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-2 menu__list-item"><a class="menu__link" tabindex="0" href="/docs/resources/sync-resources">Sync Resources</a></li><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-2 menu__list-item"><a class="menu__link" tabindex="0" href="/docs/resources/webhooks">Configuring Webhooks</a></li><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-2 menu__list-item"><a class="menu__link menu__link--active" aria-current="page" tabindex="0" href="/docs/resources/permissioning">Permissioning</a></li></ul></li><li class="theme-doc-sidebar-item-category theme-doc-sidebar-item-category-level-1 menu__list-item menu__list-item--collapsed"><div class="menu__list-item-collapsible"><a class="menu__link menu__link--sublist" href="/docs/ecosystem">Ecosystem</a><button aria-label="Expand sidebar category 'Ecosystem'" aria-expanded="false" type="button" class="clean-btn menu__caret"></button></div></li></ul></nav></div></div></aside><main class="docMainContainer_TBSr"><div class="container padding-top--md padding-bottom--lg"><div class="row"><div class="col docItemCol_VOVn"><div class="docItemContainer_Djhp"><article><nav class="theme-doc-breadcrumbs breadcrumbsContainer_Z_bl" aria-label="Breadcrumbs"><ul class="breadcrumbs"><li class="breadcrumbs__item"><a aria-label="Home page" class="breadcrumbs__link" href="/"><svg viewBox="0 0 24 24" class="breadcrumbHomeIcon_YNFT"><path d="M10 19v-5h4v5c0 .55.45 1 1 1h3c.55 0 1-.45 1-1v-7h1.7c.46 0 .68-.57.33-.87L12.67 3.6c-.38-.34-.96-.34-1.34 0l-8.36 7.53c-.34.3-.13.87.33.87H5v7c0 .55.45 1 1 1h3c.55 0 1-.45 1-1z" fill="currentColor"></path></svg></a></li><li class="breadcrumbs__item"><a class="breadcrumbs__link" href="/docs/resources"><span>Resources</span></a></li><li class="breadcrumbs__item breadcrumbs__item--active"><span class="breadcrumbs__link">Permissioning</span></li></ul></nav><div class="tocCollapsible_ETCw theme-doc-toc-mobile tocMobile_ITEo"><button type="button" class="clean-btn tocCollapsibleButton_TO0P">On this page</button></div><div class="theme-doc-markdown markdown"><header><h1>Permissioning</h1></header>
|
||
<p>Komodo has a granular, layer-based permissioning system to provide non-admin users access only to intended Resources.</p>
|
||
<h2 class="anchor anchorWithStickyNavbar_LWe7" id="user-groups">User Groups<a href="#user-groups" class="hash-link" aria-label="Direct link to User Groups" title="Direct link to User Groups"></a></h2>
|
||
<p>While Komodo can assign permissions to specific users directly, it is recommended to instead <strong>create User Groups and assign permissions to them</strong>, as if they were a user.</p>
|
||
<p>Users can then be <strong>added to multiple User Groups</strong> and they <strong>inherit the group's permissions</strong>, similar to linux permissions.
|
||
There is also an <code>Everyone</code> mode for User Groups, if this is enabled then <strong>all users implicitly gain the groups permissions</strong>.</p>
|
||
<p>For permissioning at scale, users can define <a href="/docs/resources/sync-resources#user-group"><strong>User Groups in Resource Syncs</strong></a>.</p>
|
||
<h2 class="anchor anchorWithStickyNavbar_LWe7" id="permission-levels">Permission Levels<a href="#permission-levels" class="hash-link" aria-label="Direct link to Permission Levels" title="Direct link to Permission Levels"></a></h2>
|
||
<p>There are 4 permission levels a user / group can be given on a Resource:</p>
|
||
<ol>
|
||
<li>
|
||
<p><strong>None</strong>. The user will not have any access to the resource. The user <strong>will not see it in the GUI, and it will not show up if the user queries the Komodo API directly</strong>. All attempts to view or update the resource will be blocked. This is the default for non-admins, unless using <code>KOMODO_TRANSPARENT_MODE=true</code>.</p>
|
||
</li>
|
||
<li>
|
||
<p><strong>Read</strong>. This is the first permission level that grants any access. It will enable the user to <strong>see the resource in the GUI and read the configuration</strong>. Any attempts to update configuration or trigger any action <strong>will be blocked</strong>. Using <code>KOMODO_TRANSPARENT_MODE=true</code> will make this level the base level on all resources, for all users.</p>
|
||
</li>
|
||
<li>
|
||
<p><strong>Execute</strong>. This level will allow the user to execute actions on the resource, <strong>like send a build command</strong> or <strong>trigger a redeploy</strong>. The user will still be blocked from updating configuration on the resource.</p>
|
||
</li>
|
||
<li>
|
||
<p><strong>Write</strong>. The user has full config write access to the resource, <strong>they can execute any actions, update the configuration, and delete the resource</strong>.</p>
|
||
</li>
|
||
</ol>
|
||
<h2 class="anchor anchorWithStickyNavbar_LWe7" id="specific-permissions">Specific Permissions<a href="#specific-permissions" class="hash-link" aria-label="Direct link to Specific Permissions" title="Direct link to Specific Permissions"></a></h2>
|
||
<p>Permission levels alone are not quite enough to provide granular access control.
|
||
Some features are additionally gated behind a specific permission for that feature.</p>
|
||
<ul>
|
||
<li><strong><code>Logs</code></strong>: User can retrieve docker / docker compose logs on the associated resource.<!-- -->
|
||
<ul>
|
||
<li>Valid on <code>Server</code>, <code>Stack</code>, <code>Deployment</code>.</li>
|
||
<li>For admins wanting this permission by default for all users with read permissions, see below on default user groups.</li>
|
||
</ul>
|
||
</li>
|
||
<li><strong><code>Inspect</code></strong>: User can "inspect" docker containers.<!-- -->
|
||
<ul>
|
||
<li>Valid on <code>Server</code>, <code>Stack</code>, <code>Deployment</code>.</li>
|
||
<li><strong>On Servers</strong>: Access to this api will expose all container environments on the given server,
|
||
and can easily lead to secrets being leaked to unintended users if not protected.</li>
|
||
</ul>
|
||
</li>
|
||
<li><strong><code>Terminal</code></strong>: User can access the associated resource's terminal.<!-- -->
|
||
<ul>
|
||
<li>If given on a <code>Server</code>, this allows server level terminal access, and all container exec priviledges (Including attached <code>Stacks</code> / <code>Deployments</code>).</li>
|
||
<li>If given on a <code>Stack</code> or <code>Deployment</code>, this allows container exec terminal (even without <code>Terminal</code> on <code>Server</code>).</li>
|
||
</ul>
|
||
</li>
|
||
<li><strong><code>Attach</code></strong>: User can "attach" <em>other resources</em> to the resource.<!-- -->
|
||
<ul>
|
||
<li>If given on a <code>Server</code>, allows users to attach <code>Stacks</code>, <code>Deployments</code>, <code>Repos</code>, and <code>Builders</code>.</li>
|
||
<li>If given on a <code>Builder</code>, allows users to attach <code>Builds</code> and <code>Repos</code>.</li>
|
||
<li>If given on a <code>Build</code>, allows users to attach it to <code>Deployments</code>.</li>
|
||
<li>If given on a <code>Repo</code>, allows users to attach it to <code>Stacks</code>, <code>Builds</code>, and <code>Resource Syncs</code>.</li>
|
||
</ul>
|
||
</li>
|
||
<li><strong><code>Processes</code></strong>: User can retrieve the full running process list on the <code>Server</code>.</li>
|
||
</ul>
|
||
<h2 class="anchor anchorWithStickyNavbar_LWe7" id="permissioning-by-resource-type">Permissioning by Resource Type<a href="#permissioning-by-resource-type" class="hash-link" aria-label="Direct link to Permissioning by Resource Type" title="Direct link to Permissioning by Resource Type"></a></h2>
|
||
<p>Users or User Groups can be given a base permission level on all Resources of a particular type, such as Stack.
|
||
In TOML form, this looks like:</p>
|
||
<div class="language-toml codeBlockContainer_Ckt0 theme-code-block" style="--prism-color:#393A34;--prism-background-color:#f6f8fa"><div class="codeBlockContent_QJqH"><pre tabindex="0" class="prism-code language-toml codeBlock_bY9V thin-scrollbar" style="color:#393A34;background-color:#f6f8fa"><code class="codeBlockLines_e6Vv"><span class="token-line" style="color:#393A34"><span class="token punctuation" style="color:#393A34">[</span><span class="token punctuation" style="color:#393A34">[</span><span class="token table class-name">user_group</span><span class="token punctuation" style="color:#393A34">]</span><span class="token punctuation" style="color:#393A34">]</span><span class="token plain"></span><br></span><span class="token-line" style="color:#393A34"><span class="token plain"></span><span class="token key property" style="color:#36acaa">name</span><span class="token plain"> </span><span class="token punctuation" style="color:#393A34">=</span><span class="token plain"> </span><span class="token string" style="color:#e3116c">"groupo"</span><span class="token plain"></span><br></span><span class="token-line" style="color:#393A34"><span class="token plain"></span><span class="token key property" style="color:#36acaa">users</span><span class="token plain"> </span><span class="token punctuation" style="color:#393A34">=</span><span class="token plain"> </span><span class="token punctuation" style="color:#393A34">[</span><span class="token string" style="color:#e3116c">"mbecker20"</span><span class="token punctuation" style="color:#393A34">,</span><span class="token plain"> </span><span class="token string" style="color:#e3116c">"karamvirsingh98"</span><span class="token punctuation" style="color:#393A34">]</span><span class="token plain"></span><br></span><span class="token-line" style="color:#393A34"><span class="token plain"></span><span class="token key property" style="color:#36acaa">all.Build</span><span class="token plain"> </span><span class="token punctuation" style="color:#393A34">=</span><span class="token plain"> </span><span class="token string" style="color:#e3116c">"Execute"</span><span class="token plain"> </span><span class="token comment" style="color:#999988;font-style:italic"># <- Group members can run all builds (but not update config),</span><span class="token plain"></span><br></span><span class="token-line" style="color:#393A34"><span class="token plain"></span><span class="token key property" style="color:#36acaa">all.Stack</span><span class="token plain"> </span><span class="token punctuation" style="color:#393A34">=</span><span class="token plain"> </span><span class="token punctuation" style="color:#393A34">{</span><span class="token plain"> </span><span class="token key property" style="color:#36acaa">level</span><span class="token plain"> </span><span class="token punctuation" style="color:#393A34">=</span><span class="token plain"> </span><span class="token string" style="color:#e3116c">"Read"</span><span class="token punctuation" style="color:#393A34">,</span><span class="token plain"> </span><span class="token key property" style="color:#36acaa">specific</span><span class="token plain"> </span><span class="token punctuation" style="color:#393A34">=</span><span class="token plain"> </span><span class="token punctuation" style="color:#393A34">[</span><span class="token string" style="color:#e3116c">"Logs"</span><span class="token punctuation" style="color:#393A34">]</span><span class="token plain"> </span><span class="token punctuation" style="color:#393A34">}</span><span class="token plain"> </span><span class="token comment" style="color:#999988;font-style:italic"># <- And see all Stacks / logs (no deploy / update, inspect, or terminal access).</span><br></span></code></pre></div></div>
|
||
<p>A user / group can still be given a greater permission level on select resources:</p>
|
||
<div class="language-toml codeBlockContainer_Ckt0 theme-code-block" style="--prism-color:#393A34;--prism-background-color:#f6f8fa"><div class="codeBlockContent_QJqH"><pre tabindex="0" class="prism-code language-toml codeBlock_bY9V thin-scrollbar" style="color:#393A34;background-color:#f6f8fa"><code class="codeBlockLines_e6Vv"><span class="token-line" style="color:#393A34"><span class="token key property" style="color:#36acaa">permissions</span><span class="token plain"> </span><span class="token punctuation" style="color:#393A34">=</span><span class="token plain"> </span><span class="token punctuation" style="color:#393A34">[</span><span class="token plain"></span><br></span><span class="token-line" style="color:#393A34"><span class="token plain"> </span><span class="token comment" style="color:#999988;font-style:italic"># Grant addition specific permission (Logs are already granted above)</span><span class="token plain"></span><br></span><span class="token-line" style="color:#393A34"><span class="token plain"> </span><span class="token punctuation" style="color:#393A34">{</span><span class="token plain"> </span><span class="token key property" style="color:#36acaa">target.type</span><span class="token plain"> </span><span class="token punctuation" style="color:#393A34">=</span><span class="token plain"> </span><span class="token string" style="color:#e3116c">"Stack"</span><span class="token punctuation" style="color:#393A34">,</span><span class="token plain"> </span><span class="token key property" style="color:#36acaa">target.id</span><span class="token plain"> </span><span class="token punctuation" style="color:#393A34">=</span><span class="token plain"> </span><span class="token string" style="color:#e3116c">"my-stack"</span><span class="token punctuation" style="color:#393A34">,</span><span class="token plain"> </span><span class="token key property" style="color:#36acaa">level</span><span class="token plain"> </span><span class="token punctuation" style="color:#393A34">=</span><span class="token plain"> </span><span class="token string" style="color:#e3116c">"Execute"</span><span class="token punctuation" style="color:#393A34">,</span><span class="token plain"> </span><span class="token key property" style="color:#36acaa">specific</span><span class="token plain"> </span><span class="token punctuation" style="color:#393A34">=</span><span class="token plain"> </span><span class="token punctuation" style="color:#393A34">[</span><span class="token string" style="color:#e3116c">"Inspect"</span><span class="token punctuation" style="color:#393A34">,</span><span class="token plain"> </span><span class="token string" style="color:#e3116c">"Terminal"</span><span class="token punctuation" style="color:#393A34">]</span><span class="token plain"> </span><span class="token punctuation" style="color:#393A34">}</span><span class="token punctuation" style="color:#393A34">,</span><span class="token plain"></span><br></span><span class="token-line" style="color:#393A34"><span class="token plain"> </span><span class="token comment" style="color:#999988;font-style:italic"># Use regex to match multiple resources, for example give john execute on all of their Stacks</span><span class="token plain"></span><br></span><span class="token-line" style="color:#393A34"><span class="token plain"> </span><span class="token punctuation" style="color:#393A34">{</span><span class="token plain"> </span><span class="token key property" style="color:#36acaa">target.type</span><span class="token plain"> </span><span class="token punctuation" style="color:#393A34">=</span><span class="token plain"> </span><span class="token string" style="color:#e3116c">"Stack"</span><span class="token punctuation" style="color:#393A34">,</span><span class="token plain"> </span><span class="token key property" style="color:#36acaa">target.id</span><span class="token plain"> </span><span class="token punctuation" style="color:#393A34">=</span><span class="token plain"> </span><span class="token string" style="color:#e3116c">"\\^john-(.+)$\\"</span><span class="token punctuation" style="color:#393A34">,</span><span class="token plain"> </span><span class="token key property" style="color:#36acaa">level</span><span class="token plain"> </span><span class="token punctuation" style="color:#393A34">=</span><span class="token plain"> </span><span class="token string" style="color:#e3116c">"Execute"</span><span class="token plain"> </span><span class="token punctuation" style="color:#393A34">}</span><span class="token punctuation" style="color:#393A34">,</span><span class="token plain"></span><br></span><span class="token-line" style="color:#393A34"><span class="token plain"></span><span class="token punctuation" style="color:#393A34">]</span><br></span></code></pre></div></div>
|
||
<h2 class="anchor anchorWithStickyNavbar_LWe7" id="administration">Administration<a href="#administration" class="hash-link" aria-label="Direct link to Administration" title="Direct link to Administration"></a></h2>
|
||
<p>Users can be given Admin privileges by a <code>Super Admin</code> (only the first user is given this status, set with <code>super_admin: true</code> on a User document in database). Super admins will see the "Make Admin" button when on a User page <code>/users/${user_id}</code>.</p>
|
||
<p>These users have unrestricted access to all Komodo Resources. Additionally, these users can update other (non-admin) user's permissions on resources.</p>
|
||
<p>Komodo admins are responsible for managing user accounts as well. When a user logs into Komodo for the first time, they will not immediately be granted access (this can changed with <code>KOMODO_ENABLE_NEW_USERS=true</code>). An admin must first <strong>enable</strong> the user, which can be done from the <code>Users</code> tab on <code>Settings</code> page. Users can also be <strong>disabled</strong> by an admin at any time, which blocks all their access to the GUI and API.</p>
|
||
<p>Users also have some configurable global permissions, these are:</p>
|
||
<ul>
|
||
<li>create server permission</li>
|
||
<li>create build permission</li>
|
||
</ul>
|
||
<p>Only users with these permissions (as well as admins) can add additional servers to Komodo, and can create additional builds, respectively.</p></div><footer class="theme-doc-footer docusaurus-mt-lg"><div class="row margin-top--sm theme-doc-footer-edit-meta-row"><div class="col"><a href="https://github.com/moghtech/komodo/tree/main/docsite/docs/resources/permissioning.md" target="_blank" rel="noopener noreferrer" class="theme-edit-this-page"><svg fill="currentColor" height="20" width="20" viewBox="0 0 40 40" class="iconEdit_Z9Sw" aria-hidden="true"><g><path d="m34.5 11.7l-3 3.1-6.3-6.3 3.1-3q0.5-0.5 1.2-0.5t1.1 0.5l3.9 3.9q0.5 0.4 0.5 1.1t-0.5 1.2z m-29.5 17.1l18.4-18.5 6.3 6.3-18.4 18.4h-6.3v-6.2z"></path></g></svg>Edit this page</a></div><div class="col lastUpdated_JAkA"></div></div></footer></article><nav class="docusaurus-mt-lg pagination-nav" aria-label="Docs pages"><a class="pagination-nav__link pagination-nav__link--prev" href="/docs/resources/webhooks"><div class="pagination-nav__sublabel">Previous</div><div class="pagination-nav__label">Configuring Webhooks</div></a><a class="pagination-nav__link pagination-nav__link--next" href="/docs/ecosystem"><div class="pagination-nav__sublabel">Next</div><div class="pagination-nav__label">Ecosystem</div></a></nav></div></div><div class="col col--3"><div class="tableOfContents_bqdL thin-scrollbar theme-doc-toc-desktop"><ul class="table-of-contents table-of-contents__left-border"><li><a href="#user-groups" class="table-of-contents__link toc-highlight">User Groups</a></li><li><a href="#permission-levels" class="table-of-contents__link toc-highlight">Permission Levels</a></li><li><a href="#specific-permissions" class="table-of-contents__link toc-highlight">Specific Permissions</a></li><li><a href="#permissioning-by-resource-type" class="table-of-contents__link toc-highlight">Permissioning by Resource Type</a></li><li><a href="#administration" class="table-of-contents__link toc-highlight">Administration</a></li></ul></div></div></div></div></main></div></div></div><footer class="theme-layout-footer footer footer--dark"><div class="container container-fluid"><div class="footer__bottom text--center"><div class="footer__copyright">Built with Docusaurus</div></div></div></footer></div>
|
||
</body>
|
||
</html> |