Skip to content

Commit

Permalink
Add example for editing resource quota permissions
Browse files Browse the repository at this point in the history
  • Loading branch information
HappyTetrahedron committed Apr 2, 2024
1 parent 974dc03 commit 339dab2
Show file tree
Hide file tree
Showing 2 changed files with 26 additions and 2 deletions.
24 changes: 24 additions & 0 deletions docs/modules/ROOT/pages/how-to/fine-grained-access-examples.adoc
Original file line number Diff line number Diff line change
Expand Up @@ -138,3 +138,27 @@ subjects:
"""
done
----

== Give a team or user permissions to manage resource quotas in a project

. Remove the user from the `organization` group

. Add the user or team which should have permission to manage resource quotas to the role binding `resource-quota-edit` in the required projects.
+
[source,bash]
----
ORGANIZATION=mycompany
TEAM=developers
PROJECT=mycompany-web-portal
oc -n "${PROJECT}" patch rolebinding resource-quota-edit -oyaml --patch """
subjects:
- apiGroup: rbac.authorization.k8s.io
kind: Group
name: ${ORGANIZATION}
- apiGroup: rbac.authorization.k8s.io
kind: Group
name: ${ORGANIZATION}+${TEAM}
"""
done
----
4 changes: 2 additions & 2 deletions docs/modules/ROOT/pages/how-to/lower-resource-quotas.adoc
Original file line number Diff line number Diff line change
Expand Up @@ -37,9 +37,9 @@ For further reference on ResourceQuota objects, refer to the https://kubernetes.
== Preventing other users from editing the ResourceQuota object

In a shared project, it's often desirable to restrict access to ResourceQuota objects, to prevent others from circumventing the quota by simply increasing it.
This can be achieved using Kubernetes rbac.
This can be achieved using Kubernetes RBAC.

Permissions to managing ResourceQuota objects are governed by the `resource-quota-edit` RoleBinding, which is created automatically in each project by {product}.
Permissions to manage ResourceQuota objects are governed by the `resource-quota-edit` RoleBinding, which is created automatically in each project by {product}.
{product} users may freely edit this RoleBinding to suit their needs.
By default, every user in the project's organization has permission to manage ResourceQuota objects.

Expand Down

0 comments on commit 339dab2

Please sign in to comment.