Skip to content

Commit ee1d2ce

Browse files
jmagakmareklibra
andauthored
RHDHBUGS-2516: orchestrator.workflow.[workflowId] permission description missing instance access behavior (#2256)
* Update Permissions.md Update the orchestrator.workflow.[workflowId] description to: Allows the user to list and read a single workflow definition and its instances that they created * Run prettier Signed-off-by: Marek Libra <marek.libra@gmail.com> --------- Signed-off-by: Marek Libra <marek.libra@gmail.com> Co-authored-by: Marek Libra <marek.libra@gmail.com>
1 parent 5f03d82 commit ee1d2ce

1 file changed

Lines changed: 8 additions & 8 deletions

File tree

workspaces/orchestrator/docs/Permissions.md

Lines changed: 8 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -3,14 +3,14 @@ the RBAC plugin. The result is control over what users can see or execute.
33

44
## Orchestrator Permissions
55

6-
| Name | Resource Type | Policy | Description | Requirements |
7-
| ---------------------------------------- | -------------- | ------ | ---------------------------------------------------------------------------------------------- | ------------ |
8-
| orchestrator.workflow | named resource | read | Allows the user to list and read any workflow definition and their instances that they created | |
9-
| orchestrator.workflow.[`workflowId`] | named resource | read | Allows the user to list and read the details of a _single_ workflow definition | |
10-
| orchestrator.workflow.use | named resource | update | Allows the user to run or abort _any_ workflow | |
11-
| orchestrator.workflow.use.[`workflowId`] | named resource | update | Allows the user to run or abort the _single_ workflow | |
12-
| orchestrator.workflowAdminView | named resource | read | Allows the user to view instance variables and workflow definition editor | |
13-
| orchestrator.instanceAdminView | named resource | read | Allows the user to view all workflow instances, including those not created by them | |
6+
| Name | Resource Type | Policy | Description | Requirements |
7+
| ---------------------------------------- | -------------- | ------ | --------------------------------------------------------------------------------------------------- | ------------ |
8+
| orchestrator.workflow | named resource | read | Allows the user to list and read any workflow definition and their instances that they created | |
9+
| orchestrator.workflow.[`workflowId`] | named resource | read | Allows the user to list and read a _single_ workflow definition and its instances that they created | |
10+
| orchestrator.workflow.use | named resource | update | Allows the user to run or abort _any_ workflow | |
11+
| orchestrator.workflow.use.[`workflowId`] | named resource | update | Allows the user to run or abort the _single_ workflow | |
12+
| orchestrator.workflowAdminView | named resource | read | Allows the user to view instance variables and workflow definition editor | |
13+
| orchestrator.instanceAdminView | named resource | read | Allows the user to view all workflow instances, including those not created by them | |
1414

1515
The user is permitted to do an action if either the generic permission or the specific one allows it.
1616
In other words, it is not possible to grant generic `orchestrator.workflow` and then selectively disable it for a specific workflow via `orchestrator.workflow.use.[workflowId]` with `deny`.

0 commit comments

Comments
 (0)