[DOCS#EV-6436]: Document the RBAC management UI for Calico Enterprise - #3035
Open
dimitri-nicolo wants to merge 1 commit into
Open
dimitri-nicolo wants to merge 1 commit into
dimitri-nicolo wants to merge 1 commit into
Conversation
✅ Deploy Preview for calico-docs-preview-next ready!
To edit notification comments on pull requests, go to your Netlify project configuration. |
✅ Deploy Preview succeeded!Built without sensitive environment variables
To edit notification comments on pull requests, go to your Netlify project configuration. |
dimitri-nicolo
force-pushed
the
dimitri-EV-6436
branch
14 times, most recently
from
September 22, 2026 22:06
8cd84c1 to
e366482
Compare
Add "Manage roles in the web console" under Operations > Calico Enterprise Manager UI, covering what the feature needs to be usable: turning it on, creating and scoping a role, granting it to a subject, binding it to an identity provider group, reviewing who holds what, and exporting roles to another cluster. Scoped to Calico Enterprise 3.24 (next) only, plus its sidebar entry and a cross-link from "Configure user roles and permissions". Behaviour the page is deliberate about, since each is easy to get wrong: - Role names take any non-empty string up to 253 characters, matching ValidateIdentity. Spaces, '@' and non-ASCII are all valid and necessary, since the name has to equal the group claim the IdP sends. - Turning the feature off uses get | jq | kubectl replace, because tigera-network-admin holds get and update on rbac-ui-config, not patch. - Subjects added by hand go on the ClusterRoleBindings. Those are what FindExistingMemberSubjects reads back, so a subject added only to a namespaced RoleBinding is dropped the next time the role is edited in the console. - IdP group binding is LDAP-only and single-homed on the management cluster: the manager's egress opens 389/636 only when Authentication.spec.ldap is set and scopes the destination to spec.ldap.host, and the /team/idp-groups routes always target the management cluster. The directory-sync secret is a second secret, distinct from tigera-ldap-credentials. - Export carries bindings, not the ClusterRoles they reference, so the target cluster needs role management on and the same tiers and namespaces. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
dimitri-nicolo
force-pushed
the
dimitri-EV-6436
branch
from
September 22, 2026 22:21
e366482 to
392691f
Compare
dimitri-nicolo
marked this pull request as ready for review
September 22, 2026 22:34
Contributor
Author
|
@Dean-Coakley @ctauchen could I please get a review? |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Product Version(s): Calico Enterprise 3.24 (next) only.
Issue: EV-6436 — epic EV-6431 / PMREQ-824
Link to docs preview:
(Use the
calico-docs-preview-nextpreview — thetigerapreview builds released versions only, so it redirects away fromnext.)SME review:
DOCS review:
Additional information:
One new page, Grant access with custom roles and IdP groups, under Operations > Calico Enterprise Manager UI, plus its sidebar entry and a cross-link from Configure user roles and permissions.
calico-enterprise/operations/cnx/manage-roles.mdx(new)sidebars-calico-enterprise.jscalico-enterprise/operations/cnx/roles-and-permissions.mdx(one link)It covers turning role management on, connecting an identity provider directory, creating and scoping a role, seeing who has access, and copying roles to another cluster. The page is written around the console —
kubectlappears only where the console has no equivalent.Merge checklist: