Skip to content

Commit 560bfb4

Browse files
committed
STAC-22208: format table
1 parent f62f9d0 commit 560bfb4

1 file changed

Lines changed: 15 additions & 6 deletions

File tree

setup/security/rbac/rbac_rancher.md

Lines changed: 15 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -12,8 +12,6 @@ Two kinds of roles are used for accessing SUSE Observability:
1212

1313
A number of `RoleTemplate`s are available to achieve this, with common groupings of permissions. Binding these templates to users or groups on a cluster or namespace will trigger roles and role-bindinds to be provisioned on the target cluster. The default templates are described below. Note that it is possible to define your own combinations of permissions in a custom RoleTemplate.
1414

15-
A standalone installation of SUSE Observability supplies predefined groups that correspond to the below instance roles.
16-
1715
### Observer role
1816

1917
The observer role grants a user the permission to read topology, metrics, logs and trace data for a namespace or a cluster. There are three `RoleTemplate`s that grant access to observability data:
@@ -35,17 +33,22 @@ The permissions assigned to each predefined SUSE Observability role can be found
3533
{% tabs %}
3634
{% tab title="Recommended Access" %}
3735
Recommended access grants permissions that are not strictly necessary, but that make SUSE Observability a lot more useful.
38-
| *Resource* | *Verbs* |
36+
37+
| Resource | Verbs |
38+
| --- | --- |
3939
| apitokens | get |
4040
| favoritedashboards | create, delete |
4141
| favoriteviews | create, delete |
4242
| stackpacks | get |
4343
| visualizationsettings | update |
44+
4445
{% endtab %}
4546

4647
{% tab title="Troubleshooter" %}
4748
The Troubleshooter role has access to all data available in SUSE Observability and the ability to create views and enable/disable monitors.
48-
| *Resource* | *Verbs* |
49+
50+
| Resource | Verbs |
51+
| --- | --- |
4952
| agents | get |
5053
| apitokens | get |
5154
| componentactions | execute |
@@ -64,11 +67,14 @@ The Troubleshooter role has access to all data available in SUSE Observability a
6467
| traces | get |
6568
| views | get, create, update, delete |
6669
| visualizationsettings | get |
70+
6771
{% endtab %}
6872

6973
{% tab title="Administrator" %}
7074
The Administrator role has all permissions assigned.
71-
| *Resource* | *Verbs* |
75+
76+
| Resource | Verbs |
77+
| --- | --- |
7278
| agents | get |
7379
| apitokens | get |
7480
| componentactions | execute |
@@ -93,6 +99,7 @@ The Administrator role has all permissions assigned.
9399
| traces | get |
94100
| views | get, create, update, delete |
95101
| visualizationsettings | update |
102+
96103
{% endtab %}
97104

98105

@@ -107,7 +114,9 @@ These resources correspond to data collected by the SUSE Observability agent and
107114
These resources can only be read, so the only applicable verb is `get`.
108115

109116
Apart from these RBAC resources controlling access to observability data, "instance" resources define user capabilities for executing and configuring SUSE Observability:
110-
| *Resource* | *Verbs* | *Description* |
117+
118+
| Resource | Verbs | Description |
119+
| --- | --- | --- |
111120
| `agents` | `get` | List connected agents with the cli `agent list` command |
112121
| `apitokens` | `get` | Access the CLI page. This provides the API key to use for authentication with the SUSE Observability CLI |
113122
| `componentactions` | `execute` | Execute [component actions](/use/views/k8s-topology-perspective.md#actions) |

0 commit comments

Comments
 (0)