diff --git a/_data/argohub-home-content.yml b/_data/argohub-home-content.yml index cf686ea63..55fc281c4 100644 --- a/_data/argohub-home-content.yml +++ b/_data/argohub-home-content.yml @@ -161,7 +161,7 @@ - title: Create a Codefresh account localurl: /gitops/administration/account-user-management/create-codefresh-account/ - title: Adding users and teams - localurl: /gitops/administration/account-user-management/add-users/ + localurl: /gitops/administration/account-user-management/add-users-teams/ - title: Access control for GitOps localurl: /gitops/administration/account-user-management/gitops-abac/ - title: User settings diff --git a/_data/argohub-nav.yml b/_data/argohub-nav.yml index 1f738515c..135334dd0 100644 --- a/_data/argohub-nav.yml +++ b/_data/argohub-nav.yml @@ -111,10 +111,10 @@ - title: Create a Codefresh account url: "/create-codefresh-account" - title: Adding users and teams - url: "/add-users" + url: "/add-users-teams" - title: Managing service accounts url: "/service-accounts" - - title: Configuring access control for GitOps + - title: Access control for GitOps url: "/gitops-abac" - title: Authorize access to organizations/projects url: "/hosted-authorize-orgs" diff --git a/_data/home-content.yml b/_data/home-content.yml index f6659a3ff..eda871f29 100644 --- a/_data/home-content.yml +++ b/_data/home-content.yml @@ -225,11 +225,11 @@ - title: Create a Codefresh account localurl: /docs/administration/account-user-management/create-codefresh-account/ - title: Adding users and teams - localurl: /docs/administration/account-user-management/add-users/ + localurl: /docs/administration/account-user-management/add-users-teams/ - title: Set up OAuth2 for GitOps - localurl: /docs/administration/account-user-management/oauth-setup/ + localurl: /docs/administration/account-user-management/oauth-setup/ - title: Access control for pipelines - localurl: /docs/administration/account-user-management/access-control/ + localurl: /docs/administration/account-user-management/access-control-pipelines/ - title: Access control for GitOps localurl: /docs/administration/account-user-management/gitops-abac/ - title: Audit diff --git a/_data/nav.yml b/_data/nav.yml index 493b665d2..acff2eb75 100644 --- a/_data/nav.yml +++ b/_data/nav.yml @@ -655,12 +655,14 @@ - title: Create a Codefresh account url: "/create-codefresh-account" - title: Adding users and teams - url: "/add-users" + url: "/add-users-teams" - title: Managing service accounts url: "/service-accounts" - - title: Configuring access control for pipelines - url: "/access-control" - - title: Configuring access control for GitOps + - title: Access control for user accounts + url: "/access-control-user-accounts" + - title: Access control for pipelines + url: "/access-control-pipelines" + - title: Access control for GitOps url: "/gitops-abac" - title: Setting up OAuth2 for GitOps url: "/oauth-setup" diff --git a/_docs/administration/account-user-management.md b/_docs/administration/account-user-management.md index 6dbf1b808..db44c2538 100644 --- a/_docs/administration/account-user-management.md +++ b/_docs/administration/account-user-management.md @@ -10,8 +10,8 @@ Codefresh has comprehensive support for all aspects of administration for organi Review: {% if page.collection != site.gitops_collection %} -* [Add users and teams]({{site.baseurl}}/docs/administration/account-user-management/add-users/) -* Configure access control for [pipelines]({{site.baseurl}}/docs/administration/account-user-management/access-control/) and for [GitOps]({{site.baseurl}}/docs/administration/account-user-management/gitops-abac/) +* [Add users and teams]({{site.baseurl}}/docs/administration/account-user-management/add-users-teams/) +* Configure access control for [pipelines]({{site.baseurl}}/docs/administration/account-user-management/access-control-pipelines/) and for [GitOps]({{site.baseurl}}/docs/administration/account-user-management/gitops-abac/) * [Configure access control for GitOps]({{site.baseurl}}/docs/administration/account-user-management/gitops-abac/) * [Configure Single Sign-On (SSO)]({{site.baseurl}}/docs/administration/single-sign-on/) * Get [audit logs]({{site.baseurl}}/docs/administration/account-user-management/audit/) for runtimes (hosted or private) @@ -21,7 +21,7 @@ For on-premises environments, see [On-premises account and user setup]({{site.ba {% endif %} {% if page.collection == site.gitops_collection %} -* [Add users and teams]({{site.baseurl}}/docs/administration/account-user-management/add-users/) +* [Add users and teams]({{site.baseurl}}/docs/administration/account-user-management/add-users-teams/) * [Configure access control for GitOps]({{site.baseurl}}/docs/administration/account-user-management/gitops-abac/) * [Configure Single Sign-On (SSO)]({{site.baseurl}}/docs/administration/single-sign-on/) {% endif %} \ No newline at end of file diff --git a/_docs/administration/account-user-management/access-control.md b/_docs/administration/account-user-management/access-control-pipelines.md similarity index 98% rename from _docs/administration/account-user-management/access-control.md rename to _docs/administration/account-user-management/access-control-pipelines.md index 3ce139f61..3875b52ec 100644 --- a/_docs/administration/account-user-management/access-control.md +++ b/_docs/administration/account-user-management/access-control-pipelines.md @@ -1,5 +1,5 @@ --- -title: "Configuring access control for pipelines" +title: "Access control for pipelines" description: "Restrict resources to pipelines in a company environment" group: administration sub_group: account-user-management @@ -9,6 +9,7 @@ redirect_from: - /docs/enterprise-account-mng/ent-account-mng/ - /docs/enterprise/ent-account-mng/ - /docs/administration/ent-account-mng/ + - /docs/administration/account-user-management/access-control/ toc: true --- @@ -38,7 +39,7 @@ Let's review the different access mechanisms in more detail, including privilege ## Role-based access for users and administrators -Role-based access is usually defined when you [add teams]({{site.baseurl}}/docs/administration/account-user-management/add-users/#teams-in-codefresh) to accounts. Role-based access means assigning either a user or an administrator role. +Role-based access is usually defined when you [add teams]({{site.baseurl}}/docs/administration/account-user-management/add-users-teams/#teams-in-codefresh) to accounts. Role-based access means assigning either a user or an administrator role. >**NOTE** Only a user with an administrator role can add other users, and assign or change user roles. @@ -248,7 +249,7 @@ Also review our examples in [Creating rules for pipelines by project tags](#crea ##### Before you begin Make sure you have: -* [Created at least one team]({{site.baseurl}}/docs/administration/account-user-management/add-users/#teams-in-codefresh) +* [Created at least one team]({{site.baseurl}}/docs/administration/account-user-management/add-user-teams/#teams-in-codefresh) * Reviewed [CRUD privileges for entities/resources](#crud-privileges-for-entitiesresources) * Added tags for all entities, except pipelines @@ -385,7 +386,7 @@ We want: **Step 1: Set up the teams** The first step is to create the teams, and add the users you want to each team. -See [Teams in Codefresh]({{site.baseurl}}/docs/administration/account-user-management/add-users/#teams-in-codefresh). +See [Teams in Codefresh]({{site.baseurl}}/docs/administration/account-user-management/add-users-teams/#teams-in-codefresh). If you have already created the DevOps and Users teams, you'll need to create the Marvel team. @@ -624,6 +625,7 @@ By default, if configured for the account, users can also load pipeline definiti ## Related articles +[Access control for user accounts]({{site.baseurl}}/docs/administration/account-user-management/access-control-user-accounts) [Codefresh Provider for Terraform](https://registry.terraform.io/providers/codefresh-io/codefresh/latest/docs){:target="\_blank"} [Managing your Kubernetes cluster]({{site.baseurl}}/docs/deployments/kubernetes/manage-kubernetes/) diff --git a/_docs/administration/account-user-management/access-control-user-accounts.md b/_docs/administration/account-user-management/access-control-user-accounts.md new file mode 100644 index 000000000..5ac0816c0 --- /dev/null +++ b/_docs/administration/account-user-management/access-control-user-accounts.md @@ -0,0 +1,38 @@ +--- +title: "Access control for user accounts" +description: "Define session timeouts and domain restrictions for all users" +toc: true +--- + +## User account access control + +You can configure general access control settings that apply to all users in your Codefresh account. These include enforcing automatic logout after periods of inactivity, and restricting invitations to approved email domains. These controls help enforce organizational security policies across the platform. + +## Define access controls for user accounts + +Define sessions timeouts and email domain restrictions for all users in the account. + +> **NOTE** +> The maximum duration for inactivity is 30 days. Inactive users are warned 15 minutes before they are logged out. + +1. In the Codefresh UI, on the toolbar, click the **Settings** icon. +1. From the sidebar, select **Access Control**. +1. **User Session**: Define the maximum duration for inactivity in minutes/hours/days before enforcing a timeout. +1. **User Invitation**: + * To restrict invitations to specific email domains, turn on **Restrict inviting additional users..** + * In the **Email domains** field, type in the domains to allow, one per line. + + {% include image.html + lightbox="true" + file="/images/administration/access-control/security-timeout.png" + url="/images/administration/access-control/security-timeout.png" + alt="Security timeout" + caption="Security timeout" + max-width="90%" + %} + +## Related articles +[Access control for GitOps]({{site.baseurl}}/docs/administration/account-user-management/gitops-abac/) +{% if page.collection != site.gitops_collection %} +[Access control for pipelines]({{site.baseurl}}/docs/administration/account-user-management/access-control-pipelines/) +{% endif %} diff --git a/_docs/administration/account-user-management/add-users.md b/_docs/administration/account-user-management/add-users-teams.md similarity index 53% rename from _docs/administration/account-user-management/add-users.md rename to _docs/administration/account-user-management/add-users-teams.md index da1fe53b2..6131f0f6e 100644 --- a/_docs/administration/account-user-management/add-users.md +++ b/_docs/administration/account-user-management/add-users-teams.md @@ -8,120 +8,96 @@ redirect_from: - /docs/accounts/ - /docs/accounts/invite-your-team-member/ - /docs/administration/invite-your-team-member/ + - /docs/administration/account-user-management/add-users/ toc: true --- Once you have created a Codefresh account, you can add any number of users to collaborate on repositories, entities, and processes. + {% if page.collection != site.gitops_collection %} For Codefresh on-premises, see [On-premises account & user setup]({{site.baseurl}}/docs/installation/on-premises/on-prem-configuration/). {% endif %} -You can then create teams in Codefresh to group users who share a common denominator, such as the same permissions, access to the same functionality, or roles. Teams make it easy for administrators to both define and manage items shared by multiple users in an organization. +You can then create teams to group users who share a common denominator, such as the same permissions, access to the same functionality, or roles. Teams make it easy for administrators to both define and manage items shared by multiple users in an organization. ## Users in Codefresh Adding a user to an account requires assigning a role to define access to account resources, and optionally, selecting an SSO provider for the user: +* **Email address**: The user's company email address. * **Role**: Defines the user's access level to the resources in the account. * **User**: The default. With this role, users can work with repositories and entities, but cannot change configuration settings. * **Administrator**: With this role, users have full access to accounts, and can change all settings, so make sure that they are trusted colleagues. {% if page.collection != site.gitops_collection %} - For guidelines on access control, see [Access control for pipelines]({{site.baseurl}}/docs/administration/account-user-management/access-control/) and [Configuring access control for GitOps]({{site.baseurl}}/docs/administration/account-user-management/gitops-abac/). + For guidelines on access control, see [Access control for pipelines]({{site.baseurl}}/docs/administration/account-user-management/access-control-pipelines/) and [Access control for GitOps]({{site.baseurl}}/docs/administration/account-user-management/gitops-abac/). {% endif %} {% if page.collection == site.gitops_collection %} - For guidelines on access control, see [Configuring access control for GitOps]({{site.baseurl}}/docs/administration/account-user-management/gitops-abac/). + For guidelines on access control, see [Access control for GitOps]({{site.baseurl}}/docs/administration/account-user-management/gitops-abac/). {% endif %} * **SSO**: By default, SSO is not enabled for users. If required, explicitly select the SSO provider. For an overview of SSO, see [About Federated Single Sign-on]({{site.baseurl}}/docs/administration/single-sign-on/). ### Add a user to a Codefresh account -1. In the Codefresh UI, on the toolbar, click the **Settings** icon and then select **Account Settings**. -1. From the sidebar select **Users & Teams**. -1. Select **Users**, and then select **+ [Add User]**. -1. Type the **User's email address**, and click **Invite**. +1. In the Codefresh UI, on the toolbar, click the **Settings** icon. +1. From the sidebar select **Users**, and then click **Add User**. +1. Add the user's **Email address**. - The user receives an email invitation, and in the Users list, the username is set to Pending, and status to Resend. -1. From the **Role** dropdown, select either **User** or **Administrator**. -1. If SSO is configured for the account, **Select SSO provider**. +1. From **Assign a role**, select either **Administrator** or **User**. +1. If SSO is configured for the account, **Select the SSO provider** from the list. ### Manage users in a Codefresh account -Once you add a user to your Codefresh account, you can do the following to manage that user: - -* Resend invitations that are pending acceptance: Select **Resend**. -* Edit the user's email address: Select **Edit**. -* Change the role: From the **Role** dropdown, select the new role. -* Change SSO provider: From the **SSO** dropdown, select the new SSO provider. -* Remove the user account: Select **Delete**. +Once you add a user to your Codefresh account, you have the following options in the context menu of the user in the Users page. +* **Edit**: Edit user's email address, change the role, or select a new SSO provider. +* **Delete**: Remove the user account. ## Teams in Codefresh -Teams are users who share the same permissions, roles, or requirements defined according to company processes. Teams allow you to enforce access control through ABAC (Attribute Based Access Control). - -By default, there are two teams: +Teams are users who share the same permissions, roles, or requirements, defined according to company processes. +You first create a team and then invite users to it. You can then view the service accounts the user is assigned to, if any. +{% if page.collection != site.gitops_collection %} * Users * Admins with users [invited as collaborators](#assign-a-user-to-a-team) - + > **NOTE** > Only Enterprise customers can add new teams. Other Codefresh plans can only use the predefined *Users* and *Admin* teams. [Contact us](https://codefresh.io/contact-us/){:target="\_blank"} to upgrade to an Enterprise plan. -{% if page.collection != site.gitops_collection %} + ### Automatically creating projects for teams As part of the global pipeline settings for an account, when creating a team, you can also automatically create a project and a project tag with the same name as that of the team. Enabling **auto-create projects for teams** (disabled by default), simplifies permissions setup for pipelines and projects, as it also creates a Read rule for the project. See [Auto-create projects for teams]({{site.baseurl}}/docs/pipelines/configuration/pipeline-settings/#auto-create-projects-for-teams). -{% endif %} -### Create a team in Codefresh +{% endif %} -Create a team in Codefresh and then assign users to the team. You can assign the same user to multiple teams, as in most companies, users have overlapping roles. +### Create teams in Codefresh -1. In the Codefresh UI, on the toolbar, click the **Settings** icon and then select **User Management**. -1. From the sidebar, select **Users & Teams**. -1. Select **Teams**, and then select **Create a Team**. -1. Enter the **Team Name**. +Create multiple teams in Codefresh. +1. In the Codefresh UI, on the toolbar, click the **Settings** icon. +1. From the sidebar, select **Teams**, and then click **Add Team**. +1. Enter the **Team Name** and click **Create**. > **NOTE** > The team name can include only lower-case alphanumeric characters and hyphens, without spaces. - See the screenshot below for some sample team names. -{% include image.html - lightbox="true" - file="/images/administration/access-control/teams.png" - url="/images/administration/access-control/teams.png" - alt="Examples of teams in Codefresh" - caption="Examples of teams in Codefresh" - max-width="80%" - %} -### Assign a user to a team -1. To assign users to the team, do the following: - 1. Hover over the team name and click the **Settings** icon. - 1. Click **Invite to team**, type the email address of the user to invite, and then click **Add**. -1. To change the name of the team, click **Edit** and type the new name. +### Assign users to teams +Add one or more users to a team. You can assign the same user to multiple teams, as in most companies, users have overlapping roles. -## Define session timeouts and domain restrictions for user accounts +1. In the Codefresh UI, on the toolbar, click the **Settings** icon. +1. From the sidebar, select **Teams**, and then click the team to which to add users. +1. Click **Add to team**, and select the user from the list. +1. Click **Add**. + +### Manage teams and users + +You can change the name of the team, delete the team, or remove users from a team . + +* **Remove user from team**: Click the team name and from the user's context menu, select ** user's email address, change the role, or select a new SSO provider. +* **Delete**: Remove the user account. -As an administrator, you can optionally define session timeouts to automatically log out users who have been inactive for the specified duration, and restrict invitations to specific email domains. -> **NOTE** -> The maximum duration for inactivity is 30 days. Inactive users are warned 15 minutes before they are logged out. - -1. In the Codefresh UI, on the toolbar, click the **Settings** icon, and then select **Account Settings**. -1. From the sidebar, select **Users & Teams**. -1. Select **Security**. -1. For **User Session**, add the timeout duration in minutes/hours/days. -1. To restrict invitations to specific email domains, below User Invitations, turn on **Restrict inviting additional users..** and then in the **Email domains**, type in the domains to allow, one per line. - - {% include image.html - lightbox="true" - file="/images/administration/access-control/security-timeout.png" - url="/images/administration/access-control/security-timeout.png" - alt="Security timeout" - caption="Security timeout" - max-width="90%" - %} ## Troubleshoot user invites @@ -135,8 +111,8 @@ As an administrator, you can optionally define session timeouts to automatically ## Related articles [Single sign-on]({{site.baseurl}}/docs/administration/single-sign-on/) -[Configuring access control for GitOps]({{site.baseurl}}/docs/administration/account-user-management/gitops-abac/) +[Access control for GitOps]({{site.baseurl}}/docs/administration/account-user-management/gitops-abac/) {% if page.collection != site.gitops_collection %} [Setting up OAuth authentication for Git providers]({{site.baseurl}}/docs/administration/account-user-management/oauth-setup) -[Configuring access control for pipelines]({{site.baseurl}}/docs/administration/account-user-management/access-control/) +[Access control for pipelines]({{site.baseurl}}/docs/administration/account-user-management/access-control-pipelines/) {% endif %} diff --git a/_docs/administration/account-user-management/audit.md b/_docs/administration/account-user-management/audit.md index 7344bcb24..ddfbc546e 100644 --- a/_docs/administration/account-user-management/audit.md +++ b/_docs/administration/account-user-management/audit.md @@ -115,5 +115,5 @@ Export all audited events, both Audits and Triggers, to a `CSV` file, for offli ## Related articles [Codefresh installation options]({{site.baseurl}}/docs/installation/installation-options/) -[Configuring access Control]({{site.baseurl}}/docs/administration/account-user-management/access-control/) +[Access control for pipelines]({{site.baseurl}}/docs/administration/account-user-management/access-contro-pipelines/) [Codefresh API integration]({{site.baseurl}}/docs/integrations/codefresh-api/) diff --git a/_docs/administration/account-user-management/create-codefresh-account.md b/_docs/administration/account-user-management/create-codefresh-account.md index fb3d55307..e8357e2f4 100644 --- a/_docs/administration/account-user-management/create-codefresh-account.md +++ b/_docs/administration/account-user-management/create-codefresh-account.md @@ -144,12 +144,12 @@ Only account owners can delete the account. ## Related articles -[Adding users and teams]({{site.baseurl}}/docs/administration/account-user-management/add-users/) +[Adding users and teams]({{site.baseurl}}/docs/administration/account-user-management/add-users-teams/) [Single sign-on]({{site.baseurl}}/docs/administration/single-sign-on/) [Codefresh IP addresses]({{site.baseurl}}/docs/administration/platform-ip-addresses/) -[Configuring access control for GitOps]({{site.baseurl}}/docs/administration/account-user-management/gitops-abac/) +[Access control for GitOps]({{site.baseurl}}/docs/administration/account-user-management/gitops-abac/) {% if page.collection != site.gitops_collection %} -[Configuring access control for pipelines]({{site.baseurl}}/docs/administration/account-user-management/access-control/) +[Access control for pipelines]({{site.baseurl}}/docs/administration/account-user-management/access-control-pipelines/) {% endif %} diff --git a/_docs/administration/account-user-management/gitops-abac.md b/_docs/administration/account-user-management/gitops-abac.md index 07ee91909..2ac48ee50 100644 --- a/_docs/administration/account-user-management/gitops-abac.md +++ b/_docs/administration/account-user-management/gitops-abac.md @@ -17,7 +17,7 @@ Rules define the *who*, *what*, and *where* to control access through the follow * [Products](#products-actions--attributes) * **Teams** - Teams control the _who_ part of the rule. See [Adding users and teams]({{site.baseurl}}/docs/administration/account-user-management/add-users/). + Teams control the _who_ part of the rule. See [Adding users and teams]({{site.baseurl}}/docs/administration/account-user-management/add-users-teams/). * **Actions** Actions control the _what_ part of the rule. You need to select at least one action per entity. Available actions differ based on the selected entity. @@ -239,3 +239,5 @@ This rule grants manual promotion privileges to specific products that match a s ## Related articles [Codefresh Provider for Terraform](https://registry.terraform.io/providers/codefresh-io/codefresh/latest/docs){:target="\_blank"} +[Access control for user accounts]({{site.baseurl}}/docs/administration/account-user-management/access-control-user-accounts) + diff --git a/_docs/administration/account-user-management/oauth-setup.md b/_docs/administration/account-user-management/oauth-setup.md index 58a6b68ae..b6f69e86b 100644 --- a/_docs/administration/account-user-management/oauth-setup.md +++ b/_docs/administration/account-user-management/oauth-setup.md @@ -204,8 +204,8 @@ For a Git provider and a Runtime account, select the authentication mechanism: C ## Related articles -[Adding users and teams]({{site.baseurl}}/docs/administration/account-user-management/add-users/) -[Configuring access control for GitOps]({{site.baseurl}}/docs/administration/account-user-management/gitops-abac/) +[Adding users and teams]({{site.baseurl}}/docs/administration/account-user-management/add-users-teams/) +[Access control for GitOps]({{site.baseurl}}/docs/administration/account-user-management/gitops-abac/) [Git tokens for GitOps]({{site.baseurl}}/docs/security/git-tokens/) \ No newline at end of file diff --git a/_docs/administration/account-user-management/pipeline-execution-context.md b/_docs/administration/account-user-management/pipeline-execution-context.md index bc2d404f9..1683384f2 100644 --- a/_docs/administration/account-user-management/pipeline-execution-context.md +++ b/_docs/administration/account-user-management/pipeline-execution-context.md @@ -21,7 +21,7 @@ A pipeline execution context is an entity attached to the pipeline that makes AP ## Permissions -When a new execution context is created, it has no permissions at first. An account admin must add ABAC rules to grant permissions to that execution context. The enforcement of the execution context permissions will be based on the existing [ABAC model]({{site.baseurl}}/docs/administration/account-user-management/access-control/) that we have today on our platform. The available permissions for execution context will be the same as we have today for codefresh teams. There will be a new tab on the Permissions page for assigning ABAC rules to the execution context. +When a new execution context is created, it has no permissions at first. An account admin must add ABAC rules to grant permissions to that execution context. The enforcement of the execution context permissions will be based on the existing [ABAC model]({{site.baseurl}}/docs/administration/account-user-management/access-control-pipelines/) that we have today on our platform. The available permissions for execution context will be the same as we have today for codefresh teams. There will be a new tab on the Permissions page for assigning ABAC rules to the execution context. In addition, there will be a new action for team rules: assigning execution context to pipelines. Account admins will be able to control which teams will be able to set execution contexts to certain pipelines by creating a rule like: “Dev team can assign execution context with tags ‘dev-context’ to pipelines that have ‘dev’ tags.” diff --git a/_docs/administration/account-user-management/service-accounts.md b/_docs/administration/account-user-management/service-accounts.md index a485c41d5..920410663 100644 --- a/_docs/administration/account-user-management/service-accounts.md +++ b/_docs/administration/account-user-management/service-accounts.md @@ -15,13 +15,13 @@ Each service account can hold multiple API keys, making it easy to manage access ## Create service accounts Create service accounts in Codefresh to manage processes, integrations, at the account level. -{% if page.collection != site.gitops_collection %}Assign teams to service accounts to ensure RBAC access for those teams and their users (see [Access control for pipelines]({{site.baseurl}}/docs/administration/account-user-management/access-control)). {% endif %} +{% if page.collection != site.gitops_collection %}Assign teams to service accounts to ensure RBAC access for those teams and their users (see [Access control for pipelines]({{site.baseurl}}/docs/administration/account-user-management/-pipelines)). {% endif %} Note that service account creation is not supported via CLI and Terraform. ##### Before you begin -* Create one or more [teams]({{site.baseurl}}/docs/administration/account-user-management/add-users/#create-a-team-in-codefresh) +* Create one or more [teams]({{site.baseurl}}/docs/administration/account-user-management/add-users-teams/#create-a-team-in-codefresh) ##### How to @@ -103,7 +103,7 @@ max-width="90%" ## Related articles {% if page.collection != site.gitops_collection %} -[Access control for pipelines]({{site.baseurl}}/docs/administration/account-user-management/access-control/) {% endif %} +[Access control for pipelines]({{site.baseurl}}/docs/administration/account-user-management/access-control-pipelines/) {% endif %} [Access control for GitOps]({{site.baseurl}}/docs/administration/account-user-management/gitops-abac/) diff --git a/_docs/administration/administration-overview.md b/_docs/administration/administration-overview.md index 62821be48..6928f5602 100644 --- a/_docs/administration/administration-overview.md +++ b/_docs/administration/administration-overview.md @@ -24,7 +24,7 @@ See [Account and user management]({{site.baseurl}}/docs/administration/account-u {% if page.collection != site.gitops_collection %} * **CI pipelines** Implement role-based access control (RBAC) and attribute-based access control (ABAC) to restrict access to pipelines. Define roles, assign tags, and create rules to manage permissions effectively. - See [Access control for pipelines]({{site.baseurl}}/docs/administration/account-user-management/access-control/). + See [Access control for pipelines]({{site.baseurl}}/docs/administration/account-user-management/access-control-pipelines/). {% endif %} * **GitOps** Set up access control mechanisms for GitOps entities and processes to ensure secure operations. diff --git a/_docs/administration/single-sign-on/team-sync.md b/_docs/administration/single-sign-on/team-sync.md index 4a309d88d..9b1416f0d 100644 --- a/_docs/administration/single-sign-on/team-sync.md +++ b/_docs/administration/single-sign-on/team-sync.md @@ -71,7 +71,7 @@ Manually synchronize users and teams provisioned in your SSO provider account, o >**NOTE** -Make sure that there are no [domain restrictions on the email address]({{site.baseurl}}/docs/administration/account-user-management/add-users/#define-session-timeouts-and-domain-restrictions-for-user-accounts). +Make sure that there are no [domain restrictions on the email address]({{site.baseurl}}/docs/administration/account-user-management/add-users-teams/#define-session-timeouts-and-domain-restrictions-for-user-accounts). As an example, you can sync your Azure teams with the CLI: @@ -99,7 +99,7 @@ max-width="40%" As an alternative to manually syncing teams on demand via the Codefresh CLI, you can manually sync teams using Codefresh pipelines. >**NOTE** -Make sure that there are no [domain restrictions on the email address]({{site.baseurl}}/docs/administration/account-user-management/add-users/#define-session-timeouts-and-domain-restrictions-for-user-accounts). +Make sure that there are no [domain restrictions on the email address]({{site.baseurl}}/docs/administration/account-user-management/add-users-teams/#define-session-timeouts-and-domain-restrictions-for-user-accounts). A pipeline makes it possible to run team-sync periodically as a job. You can use the CLI as a [freestyle step]({{site.baseurl}}/docs/pipelines/steps/freestyle/), as in the example below. You can create a Git repository with a [codefresh.yml]({{site.baseurl}}/docs/pipelines/what-is-the-codefresh-yaml/) file with the following content: diff --git a/_docs/assets/article-template.md b/_docs/assets/article-template.md new file mode 100644 index 000000000..033f656b2 --- /dev/null +++ b/_docs/assets/article-template.md @@ -0,0 +1,440 @@ +--- +title: "Add here title of help article: Create products" +description: "Add here tagline for help article - what it does describe - Create products and tailor settings to optimize them" +toc: true - required always set to true for the article to be displayed in the sidebar +--- + +## Headings within articles +Heading 2 is the main main heading level in an article. +If it's an overview, it can include: +* Paragraphs +* Embedded video if any +* Screenshot +* Bulleted list +* Level 5 headings to set off important aspects you want to communicate in the overview + + + +A product in Codefresh is a logical grouping of related Argo CD applications that provides context, versioning, and lifecycle management across environments. Unlike standalone applications in Argo CD, products establish relationships between applications, making it easier to track deployments, manage promotions, and maintain consistency. See [About Products]({{site.baseurl}}/docs/products/about-products/). + +There are two ways to create a product in Codefresh GitOps: +* When creating or editing an [application]({{site.baseurl}}/docs/deployments/gitops/application-configuration-settings/#products)
+ You can create a product while creating an application. + +* From the [Products page](#create-products)
+ Create and manage products directly, then assign applications to them, as described in this article. +##### Example of level 5 heading to callout embedded video + + + +## Example of bulleted or unordered lists +* Unordered - bulleted list items - in markdown are indicated by **asterisk*** or **dash-**. +* If the bulleted list includes the bullet item followed by a description: + * Bold the bulleted item as in the example below. + * Add two spaces or
at the end of the bulleted item to create a new line. + * Indent the new line with the description two spaces to the right to align with the text of the bulleted item. +* If the bulleted list is a list of items: + * Do not bold each item + * If the items are fragments of sentences, do not add a period at the end of the item. + * If an item is a complete sentence or includes more than one sentence, then add periods for all the items in the list. + + +### Example of lists with bullet item and description +* **No environments defined** + If you have not created environments, the Product Dashboard does not display any applications, even if you have assigned applications to the product. + + +* **Unmapped cluster-namespace** + If the cluster or namespace the application is deployed to is not mapped to an environment, the application is notdisplayed in the Product Dashboard. + +### Example of lists with bullet items only +Codefresh currently supports the following IdPs: +* GitHub +* Bitbucket +* GitLab +* Azure +* Google +* LDAP + +## Example of ordered - numbered - lists +* Numbered lists are created in markdown using 1. for all steps in the list. +* When compiled, the numbers are automatically generated in the correct sequence. +* If you have a screenshot below a step, you must manually add the number of the subsequent step, in the syntax: {:start="2"}. + + +### Example of procedure with numbered list + +1. In the Codefresh UI, from the sidebar, select **Products**. +1. Click **Add Product**. +1. Define the following: + 1. **Name**: A unique name for your Product, which is also unique in the cluster. + 1. **Connect Applications**: The applications to associate with this Product. + Copy and paste the annotation into the application's manifest. + 1. **Tags**: Any metadata providing additional context and information about the Product, used for filtering and organization purposes. + +{% include + image.html + lightbox="true" + file="/images/gitops-products/create-product.png" + url="/images/gitops-products/create-product.png" + alt="Add Product" + caption="Add Product" + max-width="60%" +%} + +{:start="4"} +1. Click **Add**. + The Product is displayed on the Product page, and on drill down, in the Product Dashboard. + +### Procedure with prerequistes +If the procedure requires the user to do or be aware of issues, indicate it with a level 5 heading entitled **Before you begin** and another before the numbered steps, entitled **How to**. + +To create a product for a new or an existing application, see [Configuring applications]({{site.baseurl}}/docs/deployments/gitops/application-configuration-settings/#products). + +##### Before you begin +* Create one or more [environments]({{site.baseurl}}/docs/environments/create-manage-environments/#create-environments) + +##### How to +1. In the Codefresh UI, from the sidebar, select **Products**. +1. Click **Add Product**. +1. Define the following: + 1. **Name**: A unique name for your Product, which is also unique in the cluster. + 1. **Connect Applications**: The applications to associate with this Product. + Copy and paste the annotation into the application's manifest. + 1. **Tags**: Any metadata providing additional context and information about the Product, used for filtering and organization purposes. + +{% include + image.html + lightbox="true" + file="/images/gitops-products/create-product.png" + url="/images/gitops-products/create-product.png" + alt="Add Product" + caption="Add Product" + max-width="60%" +%} + +{:start="4"} +1. Click **Add**. + The Product is displayed on the Product page, and on drill down, in the Product Dashboard. + +## Callouts in articles +There are three types of callouts you can add to articles: Notes, tips, and warnings. + +### Notes +This is an example of a note with two paragraphs. +>**NOTE** +For Git repositories, the login method is less important, as you can access Git repositories through Git integrations, regardless of your sign-up process.

+If you have multiple sign-up methods, as long as you use the same email address in all the sign-ups, Codefresh automatically redirects you to the account dashboard. + +### Tips + +Tips indicate information that is useful for the user to be aware of when performing a task, or describing a concept. + +##### Markdown syntax for tips +{{site.data.callout.callout_tip}} +**TIP** + If [**Auto-create projects for teams**]({{site.baseurl}}/docs/pipelines/configuration/pipeline-settings/#auto-create-projects-for-teams) is enabled in global pipeline settings for your account, then creating the team also creates a project and tag for the project, both with the same name as the team name. +{{site.data.callout.end}} + +### Important/warnings +Use Important to indicate issues which can result in loss of data. + +When needed, you can also use this syntax for notifications without the title of warning or important. + + +{{site.data.callout.callout_warning}} +**IMPORTANT** +If you do use these IPs, we **strongly recommend** that you monitor this page on a regular basis. +{{site.data.callout.end}} + + +## Cross-references and external links +Cross references are links to articles within the same docsite, either to the article or to a section within the article. +Links are references to external sites. + +Cross-references open in the same browser tab/window. External links open in a new browser tab/window. + +### Cross-references to articles within docsite +Unless the cross-reference is to an article only available in GitOps Cloud, the reference should always point to the article in ``_docs``. + +##### Cross-reference to article shared between `_docs` and `_gitops` + +**Syntax** +`[Display text in square parentheses]({{site.baseurl}}//)` + +where: +* `{{site.baseurl}}` is fixed and points to the base domain. +* `` is the relative link to the article in `_docs`. For example, `/docs/administration/user-self-management/user-settings/`. + +**Example** +[Authorize Git access in Codefresh]({{site.baseurl}}/docs/administration/user-self-management/user-settings/) + +### Cross-references to article only in GitOps +To cross reference an article only in GitOps, use the name of the gitops collection. + + +**Syntax** +`[Display text in square parentheses]({{site.baseurl}}/{{site.gitops_collection}}//)` + +where: +* `{{site.baseurl}}` is fixed and points to the base domain. +* `{{site.gitops_collection}}` points to the `_gitops` collection. +* `` is the relative link to the article in `_gitops`. For example, `/introduction/explore-gitops-cloud-features/`. + +**Example** + +[Explore Codefresh GitOps Cloud]({{site.baseurl}}/{{site.gitops_collection}}/introduction/explore-gitops-cloud-features/) + + +### Cross-references to mid-topic articles +You also add cross-references to specific sections within articles. The references are prefixed with `#`. + +##### Cross-reference is to mid-article sections in _same_ article + +**Example** +These are all cross-references to sections within the article **Application configuration settings**. +* [Application definitions](#application-definitions): Basic metadata, such as the application name, GitOps Runtime, and the name of the YAML manifest. +* [General configuration settings](#application-general-configuration-settings): Product, Group, source, destination, and sync policies for the application. + +##### Cross-reference is to mid-article section in _different_ article + +To link to a specific section in a different article within the same docsite, add the title to the complete reference link: + +**Example** + +Here are examples of cross-references to two different sections in **Application: General configuration settings**. +You can see that the reference URL includes the full link to the article, then + +* [General configuration settings]({{site.baseurl}}/docs/deployments/gitops/application-configuration-settings/#application-general-configuration-settings) + +* [Advanced configuration settings]({{site.baseurl}}/docs/deployments/gitops/application-configuration-settings/#application-advanced-configuration-settings) + +##### Cross-reference in _HTML_ format +If you have a table or lists in HTML formats enclosed within {::nomarkdown} tags, add the HTTP/HTTPS URL in HTML syntax. + +**Example** +{::nomarkdown} +See Configure SSH for runtimes +{:/} + + +### Links to external sites +Links to external sites generally comprise the HTTP/HTTPS URL to the site. Also includes the target definition - `{:target="\_blank}` - to ensure that the link opens in a browser tab/window and the user remains within the docsite context. + +**Example** +Link to a blog: +Read more on the first of their kind dashboards for GitOps Environments and Products in this [blog](https://codefresh.io/blog/introducing-the-worlds-first-dashboard-for-gitops-environments/){:target="\_blank}. + + + + + +## Screenshots in articles +Documentation uses SnagIt for screenshots. + +To add a screenshot: +1. First create the image. +1. + + +Screenshots are sized as thumbnails of 60%. + + +### Create a screenshot +Use SnagIt to create a screenshot of a region, of + +### Add to images +Save the image in the `docs.codefresh.io` repo in `images`/ if needed. + + +### Add to article + +1. Copy and paste this syntax where you want to add the image: + +{% include + image.html + lightbox="true" + file="/images/gitops-products/create-product.png" + url="/images/gitops-products/create-product.png" + alt="Add Product" + caption="Add Product" + max-width="60%" +%} + +{:start="2"} +1. For `file` and `url`, change the paths to the path where the new image is saved. For example, `images/gitops-promotions/components/environments.png`. +1. For `alt` and `caption`, change to match the new image. For example, `GitOps Environments`. + The updated image syntax now looks like this: + + {% include + image.html + lightbox="true" + file="/images/gitops-promotions/components/environments.png" + url="/images/gitops-promotions/components/environments.png" + alt="GitOps Environments" + caption="GitOps Environments" + max-width="60%" +%} + +{:start="4"} +1. Make sure to add empty lines before and after the image as in step 3. above. + +### Captions for images +Captions for images should be descriptive without being too lengthy. + + +## Diagrams in articles +Diagrams are useful to illustrate architecture, concepts etc. +Generally, the writer creates a rough draft in whichver appplication and then works with UX to create the final version in Figma. +The Figma version is exported to PNG and saved in the desired location in `/images`. + +1. Create the diagram, and export it if needed to PNG. +1. Save the diagram like you would save a screenshot in `docs.codefresh.io/images/`. +1. Use the same syntax to add the image to the article: + + {% include + image.html + lightbox="true" + file="/images/gitops-promotions/components/environments.png" + url="/images/gitops-promotions/components/environments.png" + alt="GitOps Environments" + caption="GitOps Environments" + max-width="60%" +%} + +{:start="4"} +1. Update the `file`, `url`, `alt` and `caption` fields as needed. +1. Increase the size if needed to `"80%"` or `"100%"`. + +## Tables in articles + +Tables are useful for reference information such as parameter descriptions, system requirements, dashboard data, and the like. +Here's an example of bulleted lists in markdown tables: [System requirements]({{site.baseurl}}/docs/installation/gitops/runtime-system-requirements/). + +The CSS for tables are predefined and rendered on running the build. + +### Markdown tables + +Markdown tables have a header, a header border, columns and rows with the cells separated by `pipes |`. + +##### Markdown table example + +{: .table .table-bordered .table-hover} +| Table header column1 | Table header column 2 | Required/Optional/Default | +| ---------- | -------- | ------------------------- | +| `CF_HOST` | _Deprecated from v 0.0.460 and higher._ Recommend using `CF_RUNTIME_NAME` instead.
`CF_HOST` has been deprecated because the URL is not static, and any change can fail the enrichment.

The URL to the cluster with the Codefresh runtime to integrate with. If you have more than one runtime, select the runtime from the list. Codefresh displays the URL of the selected runtime cluster. | _Deprecated_ | +| `CF_RUNTIME_NAME` | The runtime to use for the integration. If you have more than one runtime, select the runtime from the list. | Required | + +##### Add HTML lists or inline images in tables +Markdown does not support bulleted or numbered lists in tables, which is at times a serious limitation. +As a workaround, you can add HTML-formatted bulleted or numbered lists by enclosing them in {::nomarkdown} and {:/} tags. + + +{{site.data.callout.callout_warning}} +**IMPORTANT** +When you HTML syntax, remember to use HTML tags for text within the section. For example, instead of **. +Code samples or code must be enclosed in tags. For example, CF_RUNTIME_NAME instead of `CF_RUNTIME_NAME`. +{{site.data.callout.end}} + +Here's an example of HTML unordered lists within a markdown table. + +| `CF_CONTAINER_REGISTRY_INTEGRATION` | The name of the container registry integration created in Codefresh where the image is stored to reference in the CI pipeline. See [Container registry integrations]({{site.baseurl}}/docs/gitops-integrations/container-registries/).
Alternatively, you can use _one_ of these container registries with explicit credentials:{::nomarkdown}
  • DockerHub registry with CF_DOCKERHUB_USERNAME and CF_DOCKERHUB_PASSWORD.
  • Docker Registry Protocol v2 with CF_REGISTRY_DOMAIN, CF_REGISTRY_USERNAME, and CF_REGISTRY_PASSWORD.
  • Google Artifact Registry (GAR) with CF_GOOGLE_JSON_KEY and CF_GOOGLE_REGISTRY_HOST.
{:/}| Optional | + +##### Inline icons in HTML format +|**Cluster** | The local, and managed clusters if any, for the Runtime. {::nomarkdown}
  • + +### HTML tables +If you have a complex table for which you want to control the cell/column width, and merge cells vertically or horizontally, you can format the entire table in HTML format. + +{::nomarkdown} + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    CLASSIC > NEW
    AVATAR>Account SettingsMoved to Settings icon in toolbar
    User ManagementMoved to Settings icon in toolbar
    BillingMoved to Settings icon in toolbar
    User SettingsNo change
    Git Personal Access TokenNew item
    + +{:/} + + +## Related articles +Related articles are sets of links pointing to articles you determine will be most useful for the user to browse or read in the current context. + +* Each article is a cross-reference to an article within the same docsite, or very rarely to an external site. +* Each article is on a separate line, created by adding two spaces or the
    tag at the end of the link. +* If one or more links are conditional to either Enterprise or GitOps Cloud, move them to the end of the set. This is because of a limitation of Jekyll that adds an empty

    tag. + + +### Example of related articles +[Configure Product Settings]({{site.baseurl}}/docs/products/configure-product-settings/) +[Assigning applications to Products]({{site.baseurl}}/docs/products/assign-applications/) +[Assigning Promotion Flows and triggers to products]({{site.baseurl}}/docs/products/promotion-flow-triggers/) +[Tracking Product releases]({{site.baseurl}}/docs/promotions/product-releases/) + +### Example of related articles with conditions + +[Access control for GitOps]({{site.baseurl}}/docs/administration/account-user-management/gitops-abac/) +{% if page.collection != site.gitops_collection %} +[Setting up OAuth authentication for Git providers]({{site.baseurl}}/docs/administration/account-user-management/oauth-setup) +[Access control for pipelines]({{site.baseurl}}/docs/administration/account-user-management/access-control-pipelines/) +{% endif %} + + + + diff --git a/_docs/deployments/helm/helm-environment-promotion.md b/_docs/deployments/helm/helm-environment-promotion.md index b080acd82..397e96791 100644 --- a/_docs/deployments/helm/helm-environment-promotion.md +++ b/_docs/deployments/helm/helm-environment-promotion.md @@ -200,7 +200,7 @@ By default Codefresh will use a built-in install/upgrade pipeline for performing Note that the variable `CF_HELM_CHART_JSON_GZIP` is both compressed and base64 encoded. To get the raw value you need a command like `echo $CF_HELM_CHART_JSON_GZIP | base64 -d | gunzip` >**NOTE** -Only [Codefresh admin users]({{site.baseurl}}/docs/administration/account-user-management/access-control/#users-and-administrators) can override the default pipeline. +Only [Codefresh admin users]({{site.baseurl}}/docs/administration/account-user-management/access-control-pipelines/#users-and-administrators) can override the default pipeline. Once you click the *update* button, a new build will run that will perform the deployment. diff --git a/_docs/deployments/helm/helm-releases-management.md b/_docs/deployments/helm/helm-releases-management.md index a38e55879..d25749b27 100644 --- a/_docs/deployments/helm/helm-releases-management.md +++ b/_docs/deployments/helm/helm-releases-management.md @@ -212,7 +212,7 @@ By default, when you take an action in the UI, Codefresh executes the native Hel You can override these actions for a specific Helm release by defining custom pipelines for each action. This way you can add your extra logic on top of these actions. For example your own Helm uninstall pipeline might also have a notification step that posts a message to a Slack channel after a release is removed. >**NOTE** -Only [Codefresh admin users]({{site.baseurl}}/docs/administration/account-user-management/access-control/#users-and-administrators) can override the default pipelines defined for a Helm release. +Only [Codefresh admin users]({{site.baseurl}}/docs/administration/account-user-management/access-control-pipelines/#users-and-administrators) can override the default pipelines defined for a Helm release. 1. In the Codefresh UI, from the DevOps Insights section in the sidebar, select [**Helm Releases**](https://g.codefresh.io/helm/releases/releasesNew/){:target="\_blank"}. 1. In the row with the Helm release for which to override default actions, click the **Settings** (gear) icon. diff --git a/_docs/installation/installation-options/on-premises/on-prem-configuration.md b/_docs/installation/installation-options/on-premises/on-prem-configuration.md index 2cd06c483..b5bc66256 100644 --- a/_docs/installation/installation-options/on-premises/on-prem-configuration.md +++ b/_docs/installation/installation-options/on-premises/on-prem-configuration.md @@ -307,7 +307,7 @@ Settings that are _not_ described in this table are not applicable to on-premise |**Collaborators** | The number of users permitted for this account. A Collaborator is a Codefresh user who can access the UI. If you keep the count as one, Codefresh displays an error that you have reached the user limit and prevents you from inviting additional users. | |**Runtime environments** | Optional. The System Runtime Environments to select for this account. The System Runtime Environments are global Runtime Environments predefined by Codefresh. | |**Codefresh environments** |Optional. For Windows environments, the Codefresh environment to select for the Windows nodes. | -|**Actions** | The actions available for the account, displayed by clicking the context menu to the right of the account:{::nomarkdown}

    • Audit by account: Takes you to the Audit page.
      See Auditing actions in Codefresh.
    • Invite user to account: Opens the popup where you can specify the email of the user to invite to the account. To add the admin role for this user, select Set the user as admin to this account.
    • Assign new feature: Displays the list of features where you can enable/disable specific features for this account.
      See On-premises feature list.
    • Show account domains: Restrict user invitations to specific email domains. Clicking Add Domain lets you add the email domains to allow.
      See also Define session timeouts and domain restrictions for user accounts.
      • {:/}| +|**Actions** | The actions available for the account, displayed by clicking the context menu to the right of the account:{::nomarkdown}
      • Audit by account: Takes you to the Audit page.
        See Auditing actions in Codefresh.
      • Invite user to account: Opens the popup where you can specify the email of the user to invite to the account. To add the admin role for this user, select Set the user as admin to this account.
      • Assign new feature: Displays the list of features where you can enable/disable specific features for this account.
        See On-premises feature list.
      • Show account domains: Restrict user invitations to specific email domains. Clicking Add Domain lets you add the email domains to allow.
        See also Define session timeouts and domain restrictions for user accounts.
        • {:/}| diff --git a/_docs/installation/installation-options/on-premises/on-prem-feature-management.md b/_docs/installation/installation-options/on-premises/on-prem-feature-management.md index 9af7684eb..61fe7678e 100644 --- a/_docs/installation/installation-options/on-premises/on-prem-feature-management.md +++ b/_docs/installation/installation-options/on-premises/on-prem-feature-management.md @@ -66,7 +66,7 @@ The table describes in alphabetical order, the features you can open for Codefre | Feature | Description | Default | Notes | | -------------- | -------------- | ------- | ------- | | `appDiffView` |When enabled, and the application is out of sync, displays the differences for each resource in the application in either Compact or Split view modes.
        See [Analyze out-of-sync applications with Diff View]({{site.baseurl}}/docs/deployments/gitops/monitor-applications/#analyze-out-of-sync-applications-in-diff-view) | TRUE | | -| `abacAndRule` | When enabled, supports creating ABAC rules for entities in Codefresh pipelines using "AND".
        See [Configuring rules for access control in pipelines]({{site.baseurl}}/docs/administration/account-user-management/access-control/#rules-for-access-control).| FALSE | _Default changed to FALSE in v2.7_ | +| `abacAndRule` | When enabled, supports creating ABAC rules for entities in Codefresh pipelines using "AND".
        See [Configuring rules for access control in pipelines]({{site.baseurl}}/docs/administration/account-user-management/access-control-pipelines/#rules-for-access-control).| FALSE | _Default changed to FALSE in v2.7_ | |`abacRuntimeEnvironments` | When enabled (the default), allows creating rules in **Permissions** which impacts options in Pipeline > Settings > Build Runtime: {::nomarkdown}
        • Build Runtime Environment: When enabled, allows restricting Runtime Environments available for pipelines based on tags. Restricted Runtime Environments are disabled in the Runtime Environments list for the pipeline/build run.
        • Pipeline actions:
          • Manage resources: Select CPU, memory, and minimum disk space for the pipeline/build run.
          • Set runtime environment: Select a Runtime Environment from those available in the Runtime Environments list for the pipeline/build run.
          • Set cloud builds: Set Cloud build and select the resource size for the pipeline/build run.
        {:/}| TRUE | _Default changed to TRUE in v2.5_ | |`abacHermesTriggers` | When enabled, restricts access to the legacy version of Cron triggers for users without permissions to edit pipelines.| FALSE | | |`abacUIEnforcement` | When enabled (the default), for Pipelines, prevents the user from selecting options and performing actions which are not permitted.| TRUE | _Default changed to TRUE in v2.5_ | diff --git a/_docs/integrations/codefresh-api.md b/_docs/integrations/codefresh-api.md index 55d43d453..4971633f7 100644 --- a/_docs/integrations/codefresh-api.md +++ b/_docs/integrations/codefresh-api.md @@ -83,10 +83,10 @@ The following resources can be targeted with the API: * *Agent* - Used for [Codefresh Runner installation]({{site.baseurl}}/docs/installation/behind-the-firewall/) * *Audit* - Read [Audit logs]({{site.baseurl}}/docs/administration/account-user-management/audit/) * *Build* - Get/change [build status]({{site.baseurl}}/docs/pipelines/monitoring-pipelines/) -* *Cluster* - [Access control]({{site.baseurl}}/docs/administration/account-user-management/access-control/) for [Kubernetes clusters]({{site.baseurl}}/docs/deployments/kubernetes/manage-kubernetes/) +* *Cluster* - [Access control]({{site.baseurl}}/docs/administration/account-user-management/access-control-pipelines/) for [Kubernetes clusters]({{site.baseurl}}/docs/deployments/kubernetes/manage-kubernetes/) * *Environments-v2* - Read/Write [Environment Dashboard]({{site.baseurl}}/docs/deployments/kubernetes/environment-dashboard/) information * *GitHub Actions* - Run [GitHub Actions inside Codefresh pipelines]({{site.baseurl}}/docs/integrations/github-actions/) -* *Pipeline* - [Access control]({{site.baseurl}}/docs/administration/account-user-management/access-control/) for [pipelines]({{site.baseurl}}/docs/pipelines/introduction-to-codefresh-pipelines/) +* *Pipeline* - [Access control]({{site.baseurl}}/docs/administration/account-user-management/access-control-pipelines/) for [pipelines]({{site.baseurl}}/docs/pipelines/introduction-to-codefresh-pipelines/) * *Repos* - Refers to [Git repositories]({{site.baseurl}}/docs/integrations/git-providers/) * *Step Type* - Refers to [custom pipeline steps]({{site.baseurl}}/docs/pipelines/steps/#creating-a-typed-codefresh-plugin) @@ -292,7 +292,7 @@ Codefresh automatically generates additional fields, usually fields with dates a | `project` | `metadata` | string | the project that contains this pipeline | | `originalYamlString` | `metadata` | string | the full contents of the pipeline editor. Only kept for archival purposes | | `labels` | `metadata` | object | Holds the `tags` array | -| `tags` | `labels` | array | A list of [access control tags]({{site.baseurl}}/docs/administration/account-user-management/access-control/#marking-pipelines-with-policy-attributes) for this pipeline | +| `tags` | `labels` | array | A list of [access control tags]({{site.baseurl}}/docs/administration/account-user-management/access-control-pipelines/#marking-pipelines-with-policy-attributes) for this pipeline | | `description` | `metadata` | string | Human readable description of the pipeline | | `isPublic ` | `metadata` | boolean | If true, the pipeline logs [will be public]({{site.baseurl}}/docs/pipelines/configuration/build-status/) even for non-authenticated users | | `template ` | `metadata` | boolean | If true, this pipeline will be listed as a template when creating a new pipeline | diff --git a/_docs/integrations/git-providers.md b/_docs/integrations/git-providers.md index f8431d51b..91e931120 100644 --- a/_docs/integrations/git-providers.md +++ b/_docs/integrations/git-providers.md @@ -131,7 +131,7 @@ caption="GitHub permissions" alt="GitHub permissions" %} -For GitHub on-premises you also need to provide the URL of the GitHub server in your organization. If enabled in your account you can setup [Pipeline definition restrictions]({{site.baseurl}}/docs/administration/account-user-management/access-control/#pipeline-definition-restrictions) by expanding the *YAML Options* segment. +For GitHub on-premises you also need to provide the URL of the GitHub server in your organization. If enabled in your account you can setup [Pipeline definition restrictions]({{site.baseurl}}/docs/administration/account-user-management/access-control-pipelines/#pipeline-definition-restrictions) by expanding the *YAML Options* segment. ### Using External Secrets for GitHub Token @@ -204,7 +204,7 @@ If you need additional permission for your integration, use the Manual Creation 1. To apply your changes, click **Save**. >**NOTE** -If enabled in your account you can set up [Pipeline definition restrictions]({{site.baseurl}}/docs/administration/account-user-management/access-control/#pipeline-definition-restrictions) by expanding the *YAML Options* segment. +If enabled in your account you can set up [Pipeline definition restrictions]({{site.baseurl}}/docs/administration/account-user-management/-pipelines/#pipeline-definition-restrictions) by expanding the *YAML Options* segment. ## GitLab @@ -225,7 +225,7 @@ The name you enter in order to create the token in the GitLab UI is completely a Once you have the token, paste it in the Codefresh UI and click *Test connection*. If everything is OK can now save the Git integration. -For GitLab on-premises, you also need to provide the URL of the GitLab server in your organization. If enabled in your account you can set up [Pipeline definition restrictions]({{site.baseurl}}/docs/administration/account-user-management/access-control/#pipeline-definition-restrictions) by expanding the *YAML Options* segment. +For GitLab on-premises, you also need to provide the URL of the GitLab server in your organization. If enabled in your account you can set up [Pipeline definition restrictions]({{site.baseurl}}/docs/administration/account-user-management/access-control-pipelines/#pipeline-definition-restrictions) by expanding the *YAML Options* segment. ### Using External Secrets for GitLab Token @@ -330,7 +330,7 @@ alt="Codefresh integration with Azure Devops" Your Azure DevOps repositories will be available when [creating a new project in Codefresh]({{site.baseurl}}/docs/quick-start/ci-quick-start/create-ci-pipeline/). - If enabled in your account you can setup [Pipeline definition restrictions]({{site.baseurl}}/docs/administration/account-user-management/access-control/#pipeline-definition-restrictions) by expanding the *YAML Options* segment. + If enabled in your account you can setup [Pipeline definition restrictions]({{site.baseurl}}/docs/administration/account-user-management/access-control-pipelines/#pipeline-definition-restrictions) by expanding the *YAML Options* segment. ## Atlassian Stash diff --git a/_docs/integrations/helm.md b/_docs/integrations/helm.md index ec71b09e3..49f8627ff 100644 --- a/_docs/integrations/helm.md +++ b/_docs/integrations/helm.md @@ -18,7 +18,7 @@ Native support for Helm in Codefresh includes: The built-in Helm repository is production ready. You can start using Helm right away with your Codefresh account, even if you don't have an external Helm repository. See our [quick start guide for Helm]({{site.baseurl}}/docs/quick-start/ci-quick-start/deploy-with-helm/) or the [complete Helm example]({{site.baseurl}}/docs/example-catalog/cd-examples/helm/). -For each Helm integration, you can toggle the level of access for [non-admin users]({{site.baseurl}}/docs/administration/account-user-management/access-control/#users-and-administrators). +For each Helm integration, you can toggle the level of access for [non-admin users]({{site.baseurl}}/docs/administration/account-user-management/access-control-pipelines/#users-and-administrators). {{site.data.callout.callout_warning}} **IMPORTANT** diff --git a/_docs/kb/articles/automating-shared-secrets-creation.md b/_docs/kb/articles/automating-shared-secrets-creation.md index 3309619ac..70926ecbb 100644 --- a/_docs/kb/articles/automating-shared-secrets-creation.md +++ b/_docs/kb/articles/automating-shared-secrets-creation.md @@ -58,5 +58,5 @@ echo "$CMD" ## Related articles [Secrets in pipelines]({{site.baseurl}}/docs/pipelines/configuration/secrets-store/) -[Configuring access control for pipelines]({{site.baseurl}}/docs/administration/account-user-management/access-control/) +[Access control for pipelines]({{site.baseurl}}/docs/administration/account-user-management/access-control-pipelines/) [Pipeline execution context]({{site.baseurl}}/docs/administration/account-user-management/pipeline-execution-context/) diff --git a/_docs/pipelines/configuration/shared-configuration.md b/_docs/pipelines/configuration/shared-configuration.md index 0123d99ca..d6087ab06 100644 --- a/_docs/pipelines/configuration/shared-configuration.md +++ b/_docs/pipelines/configuration/shared-configuration.md @@ -76,7 +76,7 @@ If you didn't include a resource name during secret creation then enter the full ### Level of access -For each set of values you can toggle the level of access by [non-admin users]({{site.baseurl}}/docs/administration/access-control/#users-and-administrators). If it is off, users will **not** be able to use the [CLI](https://codefresh-io.github.io/cli/) or [API]({{site.baseurl}}/docs/integrations/codefresh-api/) +For each set of values you can toggle the level of access by [non-admin users]({{site.baseurl}}/docs/administration/access-control-pipelines/#users-and-administrators). If it is off, users will **not** be able to use the [CLI](https://codefresh-io.github.io/cli/) or [API]({{site.baseurl}}/docs/integrations/codefresh-api/) to access these [values](https://codefresh-io.github.io/cli/contexts/). If it is on, all users from all your Codefresh teams will be able to access this set of values with CLI commands or API calls. diff --git a/_docs/pipelines/pipelines.md b/_docs/pipelines/pipelines.md index 8c0b15848..fb8079692 100644 --- a/_docs/pipelines/pipelines.md +++ b/_docs/pipelines/pipelines.md @@ -55,7 +55,7 @@ Of course, you can also have a simpler scenario where the trigger, the pipeline ## Creating a pipeline -You can create new projects by clicking on *Projects* in the left sidebar and then selecting the *New Project* button on the top right corner. A dialog will appear that will ask you for the project name and optional tags that you can use for [access control]({{site.baseurl}}/docs/administration/account-user-management/access-control/). +You can create new projects by clicking on *Projects* in the left sidebar and then selecting the *New Project* button on the top right corner. A dialog will appear that will ask you for the project name and optional tags that you can use for [access control]({{site.baseurl}}/docs/administration/account-user-management/access-control-pipelines/). >**NOTE** @@ -206,7 +206,7 @@ Once you create your pipeline you can also click on the top tab called *Settings {{site.data.callout.end}} - **Pipeline Description**: Free text description of the pipeline. -- **Pipeline Tags**: One or more tags used for [access control]({{site.baseurl}}/docs/administration/account-user-management/access-control/) +- **Pipeline Tags**: One or more tags used for [access control]({{site.baseurl}}/docs/administration/account-user-management/access-control-pipelines/) - **Public Build Logs**: If enabled, [users without a Codefresh account]({{site.baseurl}}/docs/pipelines/configuration/build-status/#public-build-logs) can view the builds of this pipeline. - **Template**: Convert this pipeline to a template (see the next section for details on templates). - **Badges**: Simple images that show you the last [build status]({{site.baseurl}}/docs/pipelines/configuration/build-status/). @@ -267,7 +267,7 @@ Codefresh authenticates the credentials of each cluster during the build initial The option to select clusters for a pipeline is available only when the account-level pipeline setting is enabled. See [Enabling cluster contexts for pipelines]({{site.baseurl}}/docs/pipelines/configuration/pipeline-settings/#enabling-cluster-contexts-for-pipelines). * **Update Cluster** permission for users in the Codefresh UI through [Permissions](https://g.codefresh.io/account-admin/permissions/teams){:target="\_blank"}. - For more information, see [Access Control]({{site.baseurl}}/docs/administration/account-user-management/access-control/#access-to-kubernetes-clusters-and-pipelines). + For more information, see [Access Control]({{site.baseurl}}/docs/administration/account-user-management/access-control-pipelines/#access-to-kubernetes-clusters-and-pipelines). As part of the Pipeline > Policies, you can either allow access to all clusters (the default), or only specific clusters as in the example below. diff --git a/_docs/pipelines/steps/approval.md b/_docs/pipelines/steps/approval.md index 40770da2f..5e1db748e 100644 --- a/_docs/pipelines/steps/approval.md +++ b/_docs/pipelines/steps/approval.md @@ -103,7 +103,7 @@ the approval step will be automatically rejected. ## Approval Restrictions By default, any Codefresh user can approve any pipeline that is paused at the approval state. If you want to restrict -the approval action to a subset of people, you can use the [access control capabilities]({{site.baseurl}}/docs/administration/account-user-management/access-control/) that Codefresh provides. +the approval action to a subset of people, you can use the [access control capabilities]({{site.baseurl}}/docs/administration/account-user-management/access-control-pipelines/) that Codefresh provides. This is a two-step process. First you need to tag your pipeline with one or more tags (tag names are arbitrary). You can edit tags in the pipeline settings screen. diff --git a/_docs/whats-new/on-prem-release-notes.md b/_docs/whats-new/on-prem-release-notes.md index d037c2757..6185081fc 100644 --- a/_docs/whats-new/on-prem-release-notes.md +++ b/_docs/whats-new/on-prem-release-notes.md @@ -615,7 +615,7 @@ caption="Rules for runtime environments and resources in pipelines" max-width="60%" %} -For details, see [Assign tags to Pipeline Runtimes]({{site.baseurl}}/docs/administration/account-user-management/access-control/#assign-tags-to-pipeline-runtimes) and [Creating rules for Pipeline Runtimes and runtime environments]({{site.baseurl}}/docs/administration/account-user-management/access-control/#creating-rules-for-pipeline-runtimes-and-runtime-environments). +For details, see [Assign tags to Pipeline Runtimes]({{site.baseurl}}/docs/administration/account-user-management/access-control-pipelines/#assign-tags-to-pipeline-runtimes) and [Creating rules for Pipeline Runtimes and runtime environments]({{site.baseurl}}/docs/administration/account-user-management/access-control-pipelines/#creating-rules-for-pipeline-runtimes-and-runtime-environments). #### Pipelines: Dedicated environment variables for pull request titles @@ -1456,7 +1456,7 @@ caption="Rules with OR/AND logic for tags" max-width="40%" %} -For details, see [ABAC for entities with tags and rules]({{site.baseurl}}/docs/administration/account-user-management/access-control/#abac-for-entities-with-tags-and-rules). +For details, see [ABAC for entities with tags and rules]({{site.baseurl}}/docs/administration/account-user-management/access-control-pipelines/#abac-for-entities-with-tags-and-rules).
        diff --git a/_gitops/administration/account-user-management/access-control-user-accounts.md b/_gitops/administration/account-user-management/access-control-user-accounts.md new file mode 120000 index 000000000..c5ca817a5 --- /dev/null +++ b/_gitops/administration/account-user-management/access-control-user-accounts.md @@ -0,0 +1 @@ +../../../_docs/administration/account-user-management/access-control-user-accounts.md \ No newline at end of file diff --git a/_gitops/administration/account-user-management/add-users-teams.md b/_gitops/administration/account-user-management/add-users-teams.md new file mode 120000 index 000000000..b8ac5618a --- /dev/null +++ b/_gitops/administration/account-user-management/add-users-teams.md @@ -0,0 +1 @@ +../../../_docs/administration/account-user-management/add-users-teams.md \ No newline at end of file diff --git a/_gitops/administration/account-user-management/add-users.md b/_gitops/administration/account-user-management/add-users.md deleted file mode 120000 index f0145733b..000000000 --- a/_gitops/administration/account-user-management/add-users.md +++ /dev/null @@ -1 +0,0 @@ -../../../_docs/administration/account-user-management/add-users.md \ No newline at end of file diff --git a/_posts/2024-07-29-july-release-notes.md b/_posts/2024-07-29-july-release-notes.md index fdea33e6e..6550d5526 100644 --- a/_posts/2024-07-29-july-release-notes.md +++ b/_posts/2024-07-29-july-release-notes.md @@ -42,7 +42,7 @@ caption="Rules for runtime environments and resources in pipelines" max-width="60%" %} -For details, see [Assign tags to Pipeline Runtimes]({{site.baseurl}}/docs/administration/account-user-management/access-control/#assign-tags-to-pipeline-runtimes) and [Creating rules for Pipeline Runtimes and runtime environments]({{site.baseurl}}/docs/administration/account-user-management/access-control/#creating-rules-for-pipeline-runtimes-and-runtime-environments). +For details, see [Assign tags to Pipeline Runtimes]({{site.baseurl}}/docs/administration/account-user-management/access-control-pipelines/#assign-tags-to-pipeline-runtimes) and [Creating rules for Pipeline Runtimes and runtime environments]({{site.baseurl}}/docs/administration/account-user-management/access-control-pipelines/#creating-rules-for-pipeline-runtimes-and-runtime-environments). ### GitOps: Runtime upgrade diff --git a/assets/js/src/argohub-redirect-mapping.json b/assets/js/src/argohub-redirect-mapping.json index 482c85d7a..bd39e04c0 100644 --- a/assets/js/src/argohub-redirect-mapping.json +++ b/assets/js/src/argohub-redirect-mapping.json @@ -3,7 +3,7 @@ "/docs/installation/gitops/shared-configuration/": "/gitops/gitops-runtimes/shared-configuration/", "/docs/security/git-tokens/": "/gitops/security/git-tokens/", "/docs/security/secrets/": "/gitops/security/secrets/", - "/docs/administration/account-user-management/add-users/": "/gitops/administration/account-user-management/add-users/", + "/docs/administration/account-user-management/add-users-teams/": "/gitops/administration/account-user-management/add-users-teams/", "/docs/administration/account-user-management/create-codefresh-account/": "/gitops/administration/account-user-management/create-codefresh-account/", "/docs/administration/account-user-management/gitops-abac/": "/gitops/administration/account-user-management/gitops-abac/", "/docs/administration/account-user-management/hosted-authorize-orgs/": "/gitops/administration/account-user-management/hosted-authorize-orgs/", @@ -118,5 +118,6 @@ "/docs/installation/gitops/runtime-install-ingress-service-mesh-access-mode/": "/gitops/gitops-runtimes/runtime-install-ingress-service-mesh-access-mode/", "/docs/promotions/getting-started/": "/gitops/promotions/getting-started/", "/docs/installation/gitops/runtime-troubleshooting/": "/gitops/gitops-runtimes/runtime-troubleshooting/", - "/docs/products/promotion-concurrency/": "/gitops/products/promotion-concurrency/" + "/docs/products/promotion-concurrency/": "/gitops/products/promotion-concurrency/", + "/docs/administration/account-user-management/access-control-user-accounts/": "/gitops/administration/account-user-management/access-control-user-accounts/" } diff --git a/images/administration/access-control/pat.png b/images/administration/access-control/pat.png deleted file mode 100644 index 17a9baf94..000000000 Binary files a/images/administration/access-control/pat.png and /dev/null differ diff --git a/images/administration/access-control/security-timeout.png b/images/administration/access-control/security-timeout.png index eb4bc977a..de027658c 100644 Binary files a/images/administration/access-control/security-timeout.png and b/images/administration/access-control/security-timeout.png differ diff --git a/images/administration/access-control/teams.png b/images/administration/access-control/teams.png deleted file mode 100644 index 58f7c2c85..000000000 Binary files a/images/administration/access-control/teams.png and /dev/null differ diff --git a/images/administration/access-control/user-access-control.png b/images/administration/access-control/user-access-control.png deleted file mode 100644 index 954101752..000000000 Binary files a/images/administration/access-control/user-access-control.png and /dev/null differ