Skip to main content
logoTetrate Service BridgeVersion: next

Configuring Permissions

Before you get started, make sure you:
✓ Familiarize yourself with TSB concepts
✓ Install the TSB demo environment
✓ Deploy the Istio Bookinfo sample app
✓ Create a Tenant
✓ Create a Workspace
✓ Create Config Groups

In this scenario, you will use the different AccessBindings to configure two access policies:

  • A policy that grants a team full access to a Workspace. The members of the team will be able to create and fully manage the resources in that Workspace, but won't be able to modify the Workspace object itself. This is achieved by using the Creator role.
  • A policy that grants a specific user write permissions to a Group. The user will be able to modify the settings for that group and its contained configuration objects but won't be able to create new resources or delete the existing ones. This is achieved by using the Writer role.

Using the UI​

  • Under Tenant on the left panel, select Workspaces.
  • Click the desired Workspace to access its details page.
  • Click the Permissions tab.
  • To see the list of teams, select the By Teams option.
  • The list of existing teams will appear.
  • Scroll to the desired one and click the Edit icon on the right.
  • Select the Creator role.
  • Click the Save Changes button at the bottom right.

To grant write permissions to a user to a specific config group, repeat the same process for the Group:

  • Navigate to the Group's Permissions tab.
  • Use the By Users view to find the desired User.
  • Click the Edit icon and select the Writer role.
  • Click the Save Changes button at the bottom right

Using tctl​

Create the following access-policy.yaml file with the AccessBindings for both Workspace and Traffic Group objects:

apiVersion: rbac.tsb.tetrate.io/v2
kind: AccessBindings
metadata:
  fqn: organizations/tetrate/tenants/tetrate/workspaces/bookinfo-ws
spec:
  allow:
    - role: rbac/creator
      subjects:
        # Change the name of the team to the desired one
        - team: organizations/tetrate/teams/Platform
---
apiVersion: rbac.tsb.tetrate.io/v2
kind: AccessBindings
metadata:
  fqn: organizations/tetrate/tenants/tetrate/workspaces/bookinfo-ws/trafficgroups/bookinfo-traffic
spec:
  allow:
    - role: rbac/writer
      subjects:
        # Change the name of the user to the desired one
        - user: organizations/tetrate/users/zack

Apply with tctl:

tctl apply -f access-policy.yaml