You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
before you start server, you need to set env to set your root account password. Please note that password must conform to the [following set of rules](https://github.com/apache/servicecomb-service-center/blob/63722fadd511c26285e787eb2b4be516eab10b94/pkg/validate/matcher.go#L25): have at least 8 characters, have at most 32 characters, have at least one upper alpha, have at least one lower alpha, have at least one digit and have at lease one special character.
26
+
before you start server, you need to set env to set your root account password.
27
+
Please note that password must conform to the
28
+
[following set of rules](https://github.com/apache/servicecomb-service-center/blob/63722fadd511c26285e787eb2b4be516eab10b94/pkg/validate/matcher.go#L25):
29
+
have at least 8 characters, have at most 32 characters, have at least one upper alpha, have at least one lower alpha,
30
+
have at least one digit and have at lease one special character.
25
31
26
32
```sh
27
33
export SC_INIT_ROOT_PASSWORD='P4$$word'
28
34
```
29
-
at the first time service center cluster init, it will use this password to setup rbac module.
30
-
you can revoke password by rest API after cluster started. but you can not use this env to revoke password after cluster started.
35
+
At the first time service center cluster init, it will use this password to set up rbac module.
36
+
you can revoke password by rest API after a cluster started. but you can not use **SC_INIT_ROOT_PASSWORD**to revoke password after a cluster started.
31
37
32
-
the root account name is "root"
38
+
the initiated account name is fixed as "root"
33
39
34
40
To securely distribute your root account and private key,
35
41
you can use kubernetes [secret](https://kubernetes.io/zh/docs/tasks/inject-data-application/distribute-credentials-secure/)
36
42
### Generate a token
37
-
token is the only credential to access rest API, before you access any API, you need to get a token
43
+
Token is the only credential to access rest API, before you access any API, you need to get a token from service center
You must supply current password and token to update to new password
68
+
You must supply a current password and token to update to new password
63
69
```shell script
64
70
curl -X POST \
65
71
http://127.0.0.1:30100/v4/account/root/password \
66
72
-H 'Authorization: Bearer {your_token}' \
67
73
-d '{
68
74
"currentPassword":"P4$$word",
69
-
"password":"123"
75
+
"password":"P4$$word1"
70
76
}'
71
77
```
72
78
73
79
### create a new account
74
-
You can create new account named "peter", now peter has no any roles, also has no permission to operate resources. How to add roles and allocate resources please refer to next.
80
+
You can create new account named "peter", and his role is developer.
81
+
How to add roles and allocate resources please refer to next section.
75
82
```shell script
76
83
curl -X POST \
77
84
http://127.0.0.1:30100/v4/account \
@@ -80,32 +87,131 @@ curl -X POST \
80
87
-H 'Content-Type: application/json' \
81
88
-d '{
82
89
"name":"peter",
83
-
"password":"{strong_password}"
90
+
"roles":["developer"],
91
+
"password":"{strong_password}"
84
92
}'
85
93
```
86
-
### Roles
87
-
Currently, two default roles are provided. You can also add new roles and assign resources.
88
94
89
-
### API and resources
90
-
All APIs of the system are divided according to their attributes. For example, resource account has the permission to create or update or delete user account when assign the corresponding permissions, resource service has all permission to create, get, add or delete microservices when permissions equal to "*". For more details to see [here](https://github.com/apache/servicecomb-service-center/blob/master/server/service/rbac/resource.go).
91
-
A new role named "tester" owns resources "service", "instance" and "rule".
92
-
```json
95
+
### Resource
96
+
All APIs of the ServiceComb system is mapping to a **resource type**. resource is list as below:
97
+
- service: permission to discover, register service and instance
98
+
- governance: permission to manage traffic control policy, such as rate limiting
99
+
- service/schema: permission to register and discover contract
100
+
- account: permission to manage accounts
101
+
- role: permission to manage roles
102
+
- ops: permission to access admin API
103
+
104
+
declare a resource type that account can operate:
105
+
```json
106
+
{
107
+
"resources": [
108
+
{
109
+
"type": "service"
110
+
},
111
+
{
112
+
"type": "service/schema"
113
+
}
114
+
]
115
+
}
116
+
```
117
+
### Label
118
+
Define resource(only service resource) scope:
119
+
- serviceName: specify service name
120
+
- appId: specify which app that services belongs to
121
+
- environment: specify env of the service
122
+
123
+
```json
124
+
{
125
+
"resources": [
126
+
{
127
+
"type": "service",
128
+
"labels": {
129
+
"serviceName": "order-service",
130
+
"environment": "production"
131
+
}
132
+
},
133
+
{
134
+
"type": "service",
135
+
"labels": {
136
+
"serviceName": "order-service",
137
+
"environment": "acceptance"
138
+
}
139
+
}
140
+
]
141
+
}
142
+
```
143
+
### Verbs
144
+
Define what kind of action could be applied to a resource by an account, has 4 kinds:
145
+
- get
146
+
- delete
147
+
- create
148
+
- update
149
+
150
+
declare resource type and action:
151
+
```json
93
152
{
94
-
"name": "tester",
95
-
"perms": [
96
-
{
97
-
"resources": ["service","instance"],
98
-
"verbs": ["get", "create", "update"]
99
-
},
100
-
{
101
-
"resources": ["rule"],
102
-
"verbs": ["get"]
103
-
}
104
-
]
153
+
"resources": [
154
+
{
155
+
"type": "service"
156
+
},
157
+
{
158
+
"type": "account"
159
+
}
160
+
],
161
+
"verbs": [
162
+
"get"
163
+
]
105
164
}
106
165
```
107
166
167
+
### Roles
168
+
Two default roles are provided after RBAC init:
169
+
- admin: can operate account and role resource
170
+
- developer: can operate any resource except account and role resource
171
+
172
+
each role include perms elements to indicates what kind of resource can be operated by this role, for example:
173
+
174
+
A role "TeamA" can get and create any services but can only delete or update "order-service"
175
+
```json
176
+
{
177
+
"name": "TeamA",
178
+
"perms": [
179
+
{
180
+
"resources": [
181
+
{
182
+
"type": "service"
183
+
}
184
+
],
185
+
"verbs": [
186
+
"get",
187
+
"create"
188
+
]
189
+
},
190
+
{
191
+
"resources": [
192
+
{
193
+
"type": "service",
194
+
"labels": {
195
+
"serviceName": "order-service"
196
+
}
197
+
}
198
+
],
199
+
"verbs": [
200
+
"update",
201
+
"delete"
202
+
]
203
+
}
204
+
]
205
+
}
206
+
```
207
+
208
+
209
+
210
+
108
211
### create new role and how to use
212
+
213
+
You can also create a new role and give perms to this role.
214
+
109
215
1. You can add new role and allocate resources to new role. For example, a new role named "tester" and allocate resources to "tester".
110
216
```shell script
111
217
curl -X POST \
@@ -114,17 +220,34 @@ curl -X POST \
114
220
-H 'Authorization: Bearer {your_token}' \
115
221
-H 'Content-Type: application/json' \
116
222
-d '{
117
-
"name": "tester",
118
-
"perms": [
119
-
{
120
-
"resources": ["service","instance"],
121
-
"verbs": ["get", "create", "update"]
122
-
},
123
-
{
124
-
"resources": ["rule"],
125
-
"verbs": ["get"]
126
-
}
127
-
]
223
+
"name": "TeamA",
224
+
"perms": [
225
+
{
226
+
"resources": [
227
+
{
228
+
"type": "service"
229
+
}
230
+
],
231
+
"verbs": [
232
+
"get",
233
+
"create"
234
+
]
235
+
},
236
+
{
237
+
"resources": [
238
+
{
239
+
"type": "service",
240
+
"labels": {
241
+
"serviceName": "order-service"
242
+
}
243
+
}
244
+
],
245
+
"verbs": [
246
+
"update",
247
+
"delete"
248
+
]
249
+
}
250
+
]
128
251
}'
129
252
```
130
253
2.then, assigning roles "tester" and "tester2" to user account "peter", "tester2" is a empty role has not any resources.
@@ -137,7 +260,7 @@ curl -X POST \
137
260
-d '{
138
261
"name":"peter",
139
262
"password":"{strong_password}",
140
-
"roles": ["tester", "tester2"]
263
+
"roles": ["TeamA"]
141
264
}'
142
265
```
143
266
@@ -151,7 +274,7 @@ curl -X POST \
151
274
}'
152
275
```
153
276
154
-
4.finally, user "peter" carry token to access the above allocated API resources would be permit, but access others API is not allowed.
277
+
4.finally, user "peter" carry token to access resources.
0 commit comments