From e9cd784732b2974b07d95474e2f5f81c0803357d Mon Sep 17 00:00:00 2001 From: Jim Galasyn Date: Thu, 10 Aug 2017 14:37:32 -0700 Subject: [PATCH] Update rbac diagrams (#214) * Update rbac diagrams * Add Liquid tags to images --- .../admin/manage-users/grant-permissions.md | 8 +++-- .../isolate-nodes-between-teams.md | 10 +++--- .../isolate-volumes-between-teams.md | 10 +++--- .../manage-access-with-collections.md | 7 +++- .../admin/manage-users/permission-levels.md | 2 +- .../2.2/guides/images/collections-diagram.svg | 2 +- .../images/containers-and-nodes-diagram.svg | 2 +- .../guides/images/isolate-nodes-diagram.svg | 2 +- .../guides/images/isolate-volumes-diagram.svg | 2 +- .../2.2/guides/images/team-grant-diagram.svg | 32 ++++++++++++++++++- 10 files changed, 58 insertions(+), 19 deletions(-) diff --git a/datacenter/ucp/2.2/guides/admin/manage-users/grant-permissions.md b/datacenter/ucp/2.2/guides/admin/manage-users/grant-permissions.md index 192a53dbd6..79ea827bd4 100644 --- a/datacenter/ucp/2.2/guides/admin/manage-users/grant-permissions.md +++ b/datacenter/ucp/2.2/guides/admin/manage-users/grant-permissions.md @@ -13,7 +13,7 @@ to a set of resources (collection). Each grant is a 1:1:1 mapping of subject, role, collection. For example, you can grant the "Prod Team" "Restricted Control" permissions for the "/Production" collection. -![](../../images/ucp-grant-model.png) +![](../../images/ucp-grant-model.png){: .with-border} The usual workflow for creating grants has four steps. @@ -38,4 +38,8 @@ grants. Administrators create grants on the **Manage Grants** page. By default, all new users are placed in the `docker-datacenter` organization. If you want to apply a grant to all UCP users, create a grant with the -`docker-datacenter` org as a subject. \ No newline at end of file +`docker-datacenter` org as a subject. + +## Where to go next + +- [Isolate volumes between two different teams](isolate-volumes-between-teams.md) \ No newline at end of file diff --git a/datacenter/ucp/2.2/guides/admin/manage-users/isolate-nodes-between-teams.md b/datacenter/ucp/2.2/guides/admin/manage-users/isolate-nodes-between-teams.md index 6a72223642..23f495f810 100644 --- a/datacenter/ucp/2.2/guides/admin/manage-users/isolate-nodes-between-teams.md +++ b/datacenter/ucp/2.2/guides/admin/manage-users/isolate-nodes-between-teams.md @@ -21,7 +21,7 @@ complete this example. 3. Assign a worker node to the `/Prod` collection. 4. Grant the `Ops` teams access to its collection. -![](../../images/isolate-nodes-diagram.svg) +![](../../images/isolate-nodes-diagram.svg){: .with-border} ## Create a team @@ -78,7 +78,7 @@ Move a worker node by changing the value of its access label key, > **Nodes must be in either the shared or system collection without an advanced license.** > [Get a Docker EE Advanced license](https://www.docker.com/pricing). -![](../../images/isolate-nodes-1.png) +![](../../images/isolate-nodes-1.png){: .with-border} ## Grant access for a team @@ -116,7 +116,7 @@ The same steps apply for the nodes in the `/Prod` collection. 7. Click **Create** to grant the Ops team `Scheduler` access to the nodes in the `/Prod` collection. -![](../../images/isolate-nodes-2.png) +![](../../images/isolate-nodes-2.png){: .with-border} ## Deploy a service as a team member @@ -149,13 +149,13 @@ All resources are deployed under the user's default collection, 4. Click the **NGINX** container, and in the details pane, confirm that its **Collection** is **/Prod/Webserver**. - ![](../../images/isolate-nodes-3.png) + ![](../../images/isolate-nodes-3.png){: .with-border} 5. Click **Inspect Resource**, and in the dropdown, select **Nodes**. 6. Click the node, and in the details pane, confirm that its **Collection** is **/Prod**. - ![](../../images/isolate-nodes-4.png) + ![](../../images/isolate-nodes-4.png){: .with-border} ## Alternative: Use a grant instead of the default collection diff --git a/datacenter/ucp/2.2/guides/admin/manage-users/isolate-volumes-between-teams.md b/datacenter/ucp/2.2/guides/admin/manage-users/isolate-volumes-between-teams.md index 0277301298..37f8d556eb 100644 --- a/datacenter/ucp/2.2/guides/admin/manage-users/isolate-volumes-between-teams.md +++ b/datacenter/ucp/2.2/guides/admin/manage-users/isolate-volumes-between-teams.md @@ -14,7 +14,7 @@ nodes. 3. Create grants to manage access to the collections. 4. Team members create volumes that are specific to their team. -![](../../images/isolate-volumes-diagram.svg) +![](../../images/isolate-volumes-diagram.svg){: .with-border} ## Create two teams @@ -57,7 +57,7 @@ with the `/Shared/prod-volumes` collection. 6. Click **Create Grant** and repeat the previous steps for the **/Shared/prod-volumes** collection and the Prod team. -![](../../images/isolate-volumes-1.png) +![](../../images/isolate-volumes-1.png){: .with-border} With the collections and grants in place, users can sign in and create volumes in their assigned collections. @@ -78,18 +78,18 @@ Team members have permission to create volumes in their assigned collection. to create a "prod-data" volume assigned to the `/Shared/prod-volumes` collection. -![](../../images/isolate-volumes-2.png) +![](../../images/isolate-volumes-2.png){: .with-border} Now you can see role-based access control in action for volumes. The user on the Prod team can't see the Dev team's volumes, and if you log in again as a user on the Dev team, you won't see the Prod team's volumes. -![](../../images/isolate-volumes-3.png) +![](../../images/isolate-volumes-3.png){: .with-border} Sign in with a UCP administrator account, and you see all of the volumes created by the Dev and Prod users. -![](../../images/isolate-volumes-4.png) +![](../../images/isolate-volumes-4.png){: .with-border} ## Where to go next diff --git a/datacenter/ucp/2.2/guides/admin/manage-users/manage-access-with-collections.md b/datacenter/ucp/2.2/guides/admin/manage-users/manage-access-with-collections.md index a090a0541a..8fff16194b 100644 --- a/datacenter/ucp/2.2/guides/admin/manage-users/manage-access-with-collections.md +++ b/datacenter/ucp/2.2/guides/admin/manage-users/manage-access-with-collections.md @@ -53,7 +53,12 @@ UCP provides a number of built-in collections. - `/Shared/Legacy` - After updating from UCP 2.1, all legacy access control labels are stored here. -![](../../images/collections-diagram.svg) +![](../../images/collections-diagram.svg){: .with-border} + +This diagram shows the `/System` and `/Shared` collections that are created +by UCP. User private collections are children of the `/Shared/private` +collection. Also, an admin user has created a `/prod` collection and its +`/webserver` child collection. ## Default collections diff --git a/datacenter/ucp/2.2/guides/admin/manage-users/permission-levels.md b/datacenter/ucp/2.2/guides/admin/manage-users/permission-levels.md index 9b3ec76218..610c573961 100644 --- a/datacenter/ucp/2.2/guides/admin/manage-users/permission-levels.md +++ b/datacenter/ucp/2.2/guides/admin/manage-users/permission-levels.md @@ -57,7 +57,7 @@ are listed on the **Create Role** page. For example, you can create a custom role that uses the node operations, `Schedule`, `Update`, and `View`, and you might give it a name like "Node Operator". -![](../../images/custom-role.png) +![](../../images/custom-role.png){: .with-border} You can give a role a global name, like "Remove Images", which might enable the **Remove** and **Force Remove** operations for images. You can apply a diff --git a/datacenter/ucp/2.2/guides/images/collections-diagram.svg b/datacenter/ucp/2.2/guides/images/collections-diagram.svg index 1020ebe621..bbe718b730 100644 --- a/datacenter/ucp/2.2/guides/images/collections-diagram.svg +++ b/datacenter/ucp/2.2/guides/images/collections-diagram.svg @@ -1 +1 @@ -Collections \ No newline at end of file +Collections \ No newline at end of file diff --git a/datacenter/ucp/2.2/guides/images/containers-and-nodes-diagram.svg b/datacenter/ucp/2.2/guides/images/containers-and-nodes-diagram.svg index 3662c90ec4..2f3db23e8e 100644 --- a/datacenter/ucp/2.2/guides/images/containers-and-nodes-diagram.svg +++ b/datacenter/ucp/2.2/guides/images/containers-and-nodes-diagram.svg @@ -1 +1 @@ -Nodes and containers \ No newline at end of file +nodes_containers \ No newline at end of file diff --git a/datacenter/ucp/2.2/guides/images/isolate-nodes-diagram.svg b/datacenter/ucp/2.2/guides/images/isolate-nodes-diagram.svg index f51debc53b..de822b81fc 100644 --- a/datacenter/ucp/2.2/guides/images/isolate-nodes-diagram.svg +++ b/datacenter/ucp/2.2/guides/images/isolate-nodes-diagram.svg @@ -1 +1 @@ -Isolate swarm nodes \ No newline at end of file +isolate_swarm \ No newline at end of file diff --git a/datacenter/ucp/2.2/guides/images/isolate-volumes-diagram.svg b/datacenter/ucp/2.2/guides/images/isolate-volumes-diagram.svg index 27baf62fc8..690eb842e3 100644 --- a/datacenter/ucp/2.2/guides/images/isolate-volumes-diagram.svg +++ b/datacenter/ucp/2.2/guides/images/isolate-volumes-diagram.svg @@ -1 +1 @@ -Isolate volumes \ No newline at end of file +isolate_vol \ No newline at end of file diff --git a/datacenter/ucp/2.2/guides/images/team-grant-diagram.svg b/datacenter/ucp/2.2/guides/images/team-grant-diagram.svg index 58b5e5d1a9..66b8c9a6b2 100644 --- a/datacenter/ucp/2.2/guides/images/team-grant-diagram.svg +++ b/datacenter/ucp/2.2/guides/images/team-grant-diagram.svg @@ -1 +1,31 @@ -create teams \ No newline at end of file + + + + create_teams + Created with Sketch. + + + + + + + + + + + + + + + + + + + + + + + + + + \ No newline at end of file