-
Notifications
You must be signed in to change notification settings - Fork 2
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
# Description Please describe the change you have made. ## Checklist - [ ] Tests added/updated. - [ ] Run Demo Job Locally. - [ ] Documentation updated. - [ ] Changelogs updated in [CHANGELOG.cdf-tk.md](https://github.com/cognitedata/toolkit/blob/main/CHANGELOG.cdf-tk.md). - [ ] Template changelogs updated in [CHANGELOG.templates.md](https://github.com/cognitedata/toolkit/blob/main/CHANGELOG.templates.md). - [ ] Version bumped. [_version.py](https://github.com/cognitedata/toolkit/blob/main/cognite/cognite_toolkit/_version.py) and [pyproject.toml](https://github.com/cognitedata/toolkit/blob/main/pyproject.toml) per [semantic versioning](https://semver.org/).
- Loading branch information
Showing
307 changed files
with
2,991 additions
and
1,625 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
File renamed without changes.
File renamed without changes.
File renamed without changes.
File renamed without changes.
File renamed without changes.
File renamed without changes.
File renamed without changes.
File renamed without changes.
File renamed without changes.
File renamed without changes.
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
33 changes: 11 additions & 22 deletions
33
cognite_toolkit/_builtin_modules/common/cdf_auth_readwrite_all/README.md
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -1,34 +1,23 @@ | ||
# Module: cdf_auth_readwrite_all | ||
|
||
This is a foundational module used by the `cdf-tk` tool as the default | ||
auth module for read-write access to all CDF resources for the tool itself (admin or CI/CD pipeline), | ||
as well as default read-only access for admin access in the UI. | ||
|
||
This structure is based on the concept of ONLY the tool having write access to the entities | ||
that are controlled by the templates. Everybody else should either have no access or read-only access. | ||
This module contains two groups that are used to grant access to all resources in a CDF project. This | ||
should **never** be used for production projects, as it grants read-write access to all resources in the project. | ||
However, it is useful for sandbox projects to allow members of the `gp_admin_read_write` group to have full access. | ||
It can also be used for demo projects where you want to give full read access `gp_admin_readonly` access to | ||
all resources to a group of users. | ||
|
||
## Managed resources | ||
|
||
This module manages the following resources: | ||
|
||
1. a group with read-write access (`gp_cicd_all_read_write`) to everything in a CDF project (for `cdf-tk` as an admin | ||
tool or through a CI/CD pipeline). | ||
2. a group with read-only access `gp_cicd_all_read_only` (for viewing configurations from UI). | ||
1. a group with read-write access (`gp_admin_read_write`) to everything in a CDF project. | ||
2. a group with read-only access `gp_admin_readonly` (for viewing configurations from UI). | ||
|
||
## Variables | ||
|
||
The following variables are required and defined in this module: | ||
|
||
| Variable | Description | | ||
|----------|-------------| | ||
|readwrite_source_id| The source ID of the group that should be granted read-write access to all resources in the project. | | ||
|readonly_source_id| The source ID of the group that should be granted read-only access to all resources in the project.| | ||
|
||
## Usage | ||
|
||
The `gp_cicd_all_read_write` group is used default by the `cdf-tk auth verify` command to verify correct access to | ||
resources in a project. The groups are default part of several packages that are created by the `cdf-tk` tool. | ||
|
||
If you have different needs for the readwrite and readonly groups, you can copy this module into `custom_modules`, rename | ||
it (remove the cdf_ prefix), and change which modules are deployed in your `environments.yaml` file. You can also | ||
use the `cdf-tk verify --group-file=/path/to/group.yaml` command to switch out the default group file with your own. | ||
| Variable | Description | | ||
|---------------------|------------------------------------------------------------------------------------------------------| | ||
| readwrite_source_id | The source ID of the group that should be granted read-write access to all resources in the project. | | ||
| readonly_source_id | The source ID of the group that should be granted read-only access to all resources in the project. | |
Oops, something went wrong.