mirror of
https://github.com/grafana/grafana.git
synced 2026-07-30 00:08:10 -05:00
Docs: OnCall role and action definitions (#61175)
* OnCall role and action definitions * change verbs from write to update or edit * Update docs/sources/administration/roles-and-permissions/access-control/rbac-fixed-basic-role-definitions/index.md Co-authored-by: Joey Orlando <joseph.t.orlando@gmail.com>
This commit is contained in:
Ieva
Joey Orlando
+37
@@ -144,6 +144,43 @@ The following list contains role-based access control actions.
|
||||
| `users:read` | `global.users:*` | Read or search user profiles. |
|
||||
| `users:write` | `global.users:*` <br> `global.users:id:*` | Update a user’s profile. |
|
||||
|
||||
### Grafana OnCall action definitions (beta)
|
||||
|
||||
> **Note:** Available from Grafana 9.4 in early access.
|
||||
|
||||
> **Note:** This feature is behind the `accessControlOnCall` feature toggle.
|
||||
> You can enable feature toggles through configuration file or environment variables. See configuration [docs]({{< relref "../../../../setup-grafana/configure-grafana/#feature_toggles" >}}) for details.
|
||||
|
||||
The following list contains role-based access control actions used by Grafana OnCall application plugin.
|
||||
|
||||
| Action | Applicable scope | Description |
|
||||
| ------------------------------------------------ | ---------------- | ------------------------------------------------- |
|
||||
| `grafana-oncall-app.alert-groups:read` | n/a | Read OnCall alert groups. |
|
||||
| `grafana-oncall-app.alert-groups:write` | n/a | Create, edit and delete OnCall alert groups. |
|
||||
| `grafana-oncall-app.integrations:read` | n/a | Read OnCall integrations. |
|
||||
| `grafana-oncall-app.integrations:write` | n/a | Create, edit and delete OnCall integrations. |
|
||||
| `grafana-oncall-app.integrations:test` | n/a | Test OnCall integrations. |
|
||||
| `grafana-oncall-app.escalation-chains:read` | n/a | Read OnCall escalation chains. |
|
||||
| `grafana-oncall-app.escalation-chains:write` | n/a | Create, edit and delete OnCall escalation chains. |
|
||||
| `grafana-oncall-app.schedules:read` | n/a | Read OnCall schedules. |
|
||||
| `grafana-oncall-app.schedules:write` | n/a | Create, edit and delete OnCall schedules. |
|
||||
| `grafana-oncall-app.schedules:export` | n/a | Export OnCall schedules. |
|
||||
| `grafana-oncall-app.chatops:read` | n/a | Read OnCall ChatOps. |
|
||||
| `grafana-oncall-app.chatops:write` | n/a | Edit OnCall ChatOps. |
|
||||
| `grafana-oncall-app.chatops:update-settings` | n/a | Edit OnCall ChatOps settings. |
|
||||
| `grafana-oncall-app.maintenance:read` | n/a | Read OnCall maintenance. |
|
||||
| `grafana-oncall-app.maintenance:write` | n/a | Edit OnCall maintenance. |
|
||||
| `grafana-oncall-app.api-keys:read` | n/a | Read OnCall API keys. |
|
||||
| `grafana-oncall-app.api-keys:write` | n/a | Create, edit and delete OnCall API keys. |
|
||||
| `grafana-oncall-app.notifications:read` | n/a | Receive OnCall notifications. |
|
||||
| `grafana-oncall-app.notification-settings:read` | n/a | Read OnCall notification settings. |
|
||||
| `grafana-oncall-app.notification-settings:write` | n/a | Edit OnCall notification settings. |
|
||||
| `grafana-oncall-app.user-settings:read` | n/a | Read user's own OnCall user settings. |
|
||||
| `grafana-oncall-app.user-settings:write` | n/a | Edit user's own OnCall user settings. |
|
||||
| `grafana-oncall-app.user-settings:admin` | n/a | Read and edit all users' OnCall user settings. |
|
||||
| `grafana-oncall-app.other-settings:read` | n/a | Read OnCall settings. |
|
||||
| `grafana-oncall-app.other-settings:write` | n/a | Edit OnCall settings. |
|
||||
|
||||
## Scope definitions
|
||||
|
||||
The following list contains role-based access control scopes.
|
||||
|
||||
+49
@@ -101,3 +101,52 @@ Access to Grafana alert rules is an intersection of many permissions:
|
||||
There is only one exclusion at this moment. Role `fixed:alerting.provisioning:writer` does not require user to have any additional permissions and provides access to all aspects of the alerting configuration via special provisioning API.
|
||||
|
||||
For more information about the permissions required to access alert rules, refer to [Create a custom role to access alerts in a folder]({{< relref "./plan-rbac-rollout-strategy/#create-a-custom-role-to-access-alerts-in-a-folder" >}}).
|
||||
|
||||
### Grafana OnCall roles (beta)
|
||||
|
||||
> **Note:** Available from Grafana 9.4 in early access.
|
||||
|
||||
> **Note:** This feature is behind the `accessControlOnCall` feature toggle.
|
||||
> You can enable feature toggles through configuration file or environment variables. See configuration [docs]({{< relref "../../../../setup-grafana/configure-grafana/#feature_toggles" >}}) for details.
|
||||
|
||||
If you are using [Grafana OnCall](https://grafana.com/docs/oncall/latest/get-started/), you can try out the integration between Grafana OnCall and RBAC.
|
||||
This will allow you to control access to different OnCall features using the following RBAC roles:
|
||||
|
||||
| Fixed role | Permissions | Description |
|
||||
| --------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------- |
|
||||
| `plugins:grafana-oncall-app:reader` | `plugins.app:access`<br>`grafana-oncall-app.alert-groups:read`<br>`grafana-oncall-app.integrations:read`<br>`grafana-oncall-app.escalation-chains:read`<br>`grafana-oncall-app.schedules:read`<br>`grafana-oncall-app.chatops:read`<br>`grafana-oncall-app.outgoing-webhooks:read`<br>`grafana-oncall-app.maintenance:read`<br>`grafana-oncall-app.notification-settings:read`<br>`grafana-oncall-app.user-settings:read`<br>`grafana-oncall-app.other-settings:read` | Read everything in OnCall. |
|
||||
| `plugins:grafana-oncall-app:oncaller` | All permissions from `plugins:grafana-oncall-app:reader` and `grafana-oncall-app.alert-groups:write`<br>`grafana-oncall-app.schedules:write` | Read everything in OnCall and edit alert groups and schedules. |
|
||||
| `plugins:grafana-oncall-app:editor` | All permissions from `plugins:grafana-oncall-app:oncaller` and `grafana-oncall-app.notifications:read`<br>`grafana-oncall-app.integrations:test`<br>`grafana-oncall-app.schedules:export`<br>`grafana-oncall-app.chatops:write`<br>`grafana-oncall-app.maintenance:write`<br>`grafana-oncall-app.notification-settings:write`<br>`grafana-oncall-app.user-settings:write` | Read everything in OnCall and edit alert groups, schedules, ChatOps, maintenance, notification settings, and user's own settings. |
|
||||
| `plugins:grafana-oncall-app:admin` | All permissions from `plugins:grafana-oncall-app:editor` and `grafana-oncall-app.integrations:write`<br>`grafana-oncall-app.escalation-chains:write`<br>`grafana-oncall-app.chatops:update-settings:write`<br>`grafana-oncall-app.outgoing-webhooks:write`<br>`grafana-oncall-app.api-keys:write`<br>`grafana-oncall-app.user-settings:admin`<br>`grafana-oncall-app.other-settings:write` | Read and edit everything in OnCall. |
|
||||
| `plugins:grafana-oncall-app:alert-groups-reader` | `plugins.app:access`<br>`grafana-oncall-app.alert-groups:read` | Read OnCall alert groups. |
|
||||
| `plugins:grafana-oncall-app:alert-groups-editor` | `plugins.app:access`<br>`grafana-oncall-app.alert-groups:read`<br>`grafana-oncall-app.alert-groups:write` | Create, read, update and delete OnCall alert groups. |
|
||||
| `plugins:grafana-oncall-app:integrations-reader` | `plugins.app:access`<br>`grafana-oncall-app.integrations:read` | Read OnCall integrations. |
|
||||
| `plugins:grafana-oncall-app:integrations-editor` | `plugins.app:access`<br>`grafana-oncall-app.integrations:read`<br>`grafana-oncall-app.integrations:write`<br>`grafana-oncall-app.integrations:test` | Create, read, update and delete OnCall integrations. |
|
||||
| `plugins:grafana-oncall-app:escalation-chains-reader` | `plugins.app:access`<br>`grafana-oncall-app.escalation-chains:read` | Read OnCall escalation chains. |
|
||||
| `plugins:grafana-oncall-app:escalation-chains-editor` | `plugins.app:access`<br>`grafana-oncall-app.escalation-chains:read`<br>`grafana-oncall-app.escalation-chains:write` | Create, read, update and delete OnCall escalation chains. |
|
||||
| `plugins:grafana-oncall-app:schedules-reader` | `plugins.app:access`<br>`grafana-oncall-app.schedules:read` | Read OnCall schedules. |
|
||||
| `plugins:grafana-oncall-app:schedules-editor` | `plugins.app:access`<br>`grafana-oncall-app.schedules:read`<br>`grafana-oncall-app.schedules:write`<br>`grafana-oncall-app.schedules:export` | Create, read, update and delete OnCall schedules. |
|
||||
| `plugins:grafana-oncall-app:chatops-reader` | `plugins.app:access`<br>`grafana-oncall-app.chatops:read` | Read OnCall ChatOps. |
|
||||
| `plugins:grafana-oncall-app:chatops-editor` | `plugins.app:access`<br>`grafana-oncall-app.chatops:read`<br>`grafana-oncall-app.chatops:write`<br>`grafana-oncall-app.chatops:update-settings` | Read and update OnCall ChatOps. |
|
||||
| `plugins:grafana-oncall-app:outgoing-webhooks-reader` | `plugins.app:access`<br>`grafana-oncall-app.outgoing-webhooks:read` | Read OnCall outgoing webhooks. |
|
||||
| `plugins:grafana-oncall-app:outgoing-webhooks-editor` | `plugins.app:access`<br>`grafana-oncall-app.outgoing-webhooks:read`<br>`grafana-oncall-app.outgoing-webhooks:write` | Create, read, update and delete OnCall outgoing webhooks. |
|
||||
| `plugins:grafana-oncall-app:maintenance-reader` | `plugins.app:access`<br>`grafana-oncall-app.maintenance:read` | Read OnCall maintenance. |
|
||||
| `plugins:grafana-oncall-app:maintenance-editor` | `plugins.app:access`<br>`grafana-oncall-app.maintenance:read`<br>`grafana-oncall-app.maintenance:write` | Read and update OnCall maintenance. |
|
||||
| `plugins:grafana-oncall-app:api-keys-reader` | `plugins.app:access`<br>`grafana-oncall-app.api-keys:read` | Read OnCall API keys. |
|
||||
| `plugins:grafana-oncall-app:api-keys-editor` | `plugins.app:access`<br>`grafana-oncall-app.api-keys:read`<br>`grafana-oncall-app.api-keys:write` | Create, read, update and delete OnCall API keys. Also grants access to be able to consume the OnCall API. |
|
||||
| `plugins:grafana-oncall-app:notification-settings-reader` | `plugins.app:access`<br>`grafana-oncall-app.notification-settings:read` | Read OnCall notification settings. |
|
||||
| `plugins:grafana-oncall-app:notification-settings-editor` | `plugins.app:access`<br>`grafana-oncall-app.notification-settings:read`<br>`grafana-oncall-app.notification-settings:write` | Read and update OnCall notification settings. |
|
||||
| `plugins:grafana-oncall-app:user-settings-reader` | `plugins.app:access`<br>`grafana-oncall-app.user-settings:read` | Read user's own OnCall user settings. |
|
||||
| `plugins:grafana-oncall-app:user-settings-editor` | `plugins.app:access`<br>`grafana-oncall-app.user-settings:read`<br>`grafana-oncall-app.user-settings:write` | Read and update user's own OnCall user settings. |
|
||||
| `plugins:grafana-oncall-app:user-settings-admin` | `plugins.app:access`<br>`grafana-oncall-app.user-settings:read`<br>`grafana-oncall-app.user-settings:write`<br>`grafana-oncall-app.user-settings:admin` | Read and update OnCall user settings for all users. |
|
||||
| `plugins:grafana-oncall-app:settings-reader` | `plugins.app:access`<br>`grafana-oncall-app.other-settings:read` | Read OnCall settings. |
|
||||
| `plugins:grafana-oncall-app:settings-editor` | `plugins.app:access`<br>`grafana-oncall-app.other-settings:read`<br>`grafana-oncall-app.other-settings:write` | Read and update OnCall settings. |
|
||||
|
||||
The following table lists the default RBAC OnCall role assignments to the basic roles:
|
||||
|
||||
| Basic role | Associated fixed roles | Description |
|
||||
| ------------- | ----------------------------------- | ------------------------------------------------------------------------------------------------------------------ |
|
||||
| Grafana Admin | `plugins:grafana-oncall-app:admin` | Default [Grafana server administrator]({{< relref "../#grafana-server-administrators" >}}) assignments. |
|
||||
| Admin | `plugins:grafana-oncall-app:admin` | Default [Grafana organization administrator]({{< relref "../#organization-users-and-permissions" >}}) assignments. |
|
||||
| Editor | `plugins:grafana-oncall-app:editor` | Default [Editor]({{< relref "../#organization-users-and-permissions" >}}) assignments. |
|
||||
| Viewer | `plugins:grafana-oncall-app:reader` | Default [Viewer]({{< relref "../#organization-users-and-permissions" >}}) assignments. |
|
||||
|
||||
Reference in New Issue
Block a user