RBAC: Split "Create" and "Edit" Authorization Grants
long-term
N
Nectar Mole
Currently, "create" and "edit" permissions are bundled into a single authorization grant. This request is to de-couple them into separate authorization grants for greater granularity and control.
While this is generally applicable, we can try to narrow it down to a specific list of these authorization grants where we would intend to use this split. Please reach out to schedule some time if this is the case.
Log In
F
Fawn Antelope
We need this too.. we want to restrict editing of existing pipelines but grant the permission of creating new ones.
Rohan Gupta
Merged in a post:
Pipeline create restrictions is not possible using roles and the OPA policy
G
Gold Bobolink
Currently we can't restrict users to create pipeline using roles and the OPA policy. Seems there is single Harness API endpoint for both create and edit pipeline operation. Please prioritise as we would like to give the separate permission(create and edit) for users
Harness support ticket #63515
Prateek Mittal
long-term
S
Sole Chimpanzee
We need this as well for entities such as Project, Pipeline, Secrets, Templates, etc. Most of the time, I want to give a use to Edit any resources without creating new resources.
Right now, this requires that I first create the resource and then add it to a resource group to grant a user Edit permission to that specific resource. It is very time consuming and difficult/impossible to automate.
N
Nectar Mole
Hi Prateek, in particular, we would leverage different configurations on create/edit for pipelines, services, and environments.
Prateek Mittal
Hi Michael,
What are the entities for which you think, create and edit permission need to be split. And what is the expected behavior you foresee for these operations?
Thanks,
Prateek
Prateek Mittal
pending feedback