Skip to content

Add Workers RBAC updates #16213

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Closed
wants to merge 8 commits into from
Closed

Add Workers RBAC updates #16213

wants to merge 8 commits into from

Conversation

JoshuaYe
Copy link
Contributor

Summary

  1. Update account roles documentation with new Worker roles.
  2. Create new page under Workers platform to map out Worker roles to permissions.

Screenshots (optional)

Documentation checklist

  • The documentation style guide has been adhered to.
  • If a larger change - such as adding a new page- an issue has been opened in relation to any incorrect or out of date information that this PR fixes.
  • Files which have changed name or location have been allocated redirects.

@cloudflare-workers-and-pages Cloudflare Workers and Pages
Copy link

cloudflare-workers-and-pages bot commented Aug 15, 2024 •
edited
Loading

Deploying cloudflare-docs with  Cloudflare Pages  Cloudflare Pages

Latest commit: 314bff1
Status: ✅  Deploy successful!
Preview URL: https://3eb0e5ff.cloudflare-docs-7ou.pages.dev
Branch Preview URL: https://jye-workers-rbac.cloudflare-docs-7ou.pages.dev

View logs

@github-actions GitHub Actions
Copy link
Contributor

Files with changes (up to 15)

Original Link Updated Link
https://developers.cloudflare.com/workers/platform/roles-permissions/ https://jye-workers-rbac.cloudflare-docs-7ou.pages.dev/workers/platform/roles-permissions/
https://developers.cloudflare.com/fundamentals/setup/manage-members/roles/ https://jye-workers-rbac.cloudflare-docs-7ou.pages.dev/fundamentals/setup/manage-members/roles/
https://developers.cloudflare.com/workers/platform/limits/ https://jye-workers-rbac.cloudflare-docs-7ou.pages.dev/workers/platform/limits/
https://developers.cloudflare.com/workers/platform/storage-options/ https://jye-workers-rbac.cloudflare-docs-7ou.pages.dev/workers/platform/storage-options/

irvinebroque
irvinebroque reviewed Aug 15, 2024
View reviewed changes
Copy link
Contributor

@irvinebroque irvinebroque left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Am glad we are adding a table for this

src/content/docs/workers/platform/roles-permissions.mdx Outdated

To check the list of members in your account, or to manage roles and permissions, refer to our [Account setup](/fundamentals/setup/manage-members/) documentation.

The following roles have permissions not restricted to Cloudflare [Workers](/workers/) but to related developer platform products too. This includes [Pages](/pages/), [Durable Objects](/durable-objects/), [KV](/kv/) and [R2](/r2/). It also provides read access to Zones, [Zone Analytics](/analytics/account-and-zone-analytics/zone-analytics/) and [Page Rules](/rules/).
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

  1. This should live within the section below
  2. It seems like we should be able to enumerate these more specifically — otherwise how does someone reading this know something like, one needs the Workers Admin permission in order to deploy a Pages project?

Copy link
Contributor Author

@JoshuaYe JoshuaYe Aug 16, 2024 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

For 2, what do you have in mind? The copy is from a pre-existing description of Cloudflare Workers Admin role and outlines all the devplat products the role impacts.

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Right now, when I read this, I know that which Workers role I have somehow impacts what I am allowed to do with Pages, KV, etc. — but it's not explicit how.

I am saying that we should go figure out specifically things like, if I have the Workers Read role — what does that mean for whether I can or can't deploy a Pages project?

...and enumerate them on this page.

If we can't right now, then I don't think we should include this content about Pages, KV, etc on this page. It leaves you with more questions than answers.

src/content/docs/workers/platform/roles-permissions.mdx Outdated

## Workers roles

Only Super Administrators will be able to assign or remove the following roles from users in their account. They also have all the permissions of a Workers Admin. Scroll to the right to see a full list of permissions for each role.
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Scroll to the right to see a full list of permissions for each role.

@kodster28 should we track something internally around making it more intuitive and visible that a table that extends horizontally beyond the viewport is scrollable, so that docs authors don't need to explain it in words?

Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yeah... tables are an ongoing issue that we're discussing.

I think that's one potential solution... but there's a lot of stuff in the works + mobile and tables just really don't go together.

src/content/docs/fundamentals/setup/manage-members/roles.mdx
@@ -62,6 +61,10 @@ Account-scoped roles apply across an entire Cloudflare account, and through all
| Vectorize Read only | Can read [Vectorize](/vectorize/) configurations. |
| Waiting Room Admin | Can edit [Waiting Room](/waiting-room/) configuration. |
| Waiting Room Read | Can read [Waiting Room](/waiting-room/) configuration. |
| Workers Admin | Can manage Cloudflare [Workers](/workers/), [Pages](/pages/), [Durable Objects](/durable-objects/), [KV](/kv/) and [R2](/r2/). Also provides read access to Zones, [Zone Analytics](/analytics/account-and-zone-analytics/zone-analytics/) and [Page Rules](/rules/).|
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It seems helpful for this in some way to link to the new page in the Workers docs that you are adding? (think fine if unique to Workers and other products don't do this on this page)

Copy link
Contributor Author

@JoshuaYe JoshuaYe Aug 16, 2024 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Good idea, unfortunately only Zero Trust does this too. If we think two products is enough, we could add a note that links to their specific role pages.

@JoshuaYe JoshuaYe requested a review from irvinebroque August 16, 2024 19:11
@KimJ15 KimJ15 assigned abstergail and unassigned kodster28 Sep 27, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@tanushree-sharma tanushree-sharma Awaiting requested review from tanushree-sharma

@kodster28 kodster28 Awaiting requested review from kodster28 kodster28 is a code owner

@GregBrimble GregBrimble Awaiting requested review from GregBrimble GregBrimble is a code owner

@irvinebroque irvinebroque Awaiting requested review from irvinebroque irvinebroque is a code owner

Assignees

@irvinebroque irvinebroque

@GregBrimble GregBrimble

@tanushree-sharma tanushree-sharma

@abstergail abstergail

@ToriLindsay ToriLindsay

Labels
do-not-merge-yet product:fundamentals product:workers Related to Workers product size/s
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
8 participants
@JoshuaYe @irvinebroque @kodster28 @GregBrimble @KimJ15 @tanushree-sharma @abstergail @ToriLindsay