# RBAC Self-Configuration Guide

This document aims to assist team members in independently configuring the RBAC (Role-Based Access Control) system to manage access permissions for TiDB dbaas systems. To collaborate and maintain efficiently, we follow the following steps:

## 1. Preparation

Before you begin, ensure that you have created a new branch for RBAC configuration. This helps us maintain the stability of the main code.

```bash
git checkout -b rbac-config-20221013
```

## 2. Configure Permissions

RBAC permission information is stored in the `./tools/rbac-management/ALL_PRIVILEGES` file. In this file, you can define the permissions you need to configure in the following format:

```json
{
  "$SYSTEM": {
    "$URI": {
      "url": "xxxx",
      "description": "yyyyy"
    }
  }
}

```

Please make sure to add the necessary permission information to `./tools/rbac-management/ALL_PRIVILEGES`.


Below is an example for adding `orgs/{org_id}/projects/{project_id}/sqleditor/put_api` permission in `sqleditor` system.

```json
{
 "sqleditor": {
  "orgs/{org_id}/projects/{project_id}/sqleditor/put_api": {
   "description": "put api for sqleditor",
   "url": "put:/api/v1/dataapps/sqleditor/orgs/(\\d+)/projects/(\\d+)/.*"
  },
  ...
 }
 ...
}

```

## 3. Configure Role Bindings

Role binding information is stored in the `./tools/rbac-management/ALL_ROLEBINDING` file. In this file, you can define the relationships between roles and permissions in the following format:

```json
{
  "$SYSTEM": {
      "$ROLE": [
        "$URI_1",
        "$URI_2",
        ...
      ]
  },
  ...
}
```

Ensure that you assign the appropriate permissions to your roles in `./tools/rbac-management/ALL_ROLEBINDING`.


Below is an example for binding `orgs/{org_id}/projects/{project_id}/sqleditor/put_api` permission under `project:readonly` role in `sqleditor` system.


```json
{
  "sqleditor": {
      "project:readonly": [
        ...
        "orgs/{org_id}/projects/{project_id}/sqleditor/put_api",
        ...
      ]
  },
  ...
}
```


## 4. Create a Pull Request

Once you have configured the permissions and role bindings, create a pull request to merge your changes into the main branch.

```bash
git add ALL_PRIVILEGES ALL_ROLEBINDING
git commit -m "Configure RBAC permissions and role bindings in 20231013"
git push origin rbac-config-20231013
```

You can validate this configuration locally.

```
 % python rbac_management.py check-config
config_file is /etc/dbaas/config.yaml
============ check rbac config ============
============ All configuration checks have passed.  ============
```


On GitHub or another code hosting platform, create a pull request and request reviewers to review your changes.

## 5. Approval and Merge

Reviewers will examine your pull request, and if there are no issues, they will approve the merge request. 

## 6. Update RBAC Information

You can deploy the RBAC configuration to dev/staging env directly based on your branch using `Github Actions`. 
* Github Action for Dev Env: https://github.com/tidbcloud/account/actions/workflows/dev-update-rbac.yaml
* Github Action for Staging Env: https://github.com/tidbcloud/account/actions/workflows/staging-update-rbac.yaml

If you want to deploy your RBAC configuration to prod env, please contact the IAM team to review your pull request, 
Once the RBAC configuration is merged,  IAM team will update the RBAC configuration in prod according your requests.


## Conclusion

This README document provides a straightforward process for configuring RBAC to manage application access permissions. We encourage team members to actively participate in the RBAC configuration process to ensure flexibility and transparency in permission management.

If you have any questions or need further assistance, please feel free to reach out to the Account team.