rbac.yaml file reference

rbac.yaml

The rbac.yaml file contains all files used to configure Role-Based Access Control (RBAC) within an instance. This file defines groups and roles at the root level.

Only roles and groups can be managed and only a subset of fields are supported.
Roles and groups present on the instance in the UI but not included in the items.yaml file will be removed.

Property Type Description

removeStrategy

object

Optional. It specifies the strategy to be followed when you apply a new configuration to an existing instance.

The removeStrategy property is optional for the rbac.yaml file. However, this property is required if the rbacRemoveStrategy property is not set in the bundle.yaml file.

Valid values for this property are:

rbac:
- sync: If a group already exists but the configuration changes, the new configuration is applied to the existing group. Existing groups not present in the new configuration are deleted.
- update: If the role or group already exists but the configuration changes, only the existing role or group is updated and replaced with the new role or group.

The removeStrategy property is declared in the bundle descriptor in the bundle.yaml file. If a removeStrategy property is not declared, the default option none is used. When a removeStategy is declared in the parent bundle but not the child bundle, the effective bundle uses the removeStrategy of the parent. If the child bundle also declares a removeStategy property in the bundle descriptor, the effective bundle uses the removeStategy of the child bundle.
If removeStrategy is declared for the rbac.yaml file, the rbac property values must be defined.

rbac

string

Required. Specifies how an existing configuration is handled when a new configuration is applied.

sync: If the role or group already exists but the configuration changes, the new configuration is applied and the existing groups or roles are deleted.
update: If the role or group already exists but the configuration changes, only the existing role or group is updated and replaced with the new role or group.

groups

list of objects

Required. The list of RBAC groups available on the controller.

name

string

Required. The name of the RBAC group.

members

list of lists

Required. The list of users included as members of the RBAC group. There are several types of members including: users, internal_groups, and external_groups.

users

list of strings

Optional. The list of user ids of users who belong to the RBAC group.

internal_groups

list of strings

Optional. The list of groups created in the CloudBees CI instance that belong to the RBAC group.

external_groups

list of strings

Optional. The list of groups imported from an identity provider (such as LDAP) that belong to the RBAC group.

roles

list of objects

Required. The list of RBAC roles that are assigned to this RBAC group.

name

string

Required. The name of the RBAC role assigned to the RBAC group.

grantedAt

string

Optional. The level the RBAC role is applicable. Available values include: current, child, or grandchild. The default level is current.

propagates

boolean

Optional. The setting for if the role propagates. The default value is true.

roles

list of objects

Required. The list of RBAC roles available on the controller.

name

string

Required. The name of the RBAC role.

filterable

boolean

Optional. The setting for if the role is filterable. The default value is true.

permissions

list of strings

Optional. The list of permissions authorized for members assigned this RBAC role. Can be empty if a member has no permissions assigned.

Example rbac.yaml file

removeStrategy:
  rbac: "SYNC"(1)

roles:
  - name: administer
    permissions:
      - hudson.model.Hudson.Administer
  - name: developer
    permissions:
      - hudson.model.Hudson.Read
      - hudson.model.Item.Read
      - hudson.model.Item.Create
      - hudson.model.Item.Configure
    filterable: "true"(2)
  - name: browser
    permissions:
    - hudson.model.Hudson.Read
    - hudson.model.Item.Read
    filterable: "true"
  - name: authenticated
    filterable: "true"
    permissions:
    - hudson.model.Hudson.Read

groups:
  - name: Administrators
    roles:
      - name: administer
        grantedAt: current(3)
    members:
      users:
        - admin
      external_groups:
        - ${external_admin_group}
  - name: Developers
    roles:(4) (5)
      - name: developer
    members:
      users:
        - developer
      internal_groups:
        - "some-other-group"
      external_groups:
        - "ldap-cb-developers"
  - name: Browsers
    roles:
      - name: browser
    members:
      users:
        - read▼

1	For security reasons, SYNC is here to remove groups/roles from CloudBees Continuous Integration when they are removed from this file.
2	If filterable is not included, the default value is “false”.
3	Other options that could be used here include: "child" or "grandchild".
4	If propagates is not included, the default value is "true".
5	If grantedAt is not included, the default value is "current".