feat: add authz Conditions documentation#629
Merged
Merged
Conversation
Contributor
|
Warning Rate limit exceeded
You’ve run out of usage credits. Purchase more in the billing tab. ⌛ How to resolve this issue?After the wait time has elapsed, a review can be triggered using the We recommend that you space out your commits to avoid hitting the rate limit. 🚦 How do rate limits work?CodeRabbit enforces hourly rate limits for each developer per organization. Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout. Please see our FAQ for further information. ℹ️ Review info⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Pro Run ID: ⛔ Files ignored due to path filters (6)
📒 Files selected for processing (6)
📝 WalkthroughWalkthroughThis PR adds comprehensive documentation for the Conditions feature, which enables attribute-based access control within RBAC role bindings. It spans a new dedicated reference guide, updates to conceptual overviews, API specifications, platform engineer workflow instructions, and documentation navigation. ChangesAuthorization Conditions Feature Documentation
🎯 1 (Trivial) | ⏱️ ~3 minutes 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Tip 💬 Introducing Slack Agent: The best way for teams to turn conversations into code.Slack Agent is built on CodeRabbit's deep understanding of your code, so your team can collaborate across the entire SDLC without losing context.
Built for teams:
One agent for your entire SDLC. Right inside Slack. Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Contributor
Author
|
@CodeRabbit full review |
Contributor
✅ Actions performedFull review triggered. |
Signed-off-by: binoyPeries <binoyperies98@gmail.com>
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Actionable comments posted: 1
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (3)
docs/reference/api/platform/authzrolebinding.md (1)
1-196:⚠️ Potential issue | 🔴 Critical | ⚡ Quick winFix Prettier formatting issues before merge.
The pipeline reports formatting violations. Run
npx prettier --write docs/reference/api/platform/authzrolebinding.mdto fix.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@docs/reference/api/platform/authzrolebinding.md` around lines 1 - 196, The markdown file for the AuthzRoleBinding API reference has Prettier formatting violations; run the formatter (npx prettier --write docs/reference/api/platform/authzrolebinding.md) to reformat the document, verify code blocks and frontmatter around the AuthzRoleBinding sections remain intact, then stage and commit the updated file so the pipeline passes.docs/platform-engineer-guide/authorization/conditions.md (1)
1-124:⚠️ Potential issue | 🔴 Critical | ⚡ Quick winFix Prettier formatting issues before merge.
The pipeline reports formatting violations. Run
npm run formatornpx prettier --write docs/platform-engineer-guide/authorization/conditions.mdto fix.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@docs/platform-engineer-guide/authorization/conditions.md` around lines 1 - 124, Prettier formatting violations were detected in the Conditions doc; run the formatter and commit the changes: execute the project formatter (npm run format) or run npx prettier --write on the conditions.md file, review the resulting whitespace/linewrap edits in the doc (title, tables, code blocks, and YAML examples), stage the formatted file, and push the commit so the CI formatting check passes.docs/reference/api/platform/clusterauthzrolebinding.md (1)
1-193:⚠️ Potential issue | 🔴 Critical | ⚡ Quick winFix Prettier formatting issues before merge.
The pipeline reports formatting violations. Run
npx prettier --write docs/reference/api/platform/clusterauthzrolebinding.mdto fix.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@docs/reference/api/platform/clusterauthzrolebinding.md` around lines 1 - 193, The markdown file docs/reference/api/platform/clusterauthzrolebinding.md has Prettier formatting violations reported by CI; fix by running Prettier to reformat the file (for example: run npx prettier --write docs/reference/api/platform/clusterauthzrolebinding.md) then commit the updated file so the pipeline passes.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@docs/platform-engineer-guide/authorization/conditions.md`:
- Line 53: The sentence "For resources that exist in only one scope, the
resource identifiers simply carries the resource name." has subject-verb
agreement error; change "carries" to "carry" so it reads "the resource
identifiers simply carry the resource name." Update the sentence in the
Authorization Conditions documentation (the line that starts "For resources that
exist in only one scope, the resource identifiers...") to use "carry".
---
Outside diff comments:
In `@docs/platform-engineer-guide/authorization/conditions.md`:
- Around line 1-124: Prettier formatting violations were detected in the
Conditions doc; run the formatter and commit the changes: execute the project
formatter (npm run format) or run npx prettier --write on the conditions.md
file, review the resulting whitespace/linewrap edits in the doc (title, tables,
code blocks, and YAML examples), stage the formatted file, and push the commit
so the CI formatting check passes.
In `@docs/reference/api/platform/authzrolebinding.md`:
- Around line 1-196: The markdown file for the AuthzRoleBinding API reference
has Prettier formatting violations; run the formatter (npx prettier --write
docs/reference/api/platform/authzrolebinding.md) to reformat the document,
verify code blocks and frontmatter around the AuthzRoleBinding sections remain
intact, then stage and commit the updated file so the pipeline passes.
In `@docs/reference/api/platform/clusterauthzrolebinding.md`:
- Around line 1-193: The markdown file
docs/reference/api/platform/clusterauthzrolebinding.md has Prettier formatting
violations reported by CI; fix by running Prettier to reformat the file (for
example: run npx prettier --write
docs/reference/api/platform/clusterauthzrolebinding.md) then commit the updated
file so the pipeline passes.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
Run ID: 5544efd9-6374-4003-9ff0-8143c3bb501b
⛔ Files ignored due to path filters (6)
docs/platform-engineer-guide/authorization/images/role-binding-creation-allow-deny-selection.pngis excluded by!**/*.png,!**/*.pngdocs/platform-engineer-guide/authorization/images/role-binding-creation-conditions-editing.pngis excluded by!**/*.png,!**/*.pngdocs/platform-engineer-guide/authorization/images/role-binding-creation-review-selection.pngis excluded by!**/*.png,!**/*.pngdocs/platform-engineer-guide/authorization/images/role-binding-creation-role-mapping-view.pngis excluded by!**/*.png,!**/*.pngdocs/platform-engineer-guide/authorization/images/role-binding-creation-role-mapping.pngis excluded by!**/*.png,!**/*.pngdocs/platform-engineer-guide/authorization/images/role-binding-creation-subject-selection.pngis excluded by!**/*.png,!**/*.png
📒 Files selected for processing (6)
docs/platform-engineer-guide/authorization/conditions.mddocs/platform-engineer-guide/authorization/custom-roles.mdxdocs/platform-engineer-guide/authorization/overview.mddocs/reference/api/platform/authzrolebinding.mddocs/reference/api/platform/clusterauthzrolebinding.mdsidebars.ts
Signed-off-by: binoyPeries <binoyperies98@gmail.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Purpose
Documents the new conditions feature on AuthzRoleBinding and ClusterAuthzRoleBinding, which lets users attach CEL expressions to role mappings to restrict when granted actions apply.
Changes
New: Conditions concept page
A dedicated page in the Authorization category that introduces conditions as the fourth constraint on role bindings (alongside subject, scope, and role). Covers the field structure, the available-attributes model, the dual-scoped identifier format used for resources like environments, evaluation semantics, and a worked YAML example.
Authorization overview updated
The overview now mentions conditions in the Core Concepts section and adds a fourth step to the access-determination algorithm. A new Fail-Closed Evaluation subsection documents how OpenChoreo handles malformed condition expressions and other corrupted policy state, applicable across the full RBAC pipeline.
API references updated
Both
AuthzRoleBindingandClusterAuthzRoleBindingAPI reference pages now document theconditionsfield on each role mapping, theAuthzConditionshape, OR semantics across entries, and include a YAML example showing conditions in use.Backstage UI walkthrough updated
The Custom Roles and Bindings guide reflects the recently-shipped page-based binding wizard (previously a modal). The role-mapping step now includes a new Conditions (Optional) sub-section that walks through the Conditions panel — adding/editing/confirming conditions, picking actions, writing the CEL expression, and the attribute-chip discovery mechanism. The attribute-intersection rule is documented along with the disabled-Expression state for action selections that share no attributes.
Related Issues
openchoreo/openchoreo#3409
Checklist
sidebars.tsif adding a new documentation pagenpm run startto preview the changes locallynpm run buildto ensure the build passes without errors