https://issues.redhat.com/browse/ACM-29169--new fine grain and reorg … by swopebe · Pull Request #8606 · stolostron/rhacm-docs

swopebe · 2026-02-23T21:57:32Z

…of content

openshift-ci · 2026-02-23T21:57:38Z

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: swopebe

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

secure_clusters/fine_grain_rbac_enable.adoc

swopebe · 2026-02-24T18:03:13Z

secure_clusters/fine_grain_rbac_intro.adoc

@@ -0,0 +1,9 @@
+[#fine-grain-intro]


new intro for review

…ate PR

swopebe · 2026-02-24T22:20:01Z

secure_clusters/fine_grain_rbac_ui.adoc

 *Required access:* Cluster administrator

-.Prerequisites
+== Assigning fine-grained role-based access control in the console


Ignore this, changes will be made in a different PR--do not review this file.

…ate PR

swopebe · 2026-02-25T01:47:53Z

secure_clusters/fine_grain_roles.adoc

@@ -0,0 +1,112 @@
+[#fine-grained-rbac-roles]


New content for review.

swopebe · 2026-02-25T01:48:17Z

secure_clusters/securing_cluster_intro.adoc

 * xref:../secure_clusters/rbac_implement_rhacm.adoc#rhacm-rbac-implement[Implementing role-based access control]
-* xref:../secure_clusters/fine_grain_rbac_cli.adoc#fine-grain-rbac-cli[Implementing fine-grained role-based access control in the terminal (Technology Preview)]
-* xref:../secure_clusters/fine_grain_rbac_ui.adoc#fine-grain-rbac-ui[Implementing fine-grained role-based access control in the console (Technology Preview)]
+* xref:../secure_clusters/fine_grain_rbac_intro.adoc#fine-grain-intro[Fine-grained role-based access control overview]


This will be the only file needed in this intro.

kurwang · 2026-02-25T14:48:42Z

secure_clusters/fine_grain_rbac_enable.adoc

+[#fine-grain-enable]
+= Enabling fine-grained role-based access control for virtualization 
+
+{acm} supports fine-grained role-based access control (RBAC) for virtual machine scenarios. As a cluster administrator, you can manage and control permissions at the namespace level and cluster level on your managed clusters. Grant permissions to a virtual machine namespace within a cluster without granting permission to the entire managed cluster.


I would like to combine the last two sentences here and say that you can manage and grant permissions to other users.

the idea would be that as the super top admin, they can give permissions to others at namespace or cluster level

kurwang · 2026-02-25T14:49:50Z

secure_clusters/fine_grain_rbac_enable.adoc

+
+{acm} supports fine-grained role-based access control (RBAC) for virtual machine scenarios. As a cluster administrator, you can manage and control permissions at the namespace level and cluster level on your managed clusters. Grant permissions to a virtual machine namespace within a cluster without granting permission to the entire managed cluster.
+
+Enabling fine-grained RBAC significantly changes how the console displays search results and manages access for application lifecycles, governance, and observability. 


@mshort55 any thoughts on this? I wasnt as involved with other this affected other areas but i was aware there were some search issues that happened when enabling fine-grained rbac

kurwang · 2026-02-25T14:53:34Z

secure_clusters/fine_grain_rbac_enable.adoc

+
+- *Optional:* Install the _Migration Toolkit for Virtualization operator_ if you plan to perform virtual migrations. (link--= Migrating virtual machines between clusters then check the OCP link))
+
+- *Note:* If you enable the `cnv-mtv-integrations` feature in {acm-short}, the system automatically installs and configures both the OpenShift Virtualization and MTV operators for you.


can we replace system with acm?

https://docs.redhat.com/en/documentation/red_hat_advanced_cluster_management_for_kubernetes/2.15/html/virtualization/acm-virt#migrate-vm
can we link to this doc about enabling because there are a bit more steps involve to enable it correctly so i dont want it to sound misleading when mentioning automatically

kurwang · 2026-02-25T14:55:20Z

secure_clusters/fine_grain_rbac_enable.adoc

+
+.Prerequisites
+
+See the following prerequisites that are needed to enable fine-grained role-based access control:


seems like there is a request to add virtualization wording here see the google doc
https://docs.google.com/document/d/1OiP9vx7xMYkMPwTjSV5rofEgNAy__dW46Qrl2pFpuCs/edit?disco=AAAByzuBN4k

We add it in the title and the description.

kurwang · 2026-02-25T14:57:25Z

secure_clusters/fine_grain_rbac_enable.adoc

+See the following steps to enable the `fine-grained-rbac` component in the `MultiClusterHub` resource:
+
+. Run the following command to patch the resource. The default name of the custom resource is `multiclusterhub`, and `open-cluster-management` is the default namespace: If you have a different name or namespace, update the command: 
+//can this be changed?


this whole part Run the following command to patch the resource. The default name of the custom resource is multiclusterhub, and open-cluster-managementis the default namespace: If you have a different name or namespace, update the command:
can be removed in my opinion if there is a conventional way it is doc to enabling a feature
I was looking at others and it seems like just providing the oc command works?

what do you think @swopebrandi1

kurwang · 2026-02-25T14:58:42Z

secure_clusters/fine_grain_rbac_intro.adoc

+[#fine-grain-intro]
+= Fine-grained role-based access control for virtual machines
+
+{acm} supports fine-grained role-based access control (RBAC) for virtual machine scenarios. As a cluster administrator, you can manage and control permissions at the namespace level and cluster level on your managed clusters. Grant permissions to a virtual machine namespace within a cluster without granting permission to the entire managed cluster.


this seems to be duplicated I saw this in the enable part also
but i assume this is the correct spot?

if so my previous comment on that should be here instead

We need a "short description" in all the topics, most of this was already there. We have to have something here for the introduction.

kurwang · 2026-02-25T15:12:43Z

secure_clusters/fine_grain_roles.adoc

+| Grants read-only access to `kubevirt` resources.
+|===
+
+* *Scenario two:* Administrative privilege in the console


i would like to add the fleet virtualization ui here

kurwang

added my comments thanks!

https://issues.redhat.com/browse/ACM-29169--new fine grain and reorg …

a4171a1

…of content

swopebe commented Feb 24, 2026

View reviewed changes

secure_clusters/fine_grain_rbac_enable.adoc Show resolved Hide resolved

swopebe commented Feb 24, 2026

View reviewed changes

secure_clusters/fine_grain_rbac_intro.adoc

@@ -0,0 +1,9 @@

[#fine-grain-intro]

Copy link

Contributor Author

swopebe Feb 24, 2026 •

edited

Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

new intro for review

swopebe added 2 commits February 24, 2026 14:42

https://issues.redhat.com/browse/ACM-29169--refine content for dev mtg

ad0a868

https://issues.redhat.com/browse/ACM-29169--redoing UI steps in separ…

aa1e48b

…ate PR

swopebe commented Feb 24, 2026

View reviewed changes

swopebe added 2 commits February 24, 2026 17:49

https://issues.redhat.com/browse/ACM-29169--redoing UI steps in separ…

22a6411

…ate PR

https://issues.redhat.com/browse/ACM-29169--post meeting changes

51c1b52

swopebe commented Feb 25, 2026

View reviewed changes

secure_clusters/fine_grain_roles.adoc

@@ -0,0 +1,112 @@

[#fine-grained-rbac-roles]

Copy link

Contributor Author

swopebe Feb 25, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

New content for review.

swopebe commented Feb 25, 2026

View reviewed changes

kurwang reviewed Feb 25, 2026

View reviewed changes


		{acm} supports fine-grained role-based access control (RBAC) for virtual machine scenarios. As a cluster administrator, you can manage and control permissions at the namespace level and cluster level on your managed clusters. Grant permissions to a virtual machine namespace within a cluster without granting permission to the entire managed cluster.

		Enabling fine-grained RBAC significantly changes how the console displays search results and manages access for application lifecycles, governance, and observability.


		- Optional: Install the _Migration Toolkit for Virtualization operator_ if you plan to perform virtual migrations. (link--= Migrating virtual machines between clusters then check the OCP link))

		- Note: If you enable the `cnv-mtv-integrations` feature in {acm-short}, the system automatically installs and configures both the OpenShift Virtualization and MTV operators for you.


		.Prerequisites

		See the following prerequisites that are needed to enable fine-grained role-based access control:

Conversation

swopebe commented Feb 23, 2026

Uh oh!

openshift-ci bot commented Feb 23, 2026

Uh oh!

Uh oh!

swopebe Feb 24, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

kurwang Feb 25, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

kurwang left a comment

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

swopebe Feb 24, 2026 •

edited

Loading

kurwang Feb 25, 2026 •

edited

Loading