Skip to content

Commit 984f4c2

Browse files
RayOffiahsarahlwelton
authored andcommitted
Revert "[DOC-11988]: RBAC role change impact to eventing function (#256)" (#258)
This reverts commit 3e55635.
1 parent 5659df7 commit 984f4c2

File tree

1 file changed

+4
-6
lines changed

1 file changed

+4
-6
lines changed

modules/eventing/pages/eventing-rbac.adoc

Lines changed: 4 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -7,10 +7,10 @@
77
[#description]
88
== Description: What is RBAC
99

10-
Couchbase provides _Role-Based Access Control_ (RBAC), in which access privileges are assigned to fixed roles, which are in turn assigned to users, (each of which may be an administrator or an application) either _directly_; or _indirectly_, by means of _user-groups_.
10+
Couchbase provides _Role-Based Access Control_ (RBAC), in which access privileges are assigned to fixed roles; which are in turn assigned to users (each of which may be an administrator or an application) either _directly_; or _indirectly_, by means of _user-groups_.
1111

1212
Couchbase Server Enterprise Edition provides RBAC with multiple roles for finer access control.
13-
Community Edition provides multiple users that can be assigned to a limited set of roles.
13+
Community Edition provides multiple users that can be assigned to limited set of roles.
1414
There are three fixed roles in the community edition of Couchbase providing coarser access control: Bucket Full Access (`bucket_full_access[*]`), Admin (`admin`), and Read Only Admin (`ro_admin`).
1515

1616
A Couchbase-Server _role_ permits one or more _resources_ to be accessed according to defined _privileges_.
@@ -27,11 +27,9 @@ For more information, see xref:learn:security/authorization-overview.adoc[Author
2727
A bucket.scope combination is used for identifying functions belonging to the same group.
2828

2929
Only the "Eventing Full Admin" role and also the "Full Admin" role can set the bucket.scope to *+*+.+*+*; all other Eventing non-privileged users need to define a *Function Scope* for their Eventing functions that references an existing resource of bucket.scope.
30-
This provides role-based isolation of Eventing functions between non-privileged users.
30+
This provides role based isolation of Eventing functions between non-privileged users
3131

32-
include::_@cloud:eventing:eventing-rbac.adoc[tags="rbac-change-warning"]
33-
34-
Typically, you should set Function Scope to the bucket.scope that holds the collection that is the source of your mutations to your Eventing Function. This best practice ensures that you _do not_ inadvertently cause an Eventing Function to undeploy by removing a *Function Scope* pointing to a resource that is not required for the function to run.
32+
Typically you should set Function Scope to the bucket.scope that holds the collection that is the source of your mutations to your Eventing Function. This best practice ensures that you _do not_ inadvertently cause an Eventing Function to undeploy by removing a *Function Scope* pointing to a resource that is not required for the function to run.
3533

3634
NOTE: A user can be assigned multiple "Eventing/Manage Scope Function" RBAC roles.
3735
If any of these roles match an existing Eventing Function's *Function Scope*, then that user can manage, modify, or delete the Eventing Function even if it was created or imported by someone else.

0 commit comments

Comments
 (0)