- [Instructor] In order to successfully configure security
and specifically role-based access control or RBAC
in the universal control plane, you first need
to be able to identify the roles
that are used in UCP.
To that end, let's talk about the Docker
Access Control Model as Docker calls it.
So the Docker Access Control Model has a few terms
that you need to be aware of.
So I'm going to first list them out
and then we're going to go into them in more detail.
The first one is the subject.
So just like a police investigation,
the subject is who we're talking about
in this area of security, in the access control model.
Then you have the role.
The role is what's their job?
What can they do?
Then you have resources.
Exactly which resources are we talking about?
And then finally the grant is where it all comes together.
So let's talk about these one at a time.
The first one is the subject.
So examples of subjects could be the user.
So the user Bob or the team like Development
or an entire organization that we've created
like Finance for example.
Or it could also be a service account.
So once we define the subject,
then we're going to need a role
because subjects will eventually be granted roles.
So let's talk about roles.
A role defines what can be done.
So for example, they could have a View Only role
where they can only look at what's going on
in the universal control plane.
They cold have restricted control which is
a subset of full control.
So those are some examples of the different types
of roles that you might create.
And then we have what are called Resource Sets.
So resource sets are either swarm collections
or Kubernetes namespaces.
And each one of these has its own set of resources inside.
So swarm collections are made up of things
like containers, networks, nodes,
services, secrets, and volumes.
And Kubernetes namespaces are made up
of very similar concepts, pods, deployments,
network policies, nodes, services, secrets, and more.
Collections and namespaces together are called
resource sets.
So once you have your subject, your role,
and your resource in mind, it's then that
you perform your grant.
So grants are a combination of a subject, a role,
and a resource set, and they're really the ACL
or the Access Control List of Docker UCP.
Over in the universal control plane,
all of this that we just covered is configured
underneath User Management.
So it's here that you define your organizations,
your users, your roles, and then finally, your grants.
And this is what we'll be configuring
in another video in this course
where we configure role-based access control in UCP.