- [Instructor] In a production Docker infrastructure,
you're going to want to properly secure it,
using role-based access control,
in the Universal Control Plane.
So now let's go over in the UCP
and I'll walk you through the process of configuring RBAC
with a scenario in the Universal Control Plane.
So here in UCP let's take a scenario
that's actually over in the Docker documentation,
and I'll provide the link to it for you,
so that you can go check it out if you'd like.
The scenario is, by default,
administrators cannot pull images into the UCP cluster,
or into a Docker cluster that's managed by UCP.
So what if we wanted to allow a special user,
who happens to be a member of a special team,
in fact let's allow the whole team to be able to pull images
to the Docker cluster.
How would we go about doing that?
Well we would start up here with Organizations and Teams.
We'll click create and let's just call this IT
for the information technology department,
or organization in this case,
and then inside that organization
we're going to create a team,
and the team name is just going to be called developers.
We'll click Create.
And so now we have this team of developers
in the IT organization.
If we go in the Users we don't have a username Bob,
so let's create a new user named Bob.
Bob Smith is going to be his name.
And now he's not a Docker administrator,
he's just a regular user
but we'll give him some special privileges.
So we created Bob.
If we click on Bob, from here,
we cannot add or modify his team membership.
We have to actually go back into
the organizations and teams.
I'll go into the IT organization and then into developers,
and it's here that we can actually add users
to the developer team.
So we'll check Bob to add him to the team.
And now we can view the users and there we go.
Bob is active, he's an active developer,
he's in the IT organization.
As of yet he doesn't have any special privileges,
he doesn't have any roles.
So let's go in here and let's create a custom role next.
And we're going to give this a name,
called pull images,
and this is going to be a special role.
Now you don't wanna click Create yet,
you need to go in here to Operations
and there are a lot of different roles
that are all pre-defined here.
What we want in this case is,
the ability to load an image,
an image load is an image pull.
It's the same thing,
and we may want some of these other roles
in all practicality, in the real world,
but in this scenario we're just going to click Create here.
And so we successfully created this role, this new role,
that has the ability to load images or pull images.
So what do we need to do next?
Well we haven't assigned this role to the team
or to the user.
To do that we go into Grants,
and it's here that we need to create a new Grant.
And in this case,
we don't wanna assign it specifically to Bob,
we want to assign it actually to an organization.
So it's going to be the IT organization and a specific team,
the developers team.
We'll click next and then we're going to define
this new role here that we created, a custom role,
to be able to pull images.
I'll click Next and then finally,
we have to specify the resource set.
And in general we can just define this
to the Swarm collection.
But if you wanted to go down deeper here,
you could actually View Children,
and you could go down as deep as you'd like.
You can see this is really a tree here,
to grant this role with this user or team,
to a very specific resource set.
If the type is set to collections,
then you're talking about Docker Swarm.
If the type is set to namespaces,
then you're talking about Kubernetes.
In our case we're just going to define it to
the Swarm collection.
And click Create.
So with that, we have this new Grant,
where the team developers can pull images
to the object Swarm,
which in this case is the Docker Swarm cluster.
And by the way if you'd like to define custom collections,
it's not done here underneath Swarm.
It's actually done here under Shared Resources.
If we go into Collections,
it's here that we can view children
and then we can create custom collections
or namespaces, inside UCP.
And with that we have successfully configured
role-based access control in the Universal Control Plane.