Key components – level of control
Control and access control are very important aspects. This book is not about security, but it is impossible not to touch on the topic, especially when we talk about scale.
Who can administer the CI/CD platform? Who is the user? How do we separate projects/teams? Who can access what?
Many questions can be asked from an access and control perspective. Without delving into the monitoring side, let’s look at one security pattern that should be implemented in the CI/CD landscape – role-based access control (RBAC).
In short, RBAC enforces assigning permissions to users based on their role in the organization. With this approach, we do not manage users individually, and we do not need to think about what kind of access the imaginary John Doe should have. Everything comes from the central level of access control, and based on it, we add expected actions to groups. Let’s explore the following diagram:
...
