OSDOCS#13454: Updates to the web console tutorial

[bergerhoffer]

Version(s):
4.19

Issue:
https://issues.redhat.com/browse/OSDOCS-13254

Link to docs preview:
https://91212--ocpdocs-pr.netlify.app/openshift-enterprise/latest/tutorials/dev-app-web-console

QE review:

• QE has approved this change.

Additional information:

Will need #90215 to merge first before can make changes to the web console assembly. Done

Note to reviewer: Some of the wording updates match what was already merged for the CLI version of the tutorial in #90215.

[ocpdocs-previewbot]

🤖 Thu Apr 10 12:51:44 - Prow CI generated the docs preview:

https://91212--ocpdocs-pr.netlify.app/
https://91212--ocpdocs-pr.netlify.app/openshift-enterprise/latest/tutorials/dev-app-cli.html
https://91212--ocpdocs-pr.netlify.app/openshift-enterprise/latest/tutorials/dev-app-web-console.html

[bergerhoffer]

@AlexonOliveiraRH I think we can remove the above line ("You have the appropriate roles..."). It's not in the CLI version. wdyt?

[AlexonOliveiraRH]

@AlexonOliveiraRH I think we can remove the above line ("You have the appropriate roles..."). It's not in the CLI version. wdyt?

@bergerhoffer although this is not CLI, permissions are bound across all clusters resources, independently of which platform you're using, i.e. CLI or web console, the user still needs to guarantee the proper permissions.

[bergerhoffer]

@AlexonOliveiraRH What permissions should we say that they need to have then? (And if we add it here, we should also add that to the CLI version)

[AlexonOliveiraRH]

@AlexonOliveiraRH What permissions should we say that they need to have then? (And if we add it here, we should also add that to the CLI version)

@bergerhoffer the minimum permission a user should have within a namespace scope to be able to deploy applications like this is the edit one, or the cluster admin could give the user also the admin permission within the namespace context only, which is a broader permission. More on this here: https://91212--ocpdocs-pr.netlify.app/openshift-enterprise/latest/authentication/using-rbac#default-roles_using-rbac

[bergerhoffer]

Hm, this still doesn't seem to check out to me, because if they are the ones that created the project, then shouldn't they automatically get whatever permissions needed to work in that project?

The only thing I could see saying here is about whether someone has access to the cluster, but doesn't have permission to create a project (if there is such a role like that). wdyt?

[AlexonOliveiraRH]

Hm, this still doesn't seem to check out to me, because if they are the ones that created the project, then shouldn't they automatically get whatever permissions needed to work in that project?

The only thing I could see saying here is about whether someone has access to the cluster, but doesn't have permission to create a project (if there is such a role like that). wdyt?

@bergerhoffer for example, the same user could get only a view permission, so this user would be able to navigate into the project, see things, but wouldn't be able to create nothing, neither change anything. That's why the cluster admin should grant this user at least edit permission (or admin in the namespace scope only) to create the project and do the rest of the tutorial. Also, the cluster admin could tweak RoleBindings to allow an user only to create a project, but not creating anything else inside it, but this is not a default behavior/permission.

[AlexonOliveiraRH]

@bergerhoffer well done! Everything worked like a charm. With the exception of some minor tweaking you may do, LGTM to move forward.

[bergerhoffer]

/label peer-review-needed

[bergerhoffer]

Note to peer reviewer: FYI that a lot of the wording updates (like procedure intros, etc.) match what was already merged for the CLI version of the tutorial in #90215.

[kcarmichael08]

This looks great! Had a few suggestions/questions but nothing big.

[bergerhoffer]

@AlexonOliveiraRH This is ready for another review.

If it helps, here's the diff of what I changed since the last time you reviewed: https://github.com/openshift/openshift-docs/compare/71e0935bd6792e1fca1d06db0995474cebe4d99e..edd229dc788dea603795722c4fc2b4a6f7b3c7ed

The main updates I'd want you to check are

1. The rewording of the secrets paragraph (the only open comment from above)
2. I ended up adding something to the tutorial prereqs about the necessary permissions needed to create projects and add to them. Please check that wording and see if that makes sense. I mentioned cluster-admin and edit roles as examples of what they'd need.

[AlexonOliveiraRH]

@AlexonOliveiraRH This is ready for another review.

If it helps, here's the diff of what I changed since the last time you reviewed: https://github.com/openshift/openshift-docs/compare/71e0935bd6792e1fca1d06db0995474cebe4d99e..edd229dc788dea603795722c4fc2b4a6f7b3c7ed

The main updates I'd want you to check are

1. The rewording of the secrets paragraph (the only open comment from above)
2. I ended up adding something to the tutorial prereqs about the necessary permissions needed to create projects and add to them. Please check that wording and see if that makes sense. I mentioned cluster-admin and edit roles as examples of what they'd need.

@bergerhoffer these changes LGTM, thank you. The only it needs to be fixed is exactly the permission part. Please, if you could change from cluster-admin to only admin and explain that this only into the namespace scope, because cluster-admin is a wide permission, cluster scope.

[bergerhoffer]

@AlexonOliveiraRH Okay here are my latest updates after our last discussions in Slack. I also went through and tested using Developer Sandbox, and found a few more little tweaks to make.

• Added to skip creating a project if using Developer Sandbox
• Noted places where the project name might be different if they're using Developer Sandbox or another project name
• Mentioned the roles required. I removed 'edit' as an option for the project-level perms, because they need at least 'admin' to grant the view permissions
• The secrets wording we talked about
• Found a few typos where parksmap should have been nationalparks, and made a few other small tweaks
• Mentioned that the browser may ask for their location, just so they're not surprised, so they know what it does.

Here's the diff if it helps: https://github.com/openshift/openshift-docs/compare/edd229dc788dea603795722c4fc2b4a6f7b3c7ed..1d43fbcf05161eeb56fbbf0c0c2377e6a9f89b6d

Let me know how these updates look, thanks!

[AlexonOliveiraRH]

@AlexonOliveiraRH Okay here are my latest updates after our last discussions in Slack. I also went through and tested using Developer Sandbox, and found a few more little tweaks to make.

Nice.

• Added to skip creating a project if using Developer Sandbox

Good catch.

• Noted places where the project name might be different if they're using Developer Sandbox or another project name

Good catch too.

• Mentioned the roles required. I removed 'edit' as an option for the project-level perms, because they need at least 'admin' to grant the view permissions

Sounds good to me.

• The secrets wording we talked about

Perfect.

• Found a few typos where parksmap should have been nationalparks, and made a few other small tweaks

Also a good catch.

• Mentioned that the browser may ask for their location, just so they're not surprised, so they know what it does.

Nice touch.

Here's the diff if it helps: https://github.com/openshift/openshift-docs/compare/edd229dc788dea603795722c4fc2b4a6f7b3c7ed..1d43fbcf05161eeb56fbbf0c0c2377e6a9f89b6d

Let me know how these updates look, thanks!

@bergerhoffer I just finished my review and kudos to you, ma'am. It looks very good to me. :) I think you addressed all the main points we discussed, specially the recent ones.

[bergerhoffer]

@yapei Here is the PR to update the web console tutorial. Can you PTAL when you get a chance?

Preview: https://91212--ocpdocs-pr.netlify.app/openshift-enterprise/latest/tutorials/dev-app-web-console

Similar changes were made to the CLI version of the tutorial in #90215, which has been approved/merged. This PR also makes a few further tweaks to the CLI version that we made after working on this web console version. Let me know if you have any questions, thanks!

[yapei]

@bergerhoffer Changes look perfect from QE's point of view, some tiny update requests above, PTAL

[openshift-ci]

@bergerhoffer: all tests passed!

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

[bergerhoffer]

@yapei I've updated the two items you pointed out, if you can take another look please. Thanks!

[yapei]

Thanks @bergerhoffer LGTM

[bergerhoffer]

/cherrypick enterprise-4.19

[openshift-cherrypick-robot]

@bergerhoffer: new pull request created: #92099

Details

In response to this:

/cherrypick enterprise-4.19

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.