Roles

• Open F5 Distributed Cloud Console homepage, select Administration box.

Figure: Homepage

• Select IAM in left column menu > select Roles.

• Select > for any policy from the displayed list to view the policy information in JSON format.

Figure: Open Roles

Figure: In-built RBAC Policy Rules

Note: The api_groups field in the displayed information shows the API groups associated with the rule.

• Select ... (ellipsis) icon, or the linked number under API Groups column to view or edit.

• Select > for any group from the displayed list to view the group information in JSON format.

Figure: API Group Information

Note: The elements field in the displayed information shows the APIs associated with the group.

• Select ... (ellipsis) icon in Actions column.

• Select Edit.

Figure: API Group List

• Select Elements column linked number to view APIs in another window.

Figure: API Group List

• Review API Elements in this window for Path Ranges.

Figure: API Group Elements

Note: Roles are assigned to namespace, Shared applies to all services except system and application. System and Application are restricted as they are management namespaces for development, SeCops, etc. and not everyone needs or is allowed to access these areas of the console.

• On the F5 Distributed Cloud Console homepage, click the Administration box.

• From the left menu, select IAM.

• Select Roles > + Add Role.

Figure: Navigate to Roles

Role creation requires you to select API groups.

• Enter Name in Role Name box in pop-up window.

Note: When naming your custom role, follow the RFC 1035 naming convention. You can use lowercase letters (a-z), numbers (0-9), and hyphens (-). The first two characters MUST be lowercase letters (a-z). Example: aa-role2-k8s.

• Click + Allowed API Groups.

Note: Roles are assigned to namespaces. The "Shared" namespace applies to all services except system and application namespaces. "System" and "Application" namespaces are restricted, as they are used for management purposes (e.g., development, SeCops), and access to these areas is not required or permitted for everyone.

• Select the Allowed API Groups by checking box.

Note: Adding objects to a namespace after role creation does not automatically grant role access, you must manually add it.

• Click Save button to assign the selected API groups to the role.

Note: Select the value under the Elements column to view the list of APIs that are part of the associated group.

• Select the Allowed API Groups by checking box.

• Select Save button to create the role.

Note: Role cannot be created without selecting + Allowed API Groups.

Figure: API Group Selection

Note: When you add objects to a namespace, role access is not granted automatically, you must assign it manually.

Editing a Role in Administration:

• Go to IAM > Roles.

• Select the Role you want to edit.

• Click the ... (ellipsis) icon and choose the Edit option.

• Click the + Allowed API Groups button.

• Check boxes of Name, Namespace, and Elements rows that you want to grant access to for the role.

Note: Roles are assigned to namespaces. "Shared" applies to all services except for system and application namespaces. "System" and "Application" namespaces are restricted, as they are used for management purposes (e.g., development, SeCops), and not everyone requires or is allowed to access these areas of the console.

• Click the > button to view more options on subsequent pages.

• Click Save button to update the role access.

Figure: API Group Selection