From 34c3873aefe79fff7c7cb32a2f6d6e73abe63a61 Mon Sep 17 00:00:00 2001 From: Hii-Arpit Date: Fri, 11 Jul 2025 15:23:56 +0530 Subject: [PATCH 01/13] docs: update lock configurations --- .../global-configurations/lock-deployment-config.md | 11 ++++++++++- 1 file changed, 10 insertions(+), 1 deletion(-) diff --git a/docs/user-guide/global-configurations/lock-deployment-config.md b/docs/user-guide/global-configurations/lock-deployment-config.md index 265dcbf35..0aec9c87c 100644 --- a/docs/user-guide/global-configurations/lock-deployment-config.md +++ b/docs/user-guide/global-configurations/lock-deployment-config.md @@ -27,7 +27,16 @@ Whereas, the 'lock deployment configuration' feature goes one step further. It i Users need to have super-admin permission to lock deployment keys. {% endhint %} -1. Go to **Global Configurations** → **Lock Deployment Config**. Click **Configure Lock**. +To lock deployment keys, you first need to create a profile and then apply it to the desired apps. + +{% hint style="Tip" %} +### Who is a Lock Deployment Profile? +A Lock Deployment profile is a template which specifies which keys in the deployment template can be edited or locked. It enables super-admins to manage which deployment template keys other users can modify. By using profiles, super-admins can manage edit access at different levels, such as, global, cluster, environment, application, or a combination of application and environment. + +This allows for better control by making sure critical deployment template keys are locked in sensitive environments (production), while giving flexibility to change deployment template keys in other less critical environments (QA, Staging, etc.). +{% endhint %} + +1. Go to **Global Configurations** → **Lock Deployment Configuration**. Click **Configure Lock**. ![Figure 2: Configure Lock Button](https://devtron-public-asset.s3.us-east-2.amazonaws.com/images/global-configurations/lock-dt/lock-deployment-config.jpg) From 84c035c02abe324fbf1c22914fc4c3b2e8a952a6 Mon Sep 17 00:00:00 2001 From: Hii-Arpit Date: Mon, 14 Jul 2025 16:27:28 +0530 Subject: [PATCH 02/13] docs: added create profile --- .../lock-deployment-config.md | 42 +++++++++++++++---- 1 file changed, 35 insertions(+), 7 deletions(-) diff --git a/docs/user-guide/global-configurations/lock-deployment-config.md b/docs/user-guide/global-configurations/lock-deployment-config.md index 0aec9c87c..122cb7bdc 100644 --- a/docs/user-guide/global-configurations/lock-deployment-config.md +++ b/docs/user-guide/global-configurations/lock-deployment-config.md @@ -27,7 +27,7 @@ Whereas, the 'lock deployment configuration' feature goes one step further. It i Users need to have super-admin permission to lock deployment keys. {% endhint %} -To lock deployment keys, you first need to create a profile and then apply it to the desired apps. +To lock deployment keys, you first need to create a profile and apply it to the specific deployment templates. {% hint style="Tip" %} ### Who is a Lock Deployment Profile? @@ -36,26 +36,54 @@ A Lock Deployment profile is a template which specifies which keys in the deploy This allows for better control by making sure critical deployment template keys are locked in sensitive environments (production), while giving flexibility to change deployment template keys in other less critical environments (QA, Staging, etc.). {% endhint %} -1. Go to **Global Configurations** → **Lock Deployment Configuration**. Click **Configure Lock**. +### Creating Profile - ![Figure 2: Configure Lock Button](https://devtron-public-asset.s3.us-east-2.amazonaws.com/images/global-configurations/lock-dt/lock-deployment-config.jpg) +To create a profile, follow the below steps: -2. (Optional) Click **Refer Values.YAML** to check which keys you wish to lock. +1. Go to **Global Configurations** → **Lock Deployment Configuration**. Click **+ Create Profile**; a new **Create Profile** page will open. + + ![Figure 2: Creating Profile](https://devtron-public-asset.s3.us-east-2.amazonaws.com/images/global-configurations/lock-dt/lock-deployment-config.jpg) + +2. Enter the **Name** (Required) and a **Description** (Optional) for the profile. + +3. (Optional) Click **Refer Values.YAML** to check which keys you wish to lock. + + * Select the relevant Chart type and its version to reference the keys. ![Figure 3: Values.YAML File](https://devtron-public-asset.s3.us-east-2.amazonaws.com/images/global-configurations/lock-dt/values-yaml.jpg) -3. Enter the keys inside the editor on the left-hand side, e.g., `autoscaling.MaxReplicas`. Use JSONpath expressions to enter specific keys, lists, or objects to lock. +4. Enter the keys inside the editor on the left-hand side, e.g., `autoscaling.MaxReplicas`. Use [JSONpath expressions](https://goessner.net/articles/JsonPath/index.html) to enter specific keys, lists, or objects to lock. ![Figure 4: Referring Values.YAML File for Locking Keys](https://devtron-public-asset.s3.us-east-2.amazonaws.com/images/global-configurations/lock-dt/autoscaling-lock.jpg) -4. Click **Save**. +5. Click **Save Changes**. ![Figure 5: Saving Locked Keys](https://devtron-public-asset.s3.us-east-2.amazonaws.com/images/global-configurations/lock-dt/saving-locked-keys.jpg) -5. A confirmation dialog box would appear. Read it and click **Confirm**. +6. Profile will be created, and available under the **Profiles** tab. ![Figure 6: Confirmation Dialog](https://devtron-public-asset.s3.us-east-2.amazonaws.com/images/global-configurations/lock-dt/confirmation.jpg) +### Applying Profile + +After creating a profile, the next step is to apply the profile to the specific deployment templates according to your use case. To apply a profile follow the below steps: + +1. Go to **Global Configurations** → **Lock Deployment Configuration**. Click **Apply Profile**; a new **Apply Profile** page will open. + +2. Select the profiles which you want to apply from the dropdown under **Select profiles to apply**. + + * You can select multiple Profiles. + +3. Select how you want to apply the profiles under **Apply selected profiles to deployment templates of**. + + * There are 3 options you can choose from + + |Method|Description| + |:---|:---| + |**Specific deployment templates**|Choose this method if you want to apply profile| + |**By match criteria**|| + |**Global (All deployment templates)**|| + --- ## Result From a79c54fef880b209c0ec1cf95ef81f20db5be57d Mon Sep 17 00:00:00 2001 From: Hii-Arpit Date: Mon, 14 Jul 2025 16:27:59 +0530 Subject: [PATCH 03/13] docs: fixes --- .../lock-deployment-config.md | 24 ++++++++++++++++--- 1 file changed, 21 insertions(+), 3 deletions(-) diff --git a/docs/user-guide/global-configurations/lock-deployment-config.md b/docs/user-guide/global-configurations/lock-deployment-config.md index 122cb7bdc..121281203 100644 --- a/docs/user-guide/global-configurations/lock-deployment-config.md +++ b/docs/user-guide/global-configurations/lock-deployment-config.md @@ -80,10 +80,28 @@ After creating a profile, the next step is to apply the profile to the specific |Method|Description| |:---|:---| - |**Specific deployment templates**|Choose this method if you want to apply profile| - |**By match criteria**|| - |**Global (All deployment templates)**|| + |**Specific deployment templates**|Choose this option if you want to apply profile to specific deployment templates. Refer to [Specific deployment templates](#specific-deployment-templates) to learn more.| + |**By match criteria**|Choose this option to apply the profile based on specific criteria, such as applying it to the deployment templates of an entire project.| + |**Global (All deployment templates)**|Choose this option if you want to apply profile to all deployment template.| + + #### Specific deployment templates + This option allows you to apply the Lock Deployment profile to the deployment template of a specific application within a particular environment. + + To do so, follow the below steps; + + 1. Select the **Specific deployment templates** option under **Apply selected profiles to deployment templates of**. + + 2. Apply a filter from the dropdown to view deployment templates. + + * Deployment templates can be filtered by: + + |Filter|Description| + |:---|:---| + |Project|This option allows you to filter the deployment templates based on **Projects**, and it will display all applications available in the selected projects along with their environments.| + |Application|This option allows to filter the deployment templates based on **Applications**, and it will display the selected applications along with their environments.| + |Cluster|| + |Environment|| --- ## Result From 73c60dc3374d1df7c073f66d79a27a0acb4a5835 Mon Sep 17 00:00:00 2001 From: Hii-Arpit Date: Thu, 17 Jul 2025 18:36:02 +0530 Subject: [PATCH 04/13] docs: add apply profile --- .../lock-deployment-config.md | 32 +++++++++++++++---- 1 file changed, 26 insertions(+), 6 deletions(-) diff --git a/docs/user-guide/global-configurations/lock-deployment-config.md b/docs/user-guide/global-configurations/lock-deployment-config.md index 121281203..c6e44fb01 100644 --- a/docs/user-guide/global-configurations/lock-deployment-config.md +++ b/docs/user-guide/global-configurations/lock-deployment-config.md @@ -76,7 +76,7 @@ After creating a profile, the next step is to apply the profile to the specific 3. Select how you want to apply the profiles under **Apply selected profiles to deployment templates of**. - * There are 3 options you can choose from + There are 3 options you can choose from |Method|Description| |:---|:---| @@ -86,7 +86,7 @@ After creating a profile, the next step is to apply the profile to the specific #### Specific deployment templates - This option allows you to apply the Lock Deployment profile to the deployment template of a specific application within a particular environment. + This option allows you to apply the lock deployment configuration profile to the deployment template of a specific application within a particular environment. To do so, follow the below steps; @@ -98,10 +98,30 @@ After creating a profile, the next step is to apply the profile to the specific |Filter|Description| |:---|:---| - |Project|This option allows you to filter the deployment templates based on **Projects**, and it will display all applications available in the selected projects along with their environments.| - |Application|This option allows to filter the deployment templates based on **Applications**, and it will display the selected applications along with their environments.| - |Cluster|| - |Environment|| + |**Project**|This option allows you to filter the deployment templates based on **Projects**, and it will display all applications available in the selected projects along with their environments.| + |**Application**|This option allows you to filter the deployment templates based on **Applications**, and it will display the selected applications along with their environments.| + |**Cluster**|This option allows you to filter the deployment templates based on **Cluster**, and it will display all applications in the selected clusters along with their environments.| + |**Environment**|This option allows you to filter the deployment templates based on **Environments**, and it will display all the applications in the selected Environments.| + + 3. Select the applications for which you want to apply the profile. + + #### By Match Criteria + + This option allows you to apply the lock deployment configuration profile to the deployment templates of all the applications matching certain criteria. + + For example, + + * Suppose, you want to apply a lock deployment configuration profile to all applications in a particular project, you can achieve this by selecting that project as the match criteria. + + * Now, let's say your use case is even more specific, suppose you want to apply the lock deployment configuration profile to all the application's deployment templates in a particular cluster, that also belongs to a specific project and are deployed in a certain environment, then, you can choose your required **Cluster**, **Project** and **Environment** as the match criteria. Devtron will then apply the profile only to those application's deployment templates that meet every single one of the criteria you have selected. + + * If you have selected multiple options in a particular category, let's say you have selected multiple environments and a project as the match criteria, then the profile will apply to all the applications in that particular project that are deployed to any of the environments you have selected as the match criteria. + + #### Global (All deployment templates) + + This option allows you to apply the lock deployment configuration profile to all the existing and future deployment templates across all the applications. + +4. Click **Save Changes** and the selected profiles will apply on the required deployment templates. --- ## Result From ffd8477ddd7d49d1265839975f0707acad5f678f Mon Sep 17 00:00:00 2001 From: Hii-Arpit Date: Thu, 17 Jul 2025 18:47:11 +0530 Subject: [PATCH 05/13] docs: refined the structure --- .../lock-deployment-config.md | 31 +++++++++++++------ 1 file changed, 22 insertions(+), 9 deletions(-) diff --git a/docs/user-guide/global-configurations/lock-deployment-config.md b/docs/user-guide/global-configurations/lock-deployment-config.md index c6e44fb01..b8ba1613e 100644 --- a/docs/user-guide/global-configurations/lock-deployment-config.md +++ b/docs/user-guide/global-configurations/lock-deployment-config.md @@ -107,21 +107,34 @@ After creating a profile, the next step is to apply the profile to the specific #### By Match Criteria - This option allows you to apply the lock deployment configuration profile to the deployment templates of all the applications matching certain criteria. - - For example, - - * Suppose, you want to apply a lock deployment configuration profile to all applications in a particular project, you can achieve this by selecting that project as the match criteria. - - * Now, let's say your use case is even more specific, suppose you want to apply the lock deployment configuration profile to all the application's deployment templates in a particular cluster, that also belongs to a specific project and are deployed in a certain environment, then, you can choose your required **Cluster**, **Project** and **Environment** as the match criteria. Devtron will then apply the profile only to those application's deployment templates that meet every single one of the criteria you have selected. + This option allows you to apply the lock deployment configuration profile to the deployment templates of all the applications matching certain criteria. To apply the lock deployment profile, follow the below steps: + + 1. Select the **By match criteria** option under **Apply selected profiles to deployment templates of**. + + 2. Select the match criteria by applying the filter from the dropdown based on: + + |Filter|Description| + |:---|:---| + |**Project**|This option allows you to filter the deployment templates based on **Projects**, and it will display all applications available in the selected projects along with their environments.| + |**Application**|This option allows you to filter the deployment templates based on **Applications**, and it will display the selected applications along with their environments.| + |**Cluster**|This option allows you to filter the deployment templates based on **Cluster**, and it will display all applications in the selected clusters along with their environments.| + |**Environment**|This option allows you to filter the deployment templates based on **Environments**, and it will display all the applications in the selected Environments.| + + For example: + + * Suppose, you want to apply a lock deployment configuration profile to all applications in a particular project, you can achieve this by selecting that project as the match criteria. + + * Now, let's say your use case is even more specific, suppose you want to apply the lock deployment configuration profile to all the application's deployment templates in a particular cluster, that also belongs to a specific project and are deployed in a certain environment, then, you can choose your required **Cluster**, **Project** and **Environment** as the match criteria. Devtron will then apply the profile only to those application's deployment templates that meet every single one of the criteria you have selected. + + * If you have selected multiple options in a particular category, let's say you have selected multiple environments and a project as the match criteria, then the profile will apply to all the applications in that particular project that are deployed to any of the environments you have selected as the match criteria. - * If you have selected multiple options in a particular category, let's say you have selected multiple environments and a project as the match criteria, then the profile will apply to all the applications in that particular project that are deployed to any of the environments you have selected as the match criteria. #### Global (All deployment templates) - This option allows you to apply the lock deployment configuration profile to all the existing and future deployment templates across all the applications. + This option allows you to apply the lock deployment configuration profile to all the existing and future deployment templates across all the applications. To apply the lock deployment profile to all deployment templates, Select the **Global (All deployment templates)** option under **Apply selected profiles to deployment templates of**. 4. Click **Save Changes** and the selected profiles will apply on the required deployment templates. + --- ## Result From dd3efec2e05c93b64948c65333cf7dd49fe3f7c4 Mon Sep 17 00:00:00 2001 From: Hii-Arpit Date: Mon, 21 Jul 2025 15:07:58 +0530 Subject: [PATCH 06/13] docs: fixes --- .../global-configurations/lock-deployment-config.md | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) diff --git a/docs/user-guide/global-configurations/lock-deployment-config.md b/docs/user-guide/global-configurations/lock-deployment-config.md index b8ba1613e..698da134e 100644 --- a/docs/user-guide/global-configurations/lock-deployment-config.md +++ b/docs/user-guide/global-configurations/lock-deployment-config.md @@ -70,10 +70,14 @@ After creating a profile, the next step is to apply the profile to the specific 1. Go to **Global Configurations** → **Lock Deployment Configuration**. Click **Apply Profile**; a new **Apply Profile** page will open. + ![]() + 2. Select the profiles which you want to apply from the dropdown under **Select profiles to apply**. * You can select multiple Profiles. + ![]() + 3. Select how you want to apply the profiles under **Apply selected profiles to deployment templates of**. There are 3 options you can choose from @@ -83,6 +87,8 @@ After creating a profile, the next step is to apply the profile to the specific |**Specific deployment templates**|Choose this option if you want to apply profile to specific deployment templates. Refer to [Specific deployment templates](#specific-deployment-templates) to learn more.| |**By match criteria**|Choose this option to apply the profile based on specific criteria, such as applying it to the deployment templates of an entire project.| |**Global (All deployment templates)**|Choose this option if you want to apply profile to all deployment template.| + + ![]() #### Specific deployment templates @@ -183,5 +189,4 @@ Only a super-admin, manager, or application admin can edit the configuration val ![Figure 14: Proposing Changes to Protected Config](https://devtron-public-asset.s3.us-east-2.amazonaws.com/images/global-configurations/lock-dt/proposing-changes.jpg) -The same result can be seen if the user tries to edit environment-specific deployment templates. - +The same result can be seen if the user tries to edit environment-specific deployment templates. \ No newline at end of file From a9df273eae733bb2ea19092bf44f93fbb058d84a Mon Sep 17 00:00:00 2001 From: Hii-Arpit Date: Wed, 23 Jul 2025 02:08:41 +0530 Subject: [PATCH 07/13] docs: Added figures and captions --- .../lock-deployment-config.md | 206 +++++++++++++----- 1 file changed, 154 insertions(+), 52 deletions(-) diff --git a/docs/user-guide/global-configurations/lock-deployment-config.md b/docs/user-guide/global-configurations/lock-deployment-config.md index 698da134e..b4c01f6a3 100644 --- a/docs/user-guide/global-configurations/lock-deployment-config.md +++ b/docs/user-guide/global-configurations/lock-deployment-config.md @@ -30,7 +30,7 @@ Users need to have super-admin permission to lock deployment keys. To lock deployment keys, you first need to create a profile and apply it to the specific deployment templates. {% hint style="Tip" %} -### Who is a Lock Deployment Profile? +### What is a Lock Deployment Profile? A Lock Deployment profile is a template which specifies which keys in the deployment template can be edited or locked. It enables super-admins to manage which deployment template keys other users can modify. By using profiles, super-admins can manage edit access at different levels, such as, global, cluster, environment, application, or a combination of application and environment. This allows for better control by making sure critical deployment template keys are locked in sensitive environments (production), while giving flexibility to change deployment template keys in other less critical environments (QA, Staging, etc.). @@ -70,13 +70,13 @@ After creating a profile, the next step is to apply the profile to the specific 1. Go to **Global Configurations** → **Lock Deployment Configuration**. Click **Apply Profile**; a new **Apply Profile** page will open. - ![]() + ![Figure 7: Clicking 'Apply Profile'](https://devtron-public-asset.s3.us-east-2.amazonaws.com/images/global-configurations/lock-dt/lock-config-apply-profile.jpg) 2. Select the profiles which you want to apply from the dropdown under **Select profiles to apply**. * You can select multiple Profiles. - ![]() + ![Figure 8: Selecting Lock Deployment Configuration Profile](https://devtron-public-asset.s3.us-east-2.amazonaws.com/images/global-configurations/lock-dt/lock-config-select-profile.jpg) 3. Select how you want to apply the profiles under **Apply selected profiles to deployment templates of**. @@ -84,109 +84,211 @@ After creating a profile, the next step is to apply the profile to the specific |Method|Description| |:---|:---| - |**Specific deployment templates**|Choose this option if you want to apply profile to specific deployment templates. Refer to [Specific deployment templates](#specific-deployment-templates) to learn more.| - |**By match criteria**|Choose this option to apply the profile based on specific criteria, such as applying it to the deployment templates of an entire project.| - |**Global (All deployment templates)**|Choose this option if you want to apply profile to all deployment template.| + |**Specific deployment templates**|Choose this option if you want to apply profile to Specific deployment templates.
  • Refer [Specific Deployment Templates](#specific-deployment-templates) to know more.
      • | + |**By match criteria**|Choose this option to apply the profile based on specific criteria, such as applying it to the deployment templates of an entire project.
      • Refer [By match criteria](#by-match-criteria) to know more.
          • | + |**Global (All deployment templates)**|Choose this option if you want to apply profile to all deployment template.
          • Refer [Global (All Deployment Templates)](#global-all-deployment-templates) to know more.
              • | - ![]() + ![Figure 9: Selecting Apply Method](https://devtron-public-asset.s3.us-east-2.amazonaws.com/images/global-configurations/lock-dt/lock-config-apply-methods.jpg) - #### Specific deployment templates +### Specific Deployment Templates - This option allows you to apply the lock deployment configuration profile to the deployment template of a specific application within a particular environment. +This option allows you to apply the lock deployment configuration profile to the deployment template of a specific application within a particular environment. - To do so, follow the below steps; +To do so, follow the below steps: - 1. Select the **Specific deployment templates** option under **Apply selected profiles to deployment templates of**. +1. Select the **Specific deployment templates** option under **Apply selected profiles to deployment templates of**. - 2. Apply a filter from the dropdown to view deployment templates. +2. Apply a filter from the dropdown to view deployment templates. - * Deployment templates can be filtered by: + * Deployment templates can be filtered by: - |Filter|Description| - |:---|:---| - |**Project**|This option allows you to filter the deployment templates based on **Projects**, and it will display all applications available in the selected projects along with their environments.| - |**Application**|This option allows you to filter the deployment templates based on **Applications**, and it will display the selected applications along with their environments.| - |**Cluster**|This option allows you to filter the deployment templates based on **Cluster**, and it will display all applications in the selected clusters along with their environments.| - |**Environment**|This option allows you to filter the deployment templates based on **Environments**, and it will display all the applications in the selected Environments.| + |Filter|Description| + |:---|:---| + |**Project**|This option allows you to filter the deployment templates based on **Projects**, and it will display all applications available in the selected projects along with their environments.| + |**Application**|This option allows you to filter the deployment templates based on **Applications**, and it will display the selected applications along with their environments.| + |**Cluster**|This option allows you to filter the deployment templates based on **Cluster**, and it will display all applications in the selected clusters along with their environments.| + |**Environment**|This option allows you to filter the deployment templates based on **Environments**, and it will display all the applications in the selected Environments.| - 3. Select the applications for which you want to apply the profile. +3. Select the applications for which you want to apply the profile. - #### By Match Criteria + ![Figure 10: Applying Profile for Specific Deployment Templates ](https://devtron-public-asset.s3.us-east-2.amazonaws.com/images/global-configurations/lock-dt/lock-config-specific-apps.gif) + +### By Match Criteria - This option allows you to apply the lock deployment configuration profile to the deployment templates of all the applications matching certain criteria. To apply the lock deployment profile, follow the below steps: +This option allows you to apply the lock deployment configuration profile to the deployment templates of all the applications matching certain criteria. To apply the lock deployment profile, follow the below steps: + +1. Select the **By match criteria** option under **Apply selected profiles to deployment templates of**. - 1. Select the **By match criteria** option under **Apply selected profiles to deployment templates of**. +2. Select the match criteria by applying the filter from the dropdown based on: - 2. Select the match criteria by applying the filter from the dropdown based on: + |Filter|Description| + |:---|:---| + |**Project**|This option allows you to filter the deployment templates based on **Projects**, and it will display all applications available in the selected projects along with their environments.| + |**Application**|This option allows you to filter the deployment templates based on **Applications**, and it will display the selected applications along with their environments.| + |**Cluster**|This option allows you to filter the deployment templates based on **Cluster**, and it will display all applications in the selected clusters along with their environments.| + |**Environment**|This option allows you to filter the deployment templates based on **Environments**, and it will display all the applications in the selected Environments.| - |Filter|Description| - |:---|:---| - |**Project**|This option allows you to filter the deployment templates based on **Projects**, and it will display all applications available in the selected projects along with their environments.| - |**Application**|This option allows you to filter the deployment templates based on **Applications**, and it will display the selected applications along with their environments.| - |**Cluster**|This option allows you to filter the deployment templates based on **Cluster**, and it will display all applications in the selected clusters along with their environments.| - |**Environment**|This option allows you to filter the deployment templates based on **Environments**, and it will display all the applications in the selected Environments.| + Let's understand how to use **By match criteria** with the below use cases:
              - For example: + 1. Suppose, you want to apply a lock deployment configuration profile to all applications in a particular project, you can achieve this by selecting that project as the match criteria. - * Suppose, you want to apply a lock deployment configuration profile to all applications in a particular project, you can achieve this by selecting that project as the match criteria. + ![Figure 11a: Applying Profile By Match Criteria - Use Case 1](https://devtron-public-asset.s3.us-east-2.amazonaws.com/images/global-configurations/lock-dt/lock-config-match-criteria-use-case-1.gif) + + ![Figure 11b: Use Case 1 - Lock Deployment Templates using Single Criteria](https://devtron-public-asset.s3.us-east-2.amazonaws.com/images/global-configurations/lock-dt/lock-config-match-criteria-use-case-1.jpeg) - * Now, let's say your use case is even more specific, suppose you want to apply the lock deployment configuration profile to all the application's deployment templates in a particular cluster, that also belongs to a specific project and are deployed in a certain environment, then, you can choose your required **Cluster**, **Project** and **Environment** as the match criteria. Devtron will then apply the profile only to those application's deployment templates that meet every single one of the criteria you have selected. + 2. Now, let's say your use case is even more specific, suppose you want to apply the lock deployment configuration profile to all the applications' deployment templates in a particular cluster, belongs to a specific project and are deployed in a certain environment, then, you can choose your required **Cluster**, **Project** and **Environment** as the match criteria. Devtron will then apply the profile only to those applications' deployment templates that meet every single one of the criteria you have selected. + + ![Figure 12a: Applying Profile By Match Criteria - Use Case 2](https://devtron-public-asset.s3.us-east-2.amazonaws.com/images/global-configurations/lock-dt/lock-config-match-criteria-use-case-2.gif) + + ![Figure 12b: Use Case 2 - Lock Deployment Templates using Multiple Criteria](https://devtron-public-asset.s3.us-east-2.amazonaws.com/images/global-configurations/lock-dt/lock-config-match-criteria-use-case-2.jpeg) + + 3. In the above two use cases, we have selected only one option from each category, but let's say your use case requires to select multiple options from a particular category; let's say you want to apply the lock deployment configuration profile to multiple environments for a specific project, then, you can choose your required **Project** and multiple **Environments** as the match criteria, Devtron will then apply the profile to all the applications in that particular project that are deployed to any of the environments you have selected as the match criteria. + + ![Figure 13a: Applying Profile By Match Criteria - Use Case 2](https://devtron-public-asset.s3.us-east-2.amazonaws.com/images/global-configurations/lock-dt/lock-config-match-criteria-use-case-3.gif) + + ![Figure 13b: Use Case 3 - Lock Deployment Templates using multiple criteria from same category](https://devtron-public-asset.s3.us-east-2.amazonaws.com/images/global-configurations/lock-dt/lock-config-match-criteria-use-case-3.jpeg) - * If you have selected multiple options in a particular category, let's say you have selected multiple environments and a project as the match criteria, then the profile will apply to all the applications in that particular project that are deployed to any of the environments you have selected as the match criteria. +### Global (All Deployment Templates) - #### Global (All deployment templates) +This option allows you to apply the lock deployment configuration profile to all the existing and future deployment templates across all the applications. - This option allows you to apply the lock deployment configuration profile to all the existing and future deployment templates across all the applications. To apply the lock deployment profile to all deployment templates, Select the **Global (All deployment templates)** option under **Apply selected profiles to deployment templates of**. +To apply the lock deployment profile to all deployment templates, select the **Global (All deployment templates)** option under **Apply selected profiles to deployment templates of**. -4. Click **Save Changes** and the selected profiles will apply on the required deployment templates. + ![Figure 14: Applying Profile for all the Deployment Templates](https://devtron-public-asset.s3.us-east-2.amazonaws.com/images/global-configurations/lock-dt/lock-config-global.gif) + + +4. Click **Save Changes** and the selected profiles will apply on the required deployment templates and will be visible under **Applied Profiles** tab. --- ## Result -While super-admins can directly edit the locked keys, let's look at a scenario where a user (non-super-admin) tries to edit the same in an [unprotected](../../user-guide/creating-application/config-approval.md) base deployment template. +Once the lock deployment configuration profile is applied to the deployment templates, only super admins can edit the locked keys directly.Non-super admin users cannot edit the locked keys for those deployment templates. + +Let's look at a scenario where a user (non-super-admin) tries to edit the same in an [unprotected](../../user-guide/creating-application/config-approval.md) base deployment template. + + +### Viewing Locked Keys * User can hide/unhide the locked keys as shown below. - ![Figure 7: Hiding Locked Keys](https://devtron-public-asset.s3.us-east-2.amazonaws.com/images/global-configurations/lock-dt/hide-locked-keys.gif) + ![Figure 15: Hiding Locked Keys](https://devtron-public-asset.s3.us-east-2.amazonaws.com/images/global-configurations/lock-dt/hide-locked-keys.gif) -{% hint style="info" %} -GUI or YAML Mode
              -If you select 'Basic' mode instead of 'Advanced (YAML)', all the keys meant for basic mode will be displayed in the GUI even if some are locked. While users can modify these keys, they cannot save the changes made to the locked keys. -{% endhint %} + {% hint style="info" %} + GUI or YAML Mode
              + If you select 'Basic' mode instead of 'Advanced (YAML)', all the keys meant for basic mode will be displayed in the GUI even if some are locked. While users can modify these keys, they cannot save the changes made to the locked keys. + {% endhint %} + +### Editing Locked Keys * Let's assume the user edits one of the locked keys... - ![Figure 8: Editing Locked Keys](https://devtron-public-asset.s3.us-east-2.amazonaws.com/images/global-configurations/lock-dt/change-locked-values.gif) + ![Figure 16: Editing Locked Keys](https://devtron-public-asset.s3.us-east-2.amazonaws.com/images/global-configurations/lock-dt/change-locked-values.gif) ...and saves the changes. - ![Figure 9: Saving Edits to Locked Keys](https://devtron-public-asset.s3.us-east-2.amazonaws.com/images/global-configurations/lock-dt/changing-values.jpg) + ![Figure 17: Saving Edits to Locked Keys](https://devtron-public-asset.s3.us-east-2.amazonaws.com/images/global-configurations/lock-dt/changing-values.jpg) * A modal window will appear on the right highlighting the non-eligible edits. - ![Figure 10: Eligible and Non-eligible Changes](https://devtron-public-asset.s3.us-east-2.amazonaws.com/images/global-configurations/lock-dt/not-eligible-changes.jpg) + ![Figure 18: Eligible and Non-eligible Changes](https://devtron-public-asset.s3.us-east-2.amazonaws.com/images/global-configurations/lock-dt/not-eligible-changes.jpg) + +### Editing Unlocked Keys * Let's assume the user edits a key that is not locked or adds a new key. - ![Figure 11: Editing Allowed Keys](https://devtron-public-asset.s3.us-east-2.amazonaws.com/images/global-configurations/lock-dt/changing-allowed-values.jpg) + ![Figure 19: Editing Allowed Keys](https://devtron-public-asset.s3.us-east-2.amazonaws.com/images/global-configurations/lock-dt/changing-allowed-values.jpg) * The modal window will highlight the eligible edits. However, it will not let the user save those eligible edits unless the user clicks the checkbox: **Save changes which are eligible for update**. - ![Figure 12: Saving Eligible Changes](https://devtron-public-asset.s3.us-east-2.amazonaws.com/images/global-configurations/lock-dt/saving-allowed-changes.jpg) + ![Figure 20: Saving Eligible Changes](https://devtron-public-asset.s3.us-east-2.amazonaws.com/images/global-configurations/lock-dt/saving-allowed-changes.jpg) {% hint style="warning" %} ### Who Can Perform This Action? Only a super-admin, manager, or application admin can edit the configuration values. {% endhint %} -* Once the user clicks the **Update** button, the permissible changes will reflect in the deployment template. +* Once the user clicks the **Save Changes** button, the permissible changes will reflect in the deployment template. - ![Figure 13: Updating Deployment Config](https://devtron-public-asset.s3.us-east-2.amazonaws.com/images/global-configurations/lock-dt/updating-changes.jpg) + ![Figure 21: Updating Deployment Config](https://devtron-public-asset.s3.us-east-2.amazonaws.com/images/global-configurations/lock-dt/updating-changes.jpg) However, if it's a [protected template](../../user-guide/creating-application/config-approval.md), the user will require the approval of a [configuration approver](./user-access.md#devtron-apps-permissions) as shown below. - ![Figure 14: Proposing Changes to Protected Config](https://devtron-public-asset.s3.us-east-2.amazonaws.com/images/global-configurations/lock-dt/proposing-changes.jpg) + ![Figure 22: Proposing Changes to Protected Config](https://devtron-public-asset.s3.us-east-2.amazonaws.com/images/global-configurations/lock-dt/proposing-changes.jpg) + +The same result can be seen if the user tries to edit environment-specific deployment templates. + +--- + +## Updating an Applied Profile + +To update an existing applied profile, follow the below steps: + +1. Go to **Global Configurations** → **Lock Deployment Configuration**. + +2. Click **Applied Profiles** tab and click the `⋮` button next to the preferred applied profile. + +3. Click **Manage Policy** to add or remove the profiles. If you have applied the profile using match criteria then, you can also click **Edit match criteria** to edit the match criteria. + +4. Click **Save Changes**. + +![Figure 23a: Editing Applied Profiles](https://devtron-public-asset.s3.us-east-2.amazonaws.com/images/global-configurations/lock-dt/lock-config-edit-profiles.gif) + +![Figure 23b: Editing Match Criteria](https://devtron-public-asset.s3.us-east-2.amazonaws.com/images/global-configurations/lock-dt/lock-config-edit-match-criteria.gif) + +--- -The same result can be seen if the user tries to edit environment-specific deployment templates. \ No newline at end of file +## Removing an Applied Profile + +To remove an applied profile, follow the below steps: + +1. Go to **Global Configurations** → **Lock Deployment Configuration**. + +2. Click **Applied Profiles** tab and click the `⋮` button next to the preferred applied profile. + +3. Click **Delete** and the applied profile will be removed. + +![Figure 24: Removing an Applied Profile](https://devtron-public-asset.s3.us-east-2.amazonaws.com/images/global-configurations/lock-dt/lock-config-delete-applied-profile.gif) + +{% hint style="warning" %} +### Note +Removing an applied profile does not delete the lock deployment configuration profile. It only removes the associated restrictions from the deployment templates where the profile was applied. +{% endhint %} + +--- + +## Updating Profile + +To update a lock deployment configuration file, follow the steps below: + +1. Go to **Global Configurations** → **Lock Deployment Configuration**. + +2. Click the **Profiles** tab and then click the edit button next to the preferred profile. + +3. Edit the profile. + +4. Click **Save Changes**. + +![Figure 25: Updating Lock Deployment Configuration File](https://devtron-public-asset.s3.us-east-2.amazonaws.com/images/global-configurations/lock-dt/lock-config-edit-profile.gif) + +--- + +## Deleting Profile + +To delete a lock deployment configuration file, follow the steps below: + +1. Go to **Global Configurations** → **Lock Deployment Configuration**. + +2. Click the **Profiles** tab and then click the delete button next to the preferred profile. + +3. A pop window will appear, prompting you to enter the profile name for confirmation. + +4. Enter the name of the profile and click **Delete**. + +![Figure 26: Deleting Lock Deployment Configuration File](https://devtron-public-asset.s3.us-east-2.amazonaws.com/images/global-configurations/lock-dt/lock-config-delete-profile.gif) + +{% hint style="warning" %} +### Note +Deleting a profile will automatically remove it from the Applied Profiles tab and remove its restrictions from all deployment templates where it was previously applied. +{% endhint %} \ No newline at end of file From 4e631939f277828d88909ad1e44bc1ede795fd47 Mon Sep 17 00:00:00 2001 From: Arpit Agrawal Date: Wed, 23 Jul 2025 02:18:02 +0530 Subject: [PATCH 08/13] docs: fixes docs: fixes --- .../lock-deployment-config.md | 48 +++++++++---------- 1 file changed, 24 insertions(+), 24 deletions(-) diff --git a/docs/user-guide/global-configurations/lock-deployment-config.md b/docs/user-guide/global-configurations/lock-deployment-config.md index b4c01f6a3..bd288d391 100644 --- a/docs/user-guide/global-configurations/lock-deployment-config.md +++ b/docs/user-guide/global-configurations/lock-deployment-config.md @@ -16,7 +16,7 @@ This stands true for deployment templates in: The 'protect configuration' feature is meant to verify the edits by introducing an approval flow for any changes made to the configuration files, i.e., Deployment template, ConfigMaps, and Secrets. Refer [Approval Policy](../global-configurations/approval-policy.md). -Whereas, the 'lock deployment configuration' feature goes one step further. It is meant to prevent any edits to specific keys by non-super-admins. This applies only to deployment templates and is performed at global-level. --> +Whereas, the 'lock deployment configuration' feature goes one step further. It is meant to prevent any edits to specific keys by non-super-admins. This applies only to deployment templates and is performed at the global level. --> --- @@ -27,18 +27,18 @@ Whereas, the 'lock deployment configuration' feature goes one step further. It i Users need to have super-admin permission to lock deployment keys. {% endhint %} -To lock deployment keys, you first need to create a profile and apply it to the specific deployment templates. +To lock deployment keys, you must first create a profile and apply it to the specific deployment templates. {% hint style="Tip" %} ### What is a Lock Deployment Profile? -A Lock Deployment profile is a template which specifies which keys in the deployment template can be edited or locked. It enables super-admins to manage which deployment template keys other users can modify. By using profiles, super-admins can manage edit access at different levels, such as, global, cluster, environment, application, or a combination of application and environment. +A Lock Deployment profile is a template that specifies which keys in the deployment template can be edited or locked. It enables super-admins to manage which deployment template keys other users can modify. By using profiles, super-admins can manage edit access at different levels, such as global, cluster, environment, application, or a combination of application and environment. This allows for better control by making sure critical deployment template keys are locked in sensitive environments (production), while giving flexibility to change deployment template keys in other less critical environments (QA, Staging, etc.). {% endhint %} ### Creating Profile -To create a profile, follow the below steps: +To create a profile, follow the steps below: 1. Go to **Global Configurations** → **Lock Deployment Configuration**. Click **+ Create Profile**; a new **Create Profile** page will open. @@ -66,13 +66,13 @@ To create a profile, follow the below steps: ### Applying Profile -After creating a profile, the next step is to apply the profile to the specific deployment templates according to your use case. To apply a profile follow the below steps: +After creating a profile, the next step is to apply the profile to the specific deployment templates according to your use case. To apply a profile, follow the steps below: 1. Go to **Global Configurations** → **Lock Deployment Configuration**. Click **Apply Profile**; a new **Apply Profile** page will open. ![Figure 7: Clicking 'Apply Profile'](https://devtron-public-asset.s3.us-east-2.amazonaws.com/images/global-configurations/lock-dt/lock-config-apply-profile.jpg) -2. Select the profiles which you want to apply from the dropdown under **Select profiles to apply**. +2. Select the profiles that you want to apply from the dropdown under **Select profiles to apply**. * You can select multiple Profiles. @@ -80,13 +80,13 @@ After creating a profile, the next step is to apply the profile to the specific 3. Select how you want to apply the profiles under **Apply selected profiles to deployment templates of**. - There are 3 options you can choose from + There are three options you can choose from |Method|Description| |:---|:---| - |**Specific deployment templates**|Choose this option if you want to apply profile to Specific deployment templates.
              • Refer [Specific Deployment Templates](#specific-deployment-templates) to know more.
                  • | + |**Specific deployment templates**|Choose this option if you want to apply the profile to Specific deployment templates.
                  • Refer [Specific Deployment Templates](#specific-deployment-templates) to know more.
                      • | |**By match criteria**|Choose this option to apply the profile based on specific criteria, such as applying it to the deployment templates of an entire project.
                      • Refer [By match criteria](#by-match-criteria) to know more.
                          • | - |**Global (All deployment templates)**|Choose this option if you want to apply profile to all deployment template.
                          • Refer [Global (All Deployment Templates)](#global-all-deployment-templates) to know more.
                              • | + |**Global (All deployment templates)**|Choose this option if you want to apply the profile to all deployment templates.
                              • Refer [Global (All Deployment Templates)](#global-all-deployment-templates) to know more.
                                  • | ![Figure 9: Selecting Apply Method](https://devtron-public-asset.s3.us-east-2.amazonaws.com/images/global-configurations/lock-dt/lock-config-apply-methods.jpg) @@ -94,7 +94,7 @@ After creating a profile, the next step is to apply the profile to the specific This option allows you to apply the lock deployment configuration profile to the deployment template of a specific application within a particular environment. -To do so, follow the below steps: +To do so, follow the steps below: 1. Select the **Specific deployment templates** option under **Apply selected profiles to deployment templates of**. @@ -115,7 +115,7 @@ To do so, follow the below steps: ### By Match Criteria -This option allows you to apply the lock deployment configuration profile to the deployment templates of all the applications matching certain criteria. To apply the lock deployment profile, follow the below steps: +This option allows you to apply the lock deployment configuration profile to the deployment templates of all the applications matching certain criteria. To apply the lock deployment profile, follow the steps below: 1. Select the **By match criteria** option under **Apply selected profiles to deployment templates of**. @@ -130,13 +130,13 @@ This option allows you to apply the lock deployment configuration profile to the Let's understand how to use **By match criteria** with the below use cases:
                                  - 1. Suppose, you want to apply a lock deployment configuration profile to all applications in a particular project, you can achieve this by selecting that project as the match criteria. + 1. Suppose you want to apply a lock deployment configuration profile to all applications in a particular project. You can achieve this by selecting that project as the match criteria. ![Figure 11a: Applying Profile By Match Criteria - Use Case 1](https://devtron-public-asset.s3.us-east-2.amazonaws.com/images/global-configurations/lock-dt/lock-config-match-criteria-use-case-1.gif) ![Figure 11b: Use Case 1 - Lock Deployment Templates using Single Criteria](https://devtron-public-asset.s3.us-east-2.amazonaws.com/images/global-configurations/lock-dt/lock-config-match-criteria-use-case-1.jpeg) - 2. Now, let's say your use case is even more specific, suppose you want to apply the lock deployment configuration profile to all the applications' deployment templates in a particular cluster, belongs to a specific project and are deployed in a certain environment, then, you can choose your required **Cluster**, **Project** and **Environment** as the match criteria. Devtron will then apply the profile only to those applications' deployment templates that meet every single one of the criteria you have selected. + 2. Now, let's say your use case is even more specific, suppose you want to apply the lock deployment configuration profile to all the applications' deployment templates in a particular cluster, belongs to a specific project and are deployed in a particular environment, then, you can choose your required **Cluster**, **Project** and **Environment** as the match criteria. Devtron will then apply the profile only to those applications' deployment templates that meet every single one of the criteria you have selected. ![Figure 12a: Applying Profile By Match Criteria - Use Case 2](https://devtron-public-asset.s3.us-east-2.amazonaws.com/images/global-configurations/lock-dt/lock-config-match-criteria-use-case-2.gif) @@ -158,13 +158,13 @@ To apply the lock deployment profile to all deployment templates, select the **G ![Figure 14: Applying Profile for all the Deployment Templates](https://devtron-public-asset.s3.us-east-2.amazonaws.com/images/global-configurations/lock-dt/lock-config-global.gif) -4. Click **Save Changes** and the selected profiles will apply on the required deployment templates and will be visible under **Applied Profiles** tab. +4. Click **Save Changes**, and the selected profiles will apply to the required deployment templates and be visible under the **Applied Profiles** tab. --- ## Result -Once the lock deployment configuration profile is applied to the deployment templates, only super admins can edit the locked keys directly.Non-super admin users cannot edit the locked keys for those deployment templates. +Only super admins can edit the locked keys directly once the lock deployment configuration profile is applied to the deployment templates. Non-super admin users cannot edit the locked keys for those deployment templates. Let's look at a scenario where a user (non-super-admin) tries to edit the same in an [unprotected](../../user-guide/creating-application/config-approval.md) base deployment template. @@ -177,7 +177,7 @@ Let's look at a scenario where a user (non-super-admin) tries to edit the same i {% hint style="info" %} GUI or YAML Mode
                                  - If you select 'Basic' mode instead of 'Advanced (YAML)', all the keys meant for basic mode will be displayed in the GUI even if some are locked. While users can modify these keys, they cannot save the changes made to the locked keys. + If you select 'Basic' mode instead of 'Advanced (YAML)', all the keys meant for basic mode will be displayed in the GUI, even if some are locked. While users can modify these keys, they cannot save the changes made to the locked keys. {% endhint %} ### Editing Locked Keys @@ -190,7 +190,7 @@ Let's look at a scenario where a user (non-super-admin) tries to edit the same i ![Figure 17: Saving Edits to Locked Keys](https://devtron-public-asset.s3.us-east-2.amazonaws.com/images/global-configurations/lock-dt/changing-values.jpg) -* A modal window will appear on the right highlighting the non-eligible edits. +* A modal window highlighting the non-eligible edits will appear on the right. ![Figure 18: Eligible and Non-eligible Changes](https://devtron-public-asset.s3.us-east-2.amazonaws.com/images/global-configurations/lock-dt/not-eligible-changes.jpg) @@ -223,13 +223,13 @@ The same result can be seen if the user tries to edit environment-specific deplo ## Updating an Applied Profile -To update an existing applied profile, follow the below steps: +To update an existing applied profile, follow the steps below: 1. Go to **Global Configurations** → **Lock Deployment Configuration**. -2. Click **Applied Profiles** tab and click the `⋮` button next to the preferred applied profile. +2. Click the **Applied Profiles** tab and click the `⋮` button next to the preferred applied profile. -3. Click **Manage Policy** to add or remove the profiles. If you have applied the profile using match criteria then, you can also click **Edit match criteria** to edit the match criteria. +3. Click **Manage Policy** to add or remove the profiles. If you have applied the profile using match criteria, then you can also click **Edit match criteria** to edit the match criteria. 4. Click **Save Changes**. @@ -241,11 +241,11 @@ To update an existing applied profile, follow the below steps: ## Removing an Applied Profile -To remove an applied profile, follow the below steps: +To remove an applied profile, follow the steps below: 1. Go to **Global Configurations** → **Lock Deployment Configuration**. -2. Click **Applied Profiles** tab and click the `⋮` button next to the preferred applied profile. +2. Click the **Applied Profiles** tab and click the `⋮` button next to the preferred applied profile. 3. Click **Delete** and the applied profile will be removed. @@ -282,7 +282,7 @@ To delete a lock deployment configuration file, follow the steps below: 2. Click the **Profiles** tab and then click the delete button next to the preferred profile. -3. A pop window will appear, prompting you to enter the profile name for confirmation. +3. A pop-up window will appear, prompting you to enter the profile name for confirmation. 4. Enter the name of the profile and click **Delete**. @@ -291,4 +291,4 @@ To delete a lock deployment configuration file, follow the steps below: {% hint style="warning" %} ### Note Deleting a profile will automatically remove it from the Applied Profiles tab and remove its restrictions from all deployment templates where it was previously applied. -{% endhint %} \ No newline at end of file +{% endhint %} From a5ba792b6323197b4b021f8288d13a6fa08d82ae Mon Sep 17 00:00:00 2001 From: Hii-Arpit Date: Wed, 23 Jul 2025 02:24:06 +0530 Subject: [PATCH 09/13] docs: fixes --- docs/user-guide/global-configurations/lock-deployment-config.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/user-guide/global-configurations/lock-deployment-config.md b/docs/user-guide/global-configurations/lock-deployment-config.md index bd288d391..7a8fff753 100644 --- a/docs/user-guide/global-configurations/lock-deployment-config.md +++ b/docs/user-guide/global-configurations/lock-deployment-config.md @@ -31,7 +31,7 @@ To lock deployment keys, you must first create a profile and apply it to the spe {% hint style="Tip" %} ### What is a Lock Deployment Profile? -A Lock Deployment profile is a template that specifies which keys in the deployment template can be edited or locked. It enables super-admins to manage which deployment template keys other users can modify. By using profiles, super-admins can manage edit access at different levels, such as global, cluster, environment, application, or a combination of application and environment. +A lock deployment configuration profile is a template that specifies which keys in the deployment template cannot be edited by non-super admin users. By using lock deployment configuration profiles, super-admins can manage edit access at different levels, such as global, cluster, environment, application, or a combination of application and environment. This allows for better control by making sure critical deployment template keys are locked in sensitive environments (production), while giving flexibility to change deployment template keys in other less critical environments (QA, Staging, etc.). {% endhint %} From 6c6e644a1aa58c3dbb040f349d4bec2cce2f0b50 Mon Sep 17 00:00:00 2001 From: Hii-Arpit Date: Wed, 23 Jul 2025 02:39:52 +0530 Subject: [PATCH 10/13] docs: fixes --- .../global-configurations/lock-deployment-config.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/docs/user-guide/global-configurations/lock-deployment-config.md b/docs/user-guide/global-configurations/lock-deployment-config.md index 7a8fff753..3377d481b 100644 --- a/docs/user-guide/global-configurations/lock-deployment-config.md +++ b/docs/user-guide/global-configurations/lock-deployment-config.md @@ -84,9 +84,9 @@ After creating a profile, the next step is to apply the profile to the specific |Method|Description| |:---|:---| - |**Specific deployment templates**|Choose this option if you want to apply the profile to Specific deployment templates.
                                  • Refer [Specific Deployment Templates](#specific-deployment-templates) to know more.
                                      • | - |**By match criteria**|Choose this option to apply the profile based on specific criteria, such as applying it to the deployment templates of an entire project.
                                      • Refer [By match criteria](#by-match-criteria) to know more.
                                          • | - |**Global (All deployment templates)**|Choose this option if you want to apply the profile to all deployment templates.
                                          • Refer [Global (All Deployment Templates)](#global-all-deployment-templates) to know more.
                                              • | + |**Specific deployment templates**|Choose this option if you want to apply the profile to Specific deployment templates.
                                              • Refer [Specific Deployment Templates](#specific-deployment-templates) to know more.
                                              | + |**By match criteria**|Choose this option to apply the profile based on specific criteria, such as applying it to the deployment templates of an entire project.
                                              • Refer [By match criteria](#by-match-criteria) to know more.
                                              | + |**Global (All deployment templates)**|Choose this option if you want to apply the profile to all deployment templates.
                                              • Refer [Global (All Deployment Templates)](#global-all-deployment-templates) to know more.
                                              | ![Figure 9: Selecting Apply Method](https://devtron-public-asset.s3.us-east-2.amazonaws.com/images/global-configurations/lock-dt/lock-config-apply-methods.jpg) From 5c0c8f3f96f51028d066757ef56d4f63d9a6d5cc Mon Sep 17 00:00:00 2001 From: Hii-Arpit Date: Wed, 23 Jul 2025 10:37:58 +0530 Subject: [PATCH 11/13] docs: minor fixes --- .../global-configurations/lock-deployment-config.md | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/docs/user-guide/global-configurations/lock-deployment-config.md b/docs/user-guide/global-configurations/lock-deployment-config.md index 3377d481b..cad0aa531 100644 --- a/docs/user-guide/global-configurations/lock-deployment-config.md +++ b/docs/user-guide/global-configurations/lock-deployment-config.md @@ -111,7 +111,9 @@ To do so, follow the steps below: 3. Select the applications for which you want to apply the profile. - ![Figure 10: Applying Profile for Specific Deployment Templates ](https://devtron-public-asset.s3.us-east-2.amazonaws.com/images/global-configurations/lock-dt/lock-config-specific-apps.gif) + ![Figure 10a: Applying Profile to Specific Deployment Templates](https://devtron-public-asset.s3.us-east-2.amazonaws.com/images/global-configurations/lock-dt/lock-config-specific-apps.gif) + + ![Figure 10b: Lock Deployment Templates using 'Specific Deployment Templates'](https://devtron-public-asset.s3.us-east-2.amazonaws.com/images/global-configurations/lock-dt/lock-config-apply-specific+deployment-template.jpg) ### By Match Criteria From dfbfd7a9b8fc3af5ec1db1e1a758f273630108db Mon Sep 17 00:00:00 2001 From: Hii-Arpit Date: Thu, 24 Jul 2025 17:38:26 +0530 Subject: [PATCH 12/13] docs: implment suggestions --- .../lock-deployment-config.md | 106 ++++-------------- 1 file changed, 22 insertions(+), 84 deletions(-) diff --git a/docs/user-guide/global-configurations/lock-deployment-config.md b/docs/user-guide/global-configurations/lock-deployment-config.md index cad0aa531..15acb7130 100644 --- a/docs/user-guide/global-configurations/lock-deployment-config.md +++ b/docs/user-guide/global-configurations/lock-deployment-config.md @@ -80,85 +80,23 @@ After creating a profile, the next step is to apply the profile to the specific 3. Select how you want to apply the profiles under **Apply selected profiles to deployment templates of**. - There are three options you can choose from + There are three options you can choose from: - |Method|Description| - |:---|:---| - |**Specific deployment templates**|Choose this option if you want to apply the profile to Specific deployment templates.
                                              • Refer [Specific Deployment Templates](#specific-deployment-templates) to know more.
                                              | - |**By match criteria**|Choose this option to apply the profile based on specific criteria, such as applying it to the deployment templates of an entire project.
                                              • Refer [By match criteria](#by-match-criteria) to know more.
                                              | - |**Global (All deployment templates)**|Choose this option if you want to apply the profile to all deployment templates.
                                              • Refer [Global (All Deployment Templates)](#global-all-deployment-templates) to know more.
                                              | + 1. **Specific deployment templates**: This option allows you to apply the lock deployment configuration profile to the deployment template of a specific application within a particular environment. - ![Figure 9: Selecting Apply Method](https://devtron-public-asset.s3.us-east-2.amazonaws.com/images/global-configurations/lock-dt/lock-config-apply-methods.jpg) - -### Specific Deployment Templates + ![Figure 9: Applying Profile to Specific Deployment Templates](https://devtron-public-asset.s3.us-east-2.amazonaws.com/images/global-configurations/lock-dt/lock-config-specific-apps.gif) -This option allows you to apply the lock deployment configuration profile to the deployment template of a specific application within a particular environment. + 2. **By match criteria**: This option allows you to use a combination of filters to create criteria. Lock deployment configuration profile will only apply to the deployment templates of the applications fulfilling your criteria (including existing and future ones). -To do so, follow the steps below: + Let's understand how to use **By match criteria** with the below example:
                                              -1. Select the **Specific deployment templates** option under **Apply selected profiles to deployment templates of**. + Suppose you want to apply a lock deployment configuration profile to all applications in a particular project. You can achieve this by selecting that project as the match criteria. -2. Apply a filter from the dropdown to view deployment templates. + ![Figure 10: Applying Profile By Match Criteria - Use Case 1](https://devtron-public-asset.s3.us-east-2.amazonaws.com/images/global-configurations/lock-dt/lock-config-match-criteria-use-case-1.gif) - * Deployment templates can be filtered by: - - |Filter|Description| - |:---|:---| - |**Project**|This option allows you to filter the deployment templates based on **Projects**, and it will display all applications available in the selected projects along with their environments.| - |**Application**|This option allows you to filter the deployment templates based on **Applications**, and it will display the selected applications along with their environments.| - |**Cluster**|This option allows you to filter the deployment templates based on **Cluster**, and it will display all applications in the selected clusters along with their environments.| - |**Environment**|This option allows you to filter the deployment templates based on **Environments**, and it will display all the applications in the selected Environments.| - -3. Select the applications for which you want to apply the profile. - - ![Figure 10a: Applying Profile to Specific Deployment Templates](https://devtron-public-asset.s3.us-east-2.amazonaws.com/images/global-configurations/lock-dt/lock-config-specific-apps.gif) - - ![Figure 10b: Lock Deployment Templates using 'Specific Deployment Templates'](https://devtron-public-asset.s3.us-east-2.amazonaws.com/images/global-configurations/lock-dt/lock-config-apply-specific+deployment-template.jpg) - -### By Match Criteria - -This option allows you to apply the lock deployment configuration profile to the deployment templates of all the applications matching certain criteria. To apply the lock deployment profile, follow the steps below: - -1. Select the **By match criteria** option under **Apply selected profiles to deployment templates of**. - -2. Select the match criteria by applying the filter from the dropdown based on: - - |Filter|Description| - |:---|:---| - |**Project**|This option allows you to filter the deployment templates based on **Projects**, and it will display all applications available in the selected projects along with their environments.| - |**Application**|This option allows you to filter the deployment templates based on **Applications**, and it will display the selected applications along with their environments.| - |**Cluster**|This option allows you to filter the deployment templates based on **Cluster**, and it will display all applications in the selected clusters along with their environments.| - |**Environment**|This option allows you to filter the deployment templates based on **Environments**, and it will display all the applications in the selected Environments.| - - Let's understand how to use **By match criteria** with the below use cases:
                                              - - 1. Suppose you want to apply a lock deployment configuration profile to all applications in a particular project. You can achieve this by selecting that project as the match criteria. - - ![Figure 11a: Applying Profile By Match Criteria - Use Case 1](https://devtron-public-asset.s3.us-east-2.amazonaws.com/images/global-configurations/lock-dt/lock-config-match-criteria-use-case-1.gif) - - ![Figure 11b: Use Case 1 - Lock Deployment Templates using Single Criteria](https://devtron-public-asset.s3.us-east-2.amazonaws.com/images/global-configurations/lock-dt/lock-config-match-criteria-use-case-1.jpeg) - - 2. Now, let's say your use case is even more specific, suppose you want to apply the lock deployment configuration profile to all the applications' deployment templates in a particular cluster, belongs to a specific project and are deployed in a particular environment, then, you can choose your required **Cluster**, **Project** and **Environment** as the match criteria. Devtron will then apply the profile only to those applications' deployment templates that meet every single one of the criteria you have selected. - - ![Figure 12a: Applying Profile By Match Criteria - Use Case 2](https://devtron-public-asset.s3.us-east-2.amazonaws.com/images/global-configurations/lock-dt/lock-config-match-criteria-use-case-2.gif) - - ![Figure 12b: Use Case 2 - Lock Deployment Templates using Multiple Criteria](https://devtron-public-asset.s3.us-east-2.amazonaws.com/images/global-configurations/lock-dt/lock-config-match-criteria-use-case-2.jpeg) - - 3. In the above two use cases, we have selected only one option from each category, but let's say your use case requires to select multiple options from a particular category; let's say you want to apply the lock deployment configuration profile to multiple environments for a specific project, then, you can choose your required **Project** and multiple **Environments** as the match criteria, Devtron will then apply the profile to all the applications in that particular project that are deployed to any of the environments you have selected as the match criteria. - - ![Figure 13a: Applying Profile By Match Criteria - Use Case 2](https://devtron-public-asset.s3.us-east-2.amazonaws.com/images/global-configurations/lock-dt/lock-config-match-criteria-use-case-3.gif) - - ![Figure 13b: Use Case 3 - Lock Deployment Templates using multiple criteria from same category](https://devtron-public-asset.s3.us-east-2.amazonaws.com/images/global-configurations/lock-dt/lock-config-match-criteria-use-case-3.jpeg) - - -### Global (All Deployment Templates) - -This option allows you to apply the lock deployment configuration profile to all the existing and future deployment templates across all the applications. - -To apply the lock deployment profile to all deployment templates, select the **Global (All deployment templates)** option under **Apply selected profiles to deployment templates of**. - - ![Figure 14: Applying Profile for all the Deployment Templates](https://devtron-public-asset.s3.us-east-2.amazonaws.com/images/global-configurations/lock-dt/lock-config-global.gif) + 3. **Global (All deployment templates)**: This option allows you to apply the lock deployment configuration profile to all the existing and future deployment templates across all the applications. + ![Figure 11: Applying Profile for all the Deployment Templates](https://devtron-public-asset.s3.us-east-2.amazonaws.com/images/global-configurations/lock-dt/lock-config-global.gif) 4. Click **Save Changes**, and the selected profiles will apply to the required deployment templates and be visible under the **Applied Profiles** tab. @@ -175,7 +113,7 @@ Let's look at a scenario where a user (non-super-admin) tries to edit the same i * User can hide/unhide the locked keys as shown below. - ![Figure 15: Hiding Locked Keys](https://devtron-public-asset.s3.us-east-2.amazonaws.com/images/global-configurations/lock-dt/hide-locked-keys.gif) + ![Figure 12: Hiding Locked Keys](https://devtron-public-asset.s3.us-east-2.amazonaws.com/images/global-configurations/lock-dt/hide-locked-keys.gif) {% hint style="info" %} GUI or YAML Mode
                                              @@ -186,25 +124,25 @@ Let's look at a scenario where a user (non-super-admin) tries to edit the same i * Let's assume the user edits one of the locked keys... - ![Figure 16: Editing Locked Keys](https://devtron-public-asset.s3.us-east-2.amazonaws.com/images/global-configurations/lock-dt/change-locked-values.gif) + ![Figure 13: Editing Locked Keys](https://devtron-public-asset.s3.us-east-2.amazonaws.com/images/global-configurations/lock-dt/change-locked-values.gif) ...and saves the changes. - ![Figure 17: Saving Edits to Locked Keys](https://devtron-public-asset.s3.us-east-2.amazonaws.com/images/global-configurations/lock-dt/changing-values.jpg) + ![Figure 14: Saving Edits to Locked Keys](https://devtron-public-asset.s3.us-east-2.amazonaws.com/images/global-configurations/lock-dt/changing-values.jpg) * A modal window highlighting the non-eligible edits will appear on the right. - ![Figure 18: Eligible and Non-eligible Changes](https://devtron-public-asset.s3.us-east-2.amazonaws.com/images/global-configurations/lock-dt/not-eligible-changes.jpg) + ![Figure 15: Eligible and Non-eligible Changes](https://devtron-public-asset.s3.us-east-2.amazonaws.com/images/global-configurations/lock-dt/not-eligible-changes.jpg) ### Editing Unlocked Keys * Let's assume the user edits a key that is not locked or adds a new key. - ![Figure 19: Editing Allowed Keys](https://devtron-public-asset.s3.us-east-2.amazonaws.com/images/global-configurations/lock-dt/changing-allowed-values.jpg) + ![Figure 16: Editing Allowed Keys](https://devtron-public-asset.s3.us-east-2.amazonaws.com/images/global-configurations/lock-dt/changing-allowed-values.jpg) * The modal window will highlight the eligible edits. However, it will not let the user save those eligible edits unless the user clicks the checkbox: **Save changes which are eligible for update**. - ![Figure 20: Saving Eligible Changes](https://devtron-public-asset.s3.us-east-2.amazonaws.com/images/global-configurations/lock-dt/saving-allowed-changes.jpg) + ![Figure 17: Saving Eligible Changes](https://devtron-public-asset.s3.us-east-2.amazonaws.com/images/global-configurations/lock-dt/saving-allowed-changes.jpg) {% hint style="warning" %} ### Who Can Perform This Action? @@ -213,11 +151,11 @@ Only a super-admin, manager, or application admin can edit the configuration val * Once the user clicks the **Save Changes** button, the permissible changes will reflect in the deployment template. - ![Figure 21: Updating Deployment Config](https://devtron-public-asset.s3.us-east-2.amazonaws.com/images/global-configurations/lock-dt/updating-changes.jpg) + ![Figure 18: Updating Deployment Config](https://devtron-public-asset.s3.us-east-2.amazonaws.com/images/global-configurations/lock-dt/updating-changes.jpg) However, if it's a [protected template](../../user-guide/creating-application/config-approval.md), the user will require the approval of a [configuration approver](./user-access.md#devtron-apps-permissions) as shown below. - ![Figure 22: Proposing Changes to Protected Config](https://devtron-public-asset.s3.us-east-2.amazonaws.com/images/global-configurations/lock-dt/proposing-changes.jpg) + ![Figure 19: Proposing Changes to Protected Config](https://devtron-public-asset.s3.us-east-2.amazonaws.com/images/global-configurations/lock-dt/proposing-changes.jpg) The same result can be seen if the user tries to edit environment-specific deployment templates. @@ -235,9 +173,9 @@ To update an existing applied profile, follow the steps below: 4. Click **Save Changes**. -![Figure 23a: Editing Applied Profiles](https://devtron-public-asset.s3.us-east-2.amazonaws.com/images/global-configurations/lock-dt/lock-config-edit-profiles.gif) +![Figure 20a: Editing Applied Profiles](https://devtron-public-asset.s3.us-east-2.amazonaws.com/images/global-configurations/lock-dt/lock-config-edit-profiles.gif) -![Figure 23b: Editing Match Criteria](https://devtron-public-asset.s3.us-east-2.amazonaws.com/images/global-configurations/lock-dt/lock-config-edit-match-criteria.gif) +![Figure 20b: Editing Match Criteria](https://devtron-public-asset.s3.us-east-2.amazonaws.com/images/global-configurations/lock-dt/lock-config-edit-match-criteria.gif) --- @@ -251,7 +189,7 @@ To remove an applied profile, follow the steps below: 3. Click **Delete** and the applied profile will be removed. -![Figure 24: Removing an Applied Profile](https://devtron-public-asset.s3.us-east-2.amazonaws.com/images/global-configurations/lock-dt/lock-config-delete-applied-profile.gif) +![Figure 21: Removing an Applied Profile](https://devtron-public-asset.s3.us-east-2.amazonaws.com/images/global-configurations/lock-dt/lock-config-delete-applied-profile.gif) {% hint style="warning" %} ### Note @@ -272,7 +210,7 @@ To update a lock deployment configuration file, follow the steps below: 4. Click **Save Changes**. -![Figure 25: Updating Lock Deployment Configuration File](https://devtron-public-asset.s3.us-east-2.amazonaws.com/images/global-configurations/lock-dt/lock-config-edit-profile.gif) +![Figure 22: Updating Lock Deployment Configuration File](https://devtron-public-asset.s3.us-east-2.amazonaws.com/images/global-configurations/lock-dt/lock-config-edit-profile.gif) --- @@ -288,7 +226,7 @@ To delete a lock deployment configuration file, follow the steps below: 4. Enter the name of the profile and click **Delete**. -![Figure 26: Deleting Lock Deployment Configuration File](https://devtron-public-asset.s3.us-east-2.amazonaws.com/images/global-configurations/lock-dt/lock-config-delete-profile.gif) +![Figure 23: Deleting Lock Deployment Configuration File](https://devtron-public-asset.s3.us-east-2.amazonaws.com/images/global-configurations/lock-dt/lock-config-delete-profile.gif) {% hint style="warning" %} ### Note From f0fa75c571b8d09c1001ce54e00da55c02fb834b Mon Sep 17 00:00:00 2001 From: Hii-Arpit Date: Fri, 25 Jul 2025 17:30:29 +0530 Subject: [PATCH 13/13] docs: implement suggestions --- .../lock-deployment-config.md | 46 +++++++++++++------ 1 file changed, 33 insertions(+), 13 deletions(-) diff --git a/docs/user-guide/global-configurations/lock-deployment-config.md b/docs/user-guide/global-configurations/lock-deployment-config.md index 15acb7130..cd698afad 100644 --- a/docs/user-guide/global-configurations/lock-deployment-config.md +++ b/docs/user-guide/global-configurations/lock-deployment-config.md @@ -2,13 +2,12 @@ ## Introduction [![](https://devtron-public-asset.s3.us-east-2.amazonaws.com/images/elements/EnterpriseTag.svg)](https://devtron.ai/pricing) -The [Deployment Template](../../reference/glossary.md#base-deployment-template) might contain certain configurations intended for the DevOps team (e.g., `ingress`), and not meant for developers to modify. +The [Deployment Template](../../reference/glossary.md#base-deployment-template) might contain certain configurations (e.g., `ingress`) that are critical to the stability and security of the applications. To prevent unauthorized or accidental changes to such configurations, Devtron allows super admins to restrict (lock) such critical configurations from modification or deletion. -Therefore, Devtron allows super-admins to restrict such fields from modification or deletion. +![Figure 1: Preventing Changes to Locked Keys](https://devtron-public-asset.s3.us-east-2.amazonaws.com/images/global-configurations/lock-dt/not-eligible-chato do nges.jpg) -![Figure 1: Preventing Changes to Locked Keys](https://devtron-public-asset.s3.us-east-2.amazonaws.com/images/global-configurations/lock-dt/not-eligible-changes.jpg) +These restrictions can be applied for deployment templates in both the: -This stands true for deployment templates in: * [Base configuration](../../user-guide/creating-application/deployment-template.md) * [Environment-level configuration](../../user-guide/creating-application/environment-overrides.md) @@ -20,20 +19,21 @@ Whereas, the 'lock deployment configuration' feature goes one step further. It i --- -## Locking Deployment Keys +## Locking Deployment Configurations {% hint style="warning" %} ### Who Can Perform This Action? Users need to have super-admin permission to lock deployment keys. {% endhint %} -To lock deployment keys, you must first create a profile and apply it to the specific deployment templates. +To lock deployment configurations, you must first create a profile and apply it to the specific deployment templates. {% hint style="Tip" %} ### What is a Lock Deployment Profile? -A lock deployment configuration profile is a template that specifies which keys in the deployment template cannot be edited by non-super admin users. By using lock deployment configuration profiles, super-admins can manage edit access at different levels, such as global, cluster, environment, application, or a combination of application and environment. -This allows for better control by making sure critical deployment template keys are locked in sensitive environments (production), while giving flexibility to change deployment template keys in other less critical environments (QA, Staging, etc.). +A lock deployment configuration profile is a template that specifies which configurations (keys) in the deployment template cannot be edited or deleted by non-super admin users. By using lock deployment configuration profiles, super-admins can manage edit access at different levels, such as global, cluster, environment, application, or a combination of application and environment. + +This allows for better control by making sure critical deployment template configurations are locked in sensitive environments (production), while giving flexibility to change deployment template configurations in other less critical environments (QA, Staging, etc.). {% endhint %} ### Creating Profile @@ -56,6 +56,13 @@ To create a profile, follow the steps below: ![Figure 4: Referring Values.YAML File for Locking Keys](https://devtron-public-asset.s3.us-east-2.amazonaws.com/images/global-configurations/lock-dt/autoscaling-lock.jpg) + {% hint style=“info” %} + ### Locking Keys Outside Refer Values + + You can lock custom configurations (keys) defined in your deployment template, even if they are not listed in the **Refer Values.yaml** section. As long as the key matches your lock rule, it will be locked. + + {% endhint %} + 5. Click **Save Changes**. ![Figure 5: Saving Locked Keys](https://devtron-public-asset.s3.us-east-2.amazonaws.com/images/global-configurations/lock-dt/saving-locked-keys.jpg) @@ -64,6 +71,17 @@ To create a profile, follow the steps below: ![Figure 6: Confirmation Dialog](https://devtron-public-asset.s3.us-east-2.amazonaws.com/images/global-configurations/lock-dt/confirmation.jpg) +{% hint style="Warning" %} +### Handling Locked Index Ranges + +If you have locked a range of configurations using JSONPath (e.g., `ingressInternal.hosts[1:3].paths`), the specified index positions are protected. + +If you want to add a new configuration entry (e.g., a new host), it should be added after the locked range i.e., in case of `ingressInternal.hosts[1:3].paths`, new host configuration entry should be added at the index 4. + +Adding an entry within the locked range may shift the indices and result in validation errors or unintended modifications of locked values. + +{% endhint %} + ### Applying Profile After creating a profile, the next step is to apply the profile to the specific deployment templates according to your use case. To apply a profile, follow the steps below: @@ -102,16 +120,16 @@ After creating a profile, the next step is to apply the profile to the specific --- -## Result +## Effect of Lock Configuration Profiles on Deployment Templates -Only super admins can edit the locked keys directly once the lock deployment configuration profile is applied to the deployment templates. Non-super admin users cannot edit the locked keys for those deployment templates. +Only super admins can edit the locked configurations directly once the lock deployment configuration profile is applied to the deployment templates. Non-super admin users cannot edit the locked keys for those deployment templates. Let's look at a scenario where a user (non-super-admin) tries to edit the same in an [unprotected](../../user-guide/creating-application/config-approval.md) base deployment template. -### Viewing Locked Keys +### Viewing Locked Configurations -* User can hide/unhide the locked keys as shown below. +* User can hide/unhide the locked configurations as shown below. ![Figure 12: Hiding Locked Keys](https://devtron-public-asset.s3.us-east-2.amazonaws.com/images/global-configurations/lock-dt/hide-locked-keys.gif) @@ -120,7 +138,7 @@ Let's look at a scenario where a user (non-super-admin) tries to edit the same i If you select 'Basic' mode instead of 'Advanced (YAML)', all the keys meant for basic mode will be displayed in the GUI, even if some are locked. While users can modify these keys, they cannot save the changes made to the locked keys. {% endhint %} -### Editing Locked Keys +### Editing Locked Configurations * Let's assume the user edits one of the locked keys... @@ -232,3 +250,5 @@ To delete a lock deployment configuration file, follow the steps below: ### Note Deleting a profile will automatically remove it from the Applied Profiles tab and remove its restrictions from all deployment templates where it was previously applied. {% endhint %} + +## Use Cases