Demo RBAC in Docker EE

In this guide, you’ll learn how to configure Role-Based Access Control (RBAC) in Docker Enterprise Edition (EE) using Universal Control Plane (UCP). We’ll walk through:

• Setting up an organization and teams
• Creating users and assigning them to teams
• Defining a custom role and collection
• Granting permissions
• Verifying access for each user

By the end, you’ll see how RBAC in Docker EE ensures that teams can only perform the actions they’re authorized for.

Use Case Overview

We want to implement RBAC for an organization named KodeKloud, with two teams and two users. Here’s the plan:

1. Creating Users

1. Sign in to UCP as the admin user.
2. Navigate to Access Control → Users and click Create.
3. Enter Dave’s details (username, password, full name) and Create.
4. Repeat the process to add Adam.

2. Creating Organization and Teams

1. Go to Access Control → Orgs & Teams.
2. Click Create, set Name to KodeKloud, and save.
3. Under the new org, select Create a Team and add ITOps.
4. Click the + icon again to add the DevOps team.

3. Assigning Users to Teams

1. Select DevOps → Add User → choose Dave.
2. Select ITOps → Add User → choose Adam.

Each team should now list one member.

4. Creating the DevOps Role

1. Navigate to Access Control → Roles → Swarm.
2. Click Create, set Role Name to DevOps Role.
3. Expand Service under Operations and select All Service Operations.
4. Click Create.

5. Creating the DevOps Collection

1. Go to Shared Resources → Collections.
2. Under the Swarm default collection, click View Children and choose Shared.
3. Click Create Collection, name it DevOps Collection, and save.

6. Granting the Role and Collection

1. Head to Access Control → Grants → Swarm and click Create Grant.
2. Under Subject, select Organization: KodeKloud and Team: DevOps, then Next.
3. Choose DevOps Collection for the Resource Set, then Next.
4. Pick DevOps Role under Role Type and click Create.

7. Testing RBAC as Dave

1. Log out, then sign in to UCP as Dave.
2. Verify that his profile displays the DevOps Collection, DevOps Role, and the grant.
3. Switch to the Swarm tab and click Create Service:
   • Service Name: nginx
   • Image: nginx:latest
   • Mode: replicated (replicas: 1)
4. Click Create and confirm the service appears.

Next, attempt to create a Kubernetes namespace (which should be denied):

apiVersion: v1
kind: Namespace
metadata:
  name: testnamespace

UCP will return an “access denied” error, confirming Kubernetes operations are blocked for Dave.

8. Verifying Adam Has No Access

1. Log out and sign back in as Adam.
2. Navigate to Swarm → Services.
3. Adam should see no services, including the one Dave created.

Links and References

• Docker UCP RBAC Best Practices
• Docker Enterprise Edition Overview
• Docker Certified Associate Exam Guide