Use the self-service repository

You get access to your GitHub organization, the self-service repository, and your runtimes through the team_members section of self-service.tfvars. Each user’s email is the unique key of their entry.

Get your first access

Backbase creates your GitHub organization and self-service repository when your installation is set up. Your onboarding team or project manager gives you the repository URL and adds your first users to team_members. After their pull request merges, you can clone the repository and add others.

Add a team member

To add a team member, add an entry to team_members in self-service.tfvars and open a pull request to main:

team_members = {
  "USER_EMAIL" = {
    grandcentral = { roles = ["dev-rw", "dev-apim-rw"] }
    github       = { github_teams = ["development", "applications-live"] }
    datadog      = { roles = ["dev-ro"] }   # Optional
    grafana      = { roles = ["dev-ro"] }   # Optional
  }
}

If a user only needs GitHub access, keep only the github section and remove the others.

GitHub teams

The following table lists the GitHub teams you can assign in github_teams:

GitHub team	Permissions
`self-service`	Code owners of the self-service repository, who approve its pull requests
`applications-live`	Write access to the `applications-live` repository
`development`	Write access to development repositories
`development-admin`	Admin access to development repositories

If you leave github_teams empty, that person gets read-only access to all repositories.

Banking OS roles

Banking OS roles control what the team member can do in the Banking OS Azure directory for each runtime. Replace {env} with the runtime name, such as dev. The following table lists the Banking OS roles you can assign in grandcentral.roles:

Role	What it grants
`{env}-rw`	Full access to the runtime, including the cluster writer role on the AKS cluster
`{env}-ro`	Read-only access to the runtime
`{env}-apim-ro`	Reader access to the runtime’s Azure API Management instance: view APIs and products, and test APIs
`{env}-apim-rw`	Contributor access to manage the runtime’s Azure API Management instance
`{env}-apim-subs-ro`	Reader access to subscriptions, including viewing the primary and secondary keys
`{env}-apim-subs-rw`	Contributor access to manage subscriptions, such as approvals and key rotation
`{env}-apim-cred-manager`	Contributor access to manage credential manager configuration, such as the login required for first-time OAuth authorization

Roles and teams can differ per installation and runtime. The names in the preceding table match the dev, stg, test, and uat roles in the self-service README.

Datadog and Grafana roles

Grafana roles use the {env}-ro and {env}-rw pattern. {env}-ro grants access to logs. {env}-rw grants access to logs and lets you create dashboards, monitors, and alerts. The team member must exist in Microsoft Entra ID before you assign these roles. Datadog is available only if it’s enabled for your installation.

User seats

Your self-service README states how many seats the installation includes for users outside Backbase. Each of those users in team_members takes one seat. To request more seats, use the ticket link in that README. A Datadog-only user, also known as a DevOps Lite user, doesn’t use a GitHub seat. The entry for this user contains only the datadog section. Before you add one, request a DevOps Lite bundle through the Support Portal.

Banking OS Console

Monitor

Administer

Get your first access

Add a team member

GitHub teams

Banking OS roles

Datadog and Grafana roles

User seats

​Get your first access

​Add a team member

​GitHub teams

​Banking OS roles

​Datadog and Grafana roles

​User seats

​Related topics

Get your first access

Add a team member

GitHub teams

Banking OS roles

Datadog and Grafana roles

User seats

Related topics