From 41eeb78a6fbf3e49b79bd5ce843e8dd2aba1244f Mon Sep 17 00:00:00 2001 From: miacycle <184569369+miacycle@users.noreply.github.com> Date: Sat, 5 Sep 2026 16:54:49 -0500 Subject: [PATCH 1/2] docs(cloud): note that platform-provisioned Environments refuse delete and connection changes Some Environments are provisioned for an organization by the platform rather than created by someone in it, and they hold configuration the platform relies on. The Environments page refuses three operations against them: deleting the Environment, and assigning or removing its Connections. Those Connections are managed from the settings page that owns the feature instead. Documents the refusal where a reader meets it rather than only where it is implemented. Both notes say what to do instead, and the delete note explains why such an Environment stays visible rather than being hidden, since a reader who cannot delete something they can see will otherwise assume a fault. Avoids naming a brand in the new copy: the product's display name resolves from the organization, so the notes describe the platform rather than hardcoding a name. Signed-off-by: miacycle <184569369+miacycle@users.noreply.github.com> --- .../guides/workspaces/managing-environments/index.md | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/content/en/cloud/guides/workspaces/managing-environments/index.md b/content/en/cloud/guides/workspaces/managing-environments/index.md index 0cb93e6c340..158fd61355e 100644 --- a/content/en/cloud/guides/workspaces/managing-environments/index.md +++ b/content/en/cloud/guides/workspaces/managing-environments/index.md @@ -104,6 +104,12 @@ The **>>** and **<<** buttons act on the whole list, so they stay disabled until **Save** stays disabled until you have actually changed something, and one **Save** commits every addition and removal you made in the dialog together. +{{< alert type="info" title="Some Environments Are Managed for You" >}} +A few Environments are provisioned for your organization rather than created by someone in it, and they hold configuration the platform itself relies on - the Environment behind your organization's own identity providers is one. Their Connections are managed from the settings page that owns that feature, so assigning or removing Connections here is refused. + +You can still open such an Environment and see what belongs to it. Only changes made through this dialog are declined. +{{< /alert >}} + ## Remove Connections from an Environment Removal is the same dialog in the other direction: @@ -128,4 +134,10 @@ You can delete a single Environment or several at once. Deleting an Environment does **not** delete the Connections inside it. Connections that also belong to other Environments continue to belong to those Environments. The Environment is detached from any Workspaces it was linked to, and the resources it made available to those Workspaces stop being available through it. {{< /alert >}} +{{< alert type="info" title="Managed Environments Cannot Be Deleted Here" >}} +Deleting an Environment your organization did not create - one provisioned to hold configuration the platform relies on, such as the Environment behind your own identity providers - is refused. Remove the feature's configuration from the settings page that owns it and the Environment is taken away with it. + +This is why deletion is refused rather than simply hidden: an Environment that still holds live configuration should not disappear from a grid where you can see everything else you own. +{{< /alert >}} + While an Environment is bulk-selected its card cannot be flipped and its individual edit and delete icons are suppressed, so the bulk toolbar is the only way to act on it. Clear the selection to get the per-card actions back. From 86b379a56fb5f8131f99511d49850e28c90c690d Mon Sep 17 00:00:00 2001 From: miacycle <184569369+miacycle@users.noreply.github.com> Date: Tue, 8 Sep 2026 16:33:02 -0500 Subject: [PATCH 2/2] docs(cloud): add the workspace-link refusal and name Layer5 Cloud in the managed-Environment notes Re-verifying the preceding commit against meshery-cloud found the refusal set has grown since it was written. The Environments page refuses three operations against a platform-provisioned Environment, but a fourth verb refuses one page over: linking such an Environment to a Workspace (ErrProvisionedEnvironmentWorkspaceMappingRefused, meshery_cloud-3273, landed after the note was drafted). A mapping is a link in the inherited-access chain, so it would hand a Workspace's teams read on the Environment's Connections and the identity-provider credential behind them. Unlinking is deliberately unguarded - it only ever ends access, and it is the remediation for rows written before the guard existed - so the new note says so. Names Layer5 Cloud rather than "the platform". This repository is the user-facing documentation for the hosted product, so the product name is the correct wording here; the branding rule targets the Cloud interface, whose display name resolves per organization. Points both existing notes at the Identity Providers tab by link instead of describing an unnamed "settings page that owns the feature", and states that a managed Environment can still be renamed - only Connection membership, deletion and Workspace linking are refused. The delete note also covers bulk selection, which is refused per row like the single-card delete. Corrects the Identity Providers bullet on the Organization Management page while adjacent to it: it named the control "Delete All \"Identity Providers\"" (the button reads Delete All Identity Providers) and described the teardown as deleting "the environment named, 'Identity Providers'". Resolution no longer keys on that name - the name-based lookup was the escalation the purpose column replaced - and the revert target is Layer5's default identity providers, not "Provider Organization's defaults". Verified by building master and this branch to separate directories and diffing the id= attribute of every heading across both trees: no anchor changed. Signed-off-by: miacycle <184569369+miacycle@users.noreply.github.com> --- .../guides/organizations/org-management/_index.md | 2 +- .../workspaces/managing-environments/index.md | 14 ++++++++++---- 2 files changed, 11 insertions(+), 5 deletions(-) diff --git a/content/en/cloud/guides/organizations/org-management/_index.md b/content/en/cloud/guides/organizations/org-management/_index.md index dd2bed9c276..6af3355b078 100644 --- a/content/en/cloud/guides/organizations/org-management/_index.md +++ b/content/en/cloud/guides/organizations/org-management/_index.md @@ -63,7 +63,7 @@ By default, your Organization uses Layer5's shared OAuth applications. To overri - Use **Add Google**, **Add GitHub**, or **Add OIDC** to register a provider. Each walkthrough displays the exact redirect URI to add to your OAuth application. Saving your first provider switches the Organization to its own identity providers automatically. - Use **Edit** to rotate a provider's credentials, or **Remove** to delete a single provider. Removing your last provider reverts the Organization to Layer5's defaults. -- Use **Delete All "Identity Providers"** to delete the environment named, "Identity Providers", therein deleting every configured provider at once, reverting to Provider Organization's defaults. +- Use **Delete All Identity Providers** to remove every configured provider at once. This deletes the Environment that Layer5 Cloud provisioned to hold them, and the Organization reverts to Layer5's default identity providers. Every removal asks you to confirm and explains the consequences before it proceeds. diff --git a/content/en/cloud/guides/workspaces/managing-environments/index.md b/content/en/cloud/guides/workspaces/managing-environments/index.md index 158fd61355e..ab4bf5c5019 100644 --- a/content/en/cloud/guides/workspaces/managing-environments/index.md +++ b/content/en/cloud/guides/workspaces/managing-environments/index.md @@ -61,6 +61,12 @@ See [Link Environments to a Workspace]({{< ref "cloud/guides/workspaces/managing An Environment can be linked to more than one Workspace, and a Workspace can have more than one Environment. An Environment that appears in no Workspace is still perfectly valid - it simply is not shared with any team yet. {{< /alert >}} +{{< alert type="info" title="Managed Environments Cannot Be Linked to a Workspace" >}} +Linking an Environment that Layer5 Cloud provisioned for your organization - the Environment behind your own identity providers, for instance - to a Workspace is refused. Linking one grants every member of that Workspace's teams read access to the Environment's Connections and the Credentials behind them, and your organization's identity-provider credentials are not shared that way. + +Unlinking is not refused. If such an Environment was linked to a Workspace before this restriction existed, you can still remove it from that Workspace. +{{< /alert >}} + ## Create an Environment {{< alert type="info" title="Permissions Required" >}} @@ -105,9 +111,9 @@ The **>>** and **<<** buttons act on the whole list, so they stay disabled until **Save** stays disabled until you have actually changed something, and one **Save** commits every addition and removal you made in the dialog together. {{< alert type="info" title="Some Environments Are Managed for You" >}} -A few Environments are provisioned for your organization rather than created by someone in it, and they hold configuration the platform itself relies on - the Environment behind your organization's own identity providers is one. Their Connections are managed from the settings page that owns that feature, so assigning or removing Connections here is refused. +A few Environments are provisioned for your organization by Layer5 Cloud rather than created by someone in it, and they hold organization-level configuration Layer5 Cloud itself relies on - the Environment behind your organization's own identity providers is one. Their Connections are managed from the [Identity Providers tab]({{< ref "cloud/guides/organizations/org-management/_index.md#configuring-identity-providers-bring-your-own-credentials" >}}) of Edit Organization, so assigning or removing Connections here is refused. -You can still open such an Environment and see what belongs to it. Only changes made through this dialog are declined. +You can still open such an Environment, see what belongs to it, and change its name and description. Only Connection membership, deletion, and linking it to a Workspace are declined. {{< /alert >}} ## Remove Connections from an Environment @@ -135,9 +141,9 @@ Deleting an Environment does **not** delete the Connections inside it. Connectio {{< /alert >}} {{< alert type="info" title="Managed Environments Cannot Be Deleted Here" >}} -Deleting an Environment your organization did not create - one provisioned to hold configuration the platform relies on, such as the Environment behind your own identity providers - is refused. Remove the feature's configuration from the settings page that owns it and the Environment is taken away with it. +Deleting an Environment your organization did not create - one Layer5 Cloud provisioned to hold organization-level configuration, such as the Environment behind your own identity providers - is refused, whether you delete it singly or as part of a bulk selection. Use **Delete All Identity Providers** on the [Identity Providers tab]({{< ref "cloud/guides/organizations/org-management/_index.md#configuring-identity-providers-bring-your-own-credentials" >}}) instead, and the Environment is taken away with the configuration it holds. -This is why deletion is refused rather than simply hidden: an Environment that still holds live configuration should not disappear from a grid where you can see everything else you own. +This is why deletion is refused rather than the Environment simply being hidden: an Environment that still holds live configuration should not disappear from a grid where you can see everything else you own. {{< /alert >}} While an Environment is bulk-selected its card cannot be flipped and its individual edit and delete icons are suppressed, so the bulk toolbar is the only way to act on it. Clear the selection to get the per-card actions back.