Fine-Grained Access Configuration

This page describes how to configure Fine-Grained Access for specific Facility Types at the Helm level. For a general overview, see Fine-Grained Access Control and Configuration.

Fine-Grained Access can be enabled for multiple topology types simultaneously (e.g., both IAS and MES) by providing the relevant Facility Type IDs as a comma-separated list.

Helm Configuration

Configure the Facility Type IDs in the cm-core-configmap and rule-services-configmap via Helm custom values:

cm:
  configmaps:
    cm-core-configmap:
      CMCORE_FACILITYTYPESTOREGISTERRESOURCE_<TENANT_ID>: <FACILITY_TYPE_ID>,<FACILITY_TYPE_ID>,...
    rule-services-configmap:
      RS_FACILITYTYPESTOREGISTERRESOURCE_<TENANT_ID>: <FACILITY_TYPE_ID>,<FACILITY_TYPE_ID>,...

Replace <TENANT_ID> with the actual Tenant ID and <FACILITY_TYPE_ID> with the applicable Facility Type IDs. Both configmaps must contain the same set of Facility Type IDs.

To find the correct Facility Type IDs, check the MDM documentation or look them up directly in the MDM Topology response of your environment.

The underlying environment variables are documented in the advanced configuration parameters:

CMCORE_FACILITYTYPESTOREGISTERRESOURCE_DEFAULT — Condition Monitoring Core
RS_FACILITYTYPESTOREGISTERRESOURCE_DEFAULT — Rules Management

A tenant-specific override is created by appending the Tenant ID to the variable name. If defined, it takes precedence over the default.

Example: Enabling both IAS and MES Topology

cm:
  configmaps:
    cm-core-configmap:
      # IAS: Production Area, Production Line | MES: Product, Area, Line
      CMCORE_FACILITYTYPESTOREGISTERRESOURCE_01c498ec-d114-4ccd-8de0-1b1e0b5006ba: E14CAB2A-2113-441C-A4A1-FCC6AF91861D,F2BFFBF3-1113-4F99-81BC-C782458AD8A2
    rule-services-configmap:
      RS_FACILITYTYPESTOREGISTERRESOURCE_01c498ec-d114-4ccd-8de0-1b1e0b5006ba: E14CAB2A-2113-441C-A4A1-FCC6AF91861D,F2BFFBF3-1113-4F99-81BC-C782458AD8A2

Re-register Dynamic Resources (MDM Reload)

After updating the Helm configuration, an MDM Reload must be triggered so that the dynamic resources are re-registered with the updated Facility Type IDs. This is required for both CM Core and Rules Management.

For step-by-step instructions, see MDM Reload for the new tenant.