Merge pull request mendix#9070 from Nidhi251289/Portunus_7_10_0_20_feb

Portunus 7 10 0 (postponed from 20 feb)

Author: katarzyna-koltun-mx

content/en/docs/deployment/private-cloud/private-cloud-cluster/_index.md

@@ -1056,6 +1056,37 @@ The only limitations are that:
 When you delete a cluster, this removes the cluster from the Mendix Portal. However, it will not remove the associated namespace from your platform. You will need to explicitly delete the namespace using the tools provided by your platform.
 {{% /alert %}}
 
+#### Managing Roles and Permissions {#rolesandpermissions}
+
+It is now possible to manage the roles and permissions for the namespace member by clicking **Roles and Permissions** in the left navigation pane. 
+
+Below are the predefined roles with default permissions; these roles are built-in and cannot be edited:
+
+* **Administrator** - This role gives the cluster manager full access to the namespace, the permissions for which are shown in the figure below.
+* **Developer** - This role gives the developer with the permission which are shown in the figure below.
+
+{{< figure src="/attachments/deployment/private-cloud/private-cloud-cluster/RolesAndPermission.png" class="no-border" >}}
+
+In addition to the predefined roles, you can create customised roles with the required permissions which you want to assign to the namespace member. Cluster managers can create a role once, and then reuse it across multiple namespaces. 
+
+To create a role, click **Create Role** in the top right.
+
+{{< figure src="/attachments/deployment/private-cloud/private-cloud-cluster/CreateRole.png" class="no-border" >}}
+
+This option allows the cluster manager to create, edit, and delete roles and permissions. 
+
+Once a role is created, you can assign it to the namespace member by clicking **Invite Member** under **Members** section on the **Namespace Overview** page. You can select the role from the dropdown.
+
+{{< figure src="/attachments/deployment/private-cloud/private-cloud-cluster/Invitemember.png" class="no-border" >}}
+
+Once the role is assigned, it cannot be deleted until the role is removed from the assigned members.
+
+{{< figure src="/attachments/deployment/private-cloud/private-cloud-cluster/deleteRole.png" class="no-border" >}}
+
+{{% alert color="warning" %}}
+Existing namespace members who have been given custom permissions will continue to use those custom permissions. However, those custom permissions will no longer be editable. To update a permission, reassign an existing role or create a custom role on the Roles and Permissions page.
+{{% /alert %}}
+
 ### Namespace Management
 
 If you are a member of a namespace, you can also manage a namespace in the cluster.
@@ -1307,10 +1338,16 @@ You can invite additional members to the namespace, and configure their role dep
 
     1. **Developer** – a standard set of rights needed by a developer, these are listed on the screen
     2. **Administrator** – a standard set of rights needed by an administrator, these are listed on the screen
-    3. **Custom** – you can select a custom set of rights by checking the box next to each role you want to give to this person
+    3. **Custom** – This option is now deprecated.
 
-    With custom permissions, we have now decoupled the permissions for Scale, Start and Stop operations. If an application is in the Stopped state, the scaling does not come into effect until the application is Started. This means that you have to click **Start application** in order for the changes to be sent to the cluster.
-    Along with this, we have also decoupled the permission for modifying the MxAdmin password and managing environments.
+{{% alert color="info" %}}
+The custom permission if needed to be edited, a role need to be assigned with appropriate permissions. See [Roles and Permissions](/developerportal/deploy/private-cloud-cluster/#rolesandpermissions) for more information.
+{{% /alert %}}
+
+{{% alert color="info" %}}
+If an application is in the Stopped state, the scaling does not come into effect until the application is Started. This means that you have to click **Start application** in order for the changes to be sent to the cluster.
+Along with this, we have also decoupled the permission for modifying the MxAdmin password and managing environments.
+{{% /alert %}}
 
 6. Click **Send Invite** to send an invite to this person.
 

content/en/docs/deployment/private-cloud/private-cloud-cluster/private-cloud-storage-plans.md

@@ -267,7 +267,7 @@ This section provides technical details on how IAM authentication works with Pos
 {{% /alert %}}
 
 {{% alert color="info" %}}
-When dealing with an Aurora PostgreSQL database, an additional procedural step is required. To employ IAM authentication in conjunction with PostgreSQL, establish a connection to the designated database instance by using either the master user or an alternative user with admin privileges. Once the connection is established, assign the `rds_iam` role to the user, as shown in the following example:
+To employ IAM authentication in conjunction with PostgreSQL, establish a connection to the designated database instance by using either the master user or an alternative user with admin privileges. Once the connection is established, assign the `rds_iam` role to the user, as shown in the following example:
 
 ```shell
 GRANT rds_iam TO db_userx;
@@ -1901,7 +1901,7 @@ To configure the required settings for an RDS database, do the following steps:
 
     {{% alert color="info" %}}The VPC and firewall must be configured to allow connections to the database from the Kubernetes cluster. When creating the RDS instance, as a best practice, make sure that it uses the same VPC as the Kubernetes cluster. Alternatively, you can also use a publicly accessible cluster. After an RDS instance has been created, it is not possible to modify its VPC.{{% /alert %}}
 
-    {{% alert color="info" %}}In the case of Aurora DB, ensure that the `rds_iam` role is granted to the master database user{{% /alert %}}
+    {{% alert color="info" %}} Ensure that the `rds_iam` role is granted to the master database user{{% /alert %}}
 
 3. Navigate to the RDS instance details, and write down the following information:
 

content/en/docs/deployment/private-cloud/private-cloud-deploy.md

@@ -509,6 +509,14 @@ Images are not deleted from the container registry. You should delete those imag
 If any of these garbage collection steps fail, you will no longer see the environment in the Mendix Portal, and will have to [delete the storage instances](#delete-storage) manually.
 {{% /alert %}}
 
+##### Read-Only Root Filesystem
+
+[Read-only Root file system](/developerportal/deploy/private-cloud-cluster/#readonlyrootfs) can be enabled per environment. By default, this option is disabled. 
+
+##### Deployment Strategy 
+
+Starting from Operator 2.20.0 onwards, it is now also possible to set the deployment strategy for an environment on the cluster details page. This stategy can be enabled by the cluster manager. This feature allows to update an app with reduced downtime by performing a rolling update. By default, it is set to Recreate strategy.
+
 ##### License Mendix{#license-mendix}
 
 If you need to enter or change the subscription secret, then you can do that here.

content/en/docs/releasenotes/deployment/mendix-for-private-cloud.md

@@ -14,6 +14,12 @@ For information on the current status of deployment to Mendix for Private Cloud
 
 ### March 6, 2025
 
+#### Portal Improvements
+
+* The character limit for internal application IDs has been extended from 8 to 35 characters.
+* Version 2.21.0 of the Operator introduces support for [read-only root filesystem](/developerportal/deploy/private-cloud-cluster/#readonlyrootfs). This can be enabled for an environment by setting the **Read-Only Root Filesystem** field to **true** in the **Environment details** page.
+* We have added support for creating custom roles for namespace members. The roles can then be applied uniformly across all namespaces within a cluster.
+
 #### General Availability Release
 
 * We have released the general availability (GA) version of Global Operator in the Private Cloud.