mirror of
https://github.com/rancher/rancher-docs.git
synced 2026-09-25 04:28:15 +00:00
psps, cluster members, project members
This commit is contained in:
Denise Schannon
@@ -1,5 +1,5 @@
|
||||
---
|
||||
title: Pod Security Policies
|
||||
title: Managing Pod Security Policies
|
||||
weight: 1135
|
||||
aliases:
|
||||
-/rancher/v2.x/en/concepts/global-configuration/pod-security-policies
|
||||
@@ -53,10 +53,10 @@ Using Rancher, you can create a Pod Security Policy using our GUI rather than cr
|
||||
|
||||
You can add a Pod Security Policy (PSPs hereafter) in the following contexts:
|
||||
|
||||
- [When creating a cluster]({{< baseurl >}}/rancher/v2.x/en/kubernetes-in-rancher/editing-clusters/#adding-a-default-pod-security-policy)
|
||||
- [When editing an existing cluster]({{< baseurl >}}/rancher/v2.x/en/kubernetes-in-rancher/editing-clusters/#adding-a-pod-security-policy)
|
||||
- [When creating a project]({{< baseurl >}}/rancher/v2.x/en/kubernetes-in-rancher/projects-and-namespaces/creating-and-managing-projects/)
|
||||
- [When editing an existing project]({{< baseurl >}}/rancher/v2.x/en/kubernetes-in-rancher/projects-and-namespaces/creating-and-managing-projects/#editing-the-pod-security-policy)
|
||||
- [When creating a cluster]({{< baseurl >}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/options/pod-security-policies/)
|
||||
- [When editing an existing cluster]({{< baseurl >}}/rancher/v2.x/en/kubernetes-in-rancher/editing-clusters/)
|
||||
- [When creating a project]({{< baseurl >}}/rancher/v2.x/en/kubernetes-in-rancher/projects-and-namespaces/#creating-a-project/)
|
||||
- [When editing an existing project]({{< baseurl >}}/rancher/v2.x/en/kubernetes-in-rancher/projects-and-namespaces/editing-projects/)
|
||||
|
||||
> **Note:** We recommend adding PSPs during cluster and project creation instead of adding it to an existing one.
|
||||
|
||||
|
||||
@@ -1,5 +1,5 @@
|
||||
---
|
||||
title: Creating Kubernetes Clusters
|
||||
title: Provisioning Kubernetes Clusters
|
||||
weight: 2000
|
||||
aliases:
|
||||
- /rancher/v2.x/en/concepts/clusters/
|
||||
|
||||
@@ -15,41 +15,6 @@ There are two contexts where you can add cluster members:
|
||||
|
||||
You can add members to a cluster as you create it (recommended if possible).
|
||||
|
||||
- [Adding Members to an Existing Cluster](/tasks/#adding-members-to-an-existing-cluster)
|
||||
- [Adding Members to an Existing Cluster](/rancher/v2.x/en/kubernetes-in-rancher/editing-clusters/)
|
||||
|
||||
You can always add members to a cluster later. See below.
|
||||
|
||||
### Adding Members to an Existing Cluster
|
||||
|
||||
Following cluster creation, you can add users as cluster members so that they can access its resources.
|
||||
|
||||
1. From the **Global** view, open the cluster that you want to add members to.
|
||||
|
||||
2. From the main menu, select **Members**. Then click **Add Member**.
|
||||
|
||||
3. Search for the user or group that you want to add to the cluster.
|
||||
|
||||
If external authentication is configured:
|
||||
|
||||
- Rancher returns users from your [external authentication]({{< baseurl >}}/rancher/v2.x/en/admin-settings/authentication/) source as you type.
|
||||
|
||||
>**Using AD but can't find your users?**
|
||||
>There may be an issue with your search attribute configuration. See [Configuring Active Directory Authentication: Step 5]({{< baseurl >}}/rancher/v2.x/en/admin-settings/authentication/ad/).
|
||||
|
||||
- A drop-down allows you to add groups instead of individual users. The drop-down only lists groups that you, the logged in user, are part of.
|
||||
|
||||
>**Note:** If you are logged in as a local user, external users do not display in your search results. For more information, see [External Authentication Configuration and Principal Users]({{< baseurl >}}/rancher/v2.x/en/admin-settings/authentication/#external-authentication-configuration-and-principal-users).
|
||||
|
||||
4. Assign the user or group **Cluster** roles.
|
||||
|
||||
[What are Cluster Roles?]({{< baseurl >}}/rancher/v2.x/en/admin-settings/rbac/cluster-project-roles/)
|
||||
|
||||
>**Tip:** For Custom Roles, you can modify the list of individual roles available for assignment.
|
||||
>
|
||||
> - To add roles to the list, [Add a Custom Role]({{< baseurl >}}/rancher/v2.x/en/admin-settings/rbac/creating-roles/).
|
||||
> - To remove roles from the list, [Lock/Unlock Roles]({{< baseurl >}}/rancher/v2.x/en/admin-settings/rbac/creating-roles/#locking-unlocking-roles).
|
||||
|
||||
**Result:** The chosen users are added to the cluster.
|
||||
|
||||
- To revoke cluster membership, select the user and click **Delete**. This action deletes membership, not the user.
|
||||
- To modify a user's roles in the cluster, delete them from the cluster, and then re-add them with modified roles.
|
||||
You can always add members to a cluster after a cluster is provisioned.
|
||||
|
||||
+1
-1
@@ -1,5 +1,5 @@
|
||||
---
|
||||
title: Pod Security Policies
|
||||
title: Assigning Pod Security Policies
|
||||
weight: 2260
|
||||
---
|
||||
|
||||
|
||||
@@ -4,10 +4,46 @@ weight: 3015
|
||||
draft: true
|
||||
---
|
||||
|
||||
## Increasing Number of nodes
|
||||
## Editing the Cluster Membership
|
||||
|
||||
Following cluster creation, you can add users as cluster members so that they can access its resources.
|
||||
|
||||
## Adding a Pod Security Policy
|
||||
1. From the **Global** view, open the cluster that you want to add members to.
|
||||
|
||||
2. From the main menu, select **Members**. Then click **Add Member**.
|
||||
|
||||
3. Search for the user or group that you want to add to the cluster.
|
||||
|
||||
If external authentication is configured:
|
||||
|
||||
- Rancher returns users from your [external authentication]({{< baseurl >}}/rancher/v2.x/en/admin-settings/authentication/) source as you type.
|
||||
|
||||
>**Using AD but can't find your users?**
|
||||
>There may be an issue with your search attribute configuration. See [Configuring Active Directory Authentication: Step 5]({{< baseurl >}}/rancher/v2.x/en/admin-settings/authentication/ad/).
|
||||
|
||||
- A drop-down allows you to add groups instead of individual users. The drop-down only lists groups that you, the logged in user, are part of.
|
||||
|
||||
>**Note:** If you are logged in as a local user, external users do not display in your search results. For more information, see [External Authentication Configuration and Principal Users]({{< baseurl >}}/rancher/v2.x/en/admin-settings/authentication/#external-authentication-configuration-and-principal-users).
|
||||
|
||||
4. Assign the user or group **Cluster** roles.
|
||||
|
||||
[What are Cluster Roles?]({{< baseurl >}}/rancher/v2.x/en/admin-settings/rbac/cluster-project-roles/)
|
||||
|
||||
>**Tip:** For Custom Roles, you can modify the list of individual roles available for assignment.
|
||||
>
|
||||
> - To add roles to the list, [Add a Custom Role]({{< baseurl >}}/rancher/v2.x/en/admin-settings/rbac/default-custom-roles/).
|
||||
> - To remove roles from the list, [Lock/Unlock Roles]({{< baseurl >}}/rancher/v2.x/en/admin-settings/rbac/locked-roles).
|
||||
|
||||
**Result:** The chosen users are added to the cluster.
|
||||
|
||||
- To revoke cluster membership, select the user and click **Delete**. This action deletes membership, not the user.
|
||||
- To modify a user's roles in the cluster, delete them from the cluster, and then re-add them with modified roles.
|
||||
|
||||
## Cluster Options
|
||||
|
||||
>**Note:** These cluster options are only available for [clusters that Rancher has launched Kubernetes]({{< baseurl >}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/).
|
||||
|
||||
### Adding/Changing a Pod Security Policy
|
||||
|
||||
If you don't apply a PSP as you create your cluster, you can always add one later.
|
||||
|
||||
@@ -31,3 +67,7 @@ If you don't apply a PSP as you create your cluster, you can always add one late
|
||||
**Result:** The PSP is applied to the cluster and any projects within the cluster.
|
||||
|
||||
>**Note:** Any workloads that are already running in a cluster or project before a PSP is assigned will not be checked if it complies with the PSP. Workloads would need to be cloned or upgraded to see if they pass the PSP.
|
||||
|
||||
### Node pools
|
||||
|
||||
Changing the nodes in a RKE cluster
|
||||
|
||||
@@ -5,19 +5,16 @@ aliases:
|
||||
- /rancher/v2.x/en/concepts/projects/
|
||||
---
|
||||
|
||||
_Projects_ are a new feature in Rancher that allows you to group namespaces. Users can be added as members to the project, and the project owner can assign roles to each member to control their project access.
|
||||
_Projects_ are a new concept introduced by Rancher. They are not a native Kubernetes construct. A project captures a set of policies for a set of namespaces. A user can be assigned a specific role in a project. A role can be owner, member, read-only, or [custom]({{< baseurl >}}/rancher/v2.x/en/admin-settings/rbac/default-custom-roles/). Policies include Kubernetes Role-Based Access Control (RBAC) policies and pod security policies. Rancher 2.0 also implements a canned network policy that isolates containers in different projects. Future versions of Rancher will implement more flexible network policies.
|
||||
|
||||
|
||||
_Projects_ are a new concept introduced by Rancher. They are not a native Kubernetes construct. A project captures a set of policies for a set of namespaces. A user can be assigned a specific role in a project. A role can be owner, member, read-only, or [custom]({{< baseurl >}}/rancher/v2.x/en/admin-settings/rbac/creating-roles/#adding-a-custom-role). Policies include Kubernetes Role-Based Access Control (RBAC) policies and pod security policies. Rancher 2.0 also implements a canned network policy that isolates containers in different projects. Future versions of Rancher will implement more flexible network policies.
|
||||
|
||||
### Authorization
|
||||
## Authorization
|
||||
|
||||
Non-administrative users are only authorized for project access after an administrator explicitly adds them to the project's **Members** tab.
|
||||
|
||||
>**Exception:**
|
||||
> Non-administrative users can access projects that they create themselves.
|
||||
|
||||
### Pod Security Policies
|
||||
## Pod Security Policies
|
||||
|
||||
Rancher extends Kubernetes to allow the application of [Pod Security Policies](https://kubernetes.io/docs/concepts/policy/pod-security-policy/) at the project level in addition to the cluster level. However, as a best practice, we recommend applying Pod Security Policies at the cluster level.
|
||||
|
||||
@@ -26,3 +23,55 @@ Rancher extends Kubernetes to allow the application of [Pod Security Policies](h
|
||||
Kubernetes resources belong to specific namespaces. Rancher 2.0 relies on namespaces to isolate resources among users and apps. When the user deploys an app from the catalog, for example, he can choose to deploy that app into its own namespace, so that resource names in one app will not conflict with resource names in another. Namespaces must be globally unique. It is often difficult for users to pick unique namespace names. Rancher therefore encourages the pattern where users work with projects, and the system generates unique namespace names automatically.
|
||||
|
||||
For more information, see the [Kubernetes Namespaces Documentation](https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces/).
|
||||
|
||||
## Creating Projects
|
||||
|
||||
1. From the **Global** view, choose **Clusters** from the main menu. From the **Clusters** page, open the cluster from which you want to create a project.
|
||||
|
||||
1. From the main menu, choose **Projects/Namespaces**. Then click **Add Project**.
|
||||
|
||||
1. Enter a **Project Name**.
|
||||
|
||||
1. **Optional:** Select a **Pod Security Policy**. Assigning a PSP to a project will:
|
||||
|
||||
- Override the cluster's default PSP.
|
||||
- Apply the PSP to the project.
|
||||
- Apply the PSP to any namespaces you add to the project later.
|
||||
|
||||
>**Note:** This option is only available if you've already created a Pod Security Policy. For instruction, see [Creating Pod Security Policies]({{< baseurl >}}/rancher/v2.x/en/admin-settings/pod-security-policies/).
|
||||
|
||||
1. **Recommended:** Add project members.
|
||||
|
||||
Use the **Members** accordion to provide other users with project access and roles.
|
||||
|
||||
By default, your user is added as the project `Owner`.
|
||||
|
||||
1. Click **Add Member**.
|
||||
|
||||
1. From the **Name** combo box, search for a user or group that you want to assign project access.
|
||||
|
||||
>**Note:** You can only search for groups if external authentication is enabled.
|
||||
|
||||
1. From the **Role** drop-down, choose a role.
|
||||
|
||||
[What are Roles?]({{< baseurl >}}/rancher/v2.x/en/admin-settings/rbac/cluster-project-roles/)
|
||||
|
||||
>**Tip:** Choose Custom to create a custom role on the fly: [Custom Project Roles]({{< baseurl >}}/rancher/v2.x/en/admin-settings/rbac/cluster-project-roles/#custom-project-roles).
|
||||
|
||||
1. To add more members, repeat substeps a—c.
|
||||
|
||||
|
||||
1. Click **Create**.
|
||||
|
||||
**Result:** Your project is created. You can view it from the cluster's **Projects/Namespaces** view.
|
||||
|
||||
## Switching Projects
|
||||
|
||||
To switch between clusters, use the **Global** drop-down available in the main menu.
|
||||
|
||||
|
||||
|
||||
Alternatively, you can switch between projects and clusters using the main menu.
|
||||
|
||||
- To switch between clusters, open the **Global** view and select **Clusters** from the main menu. Then open a cluster.
|
||||
- To switch between projects, open a cluster, and then select **Projects/Namespaces** from the main menu. Select the link for the project that you want to open.
|
||||
|
||||
-94
@@ -1,94 +0,0 @@
|
||||
---
|
||||
title: Creating and Managing Projects
|
||||
weight: 3021
|
||||
aliases:
|
||||
- /rancher/v2.x/en/tasks/projects/create-project/
|
||||
---
|
||||
|
||||
|
||||
1. From the **Global** view, choose **Clusters** from the main menu. From the **Clusters** page, open the cluster from which you want to create a project.
|
||||
|
||||
1. From the main menu, choose **Projects/Namespaces**. Then click **Add Project**.
|
||||
|
||||
1. Enter a **Project Name**.
|
||||
|
||||
1. **Optional:** Select a **Pod Security Policy**. Assigning a PSP to a project will:
|
||||
|
||||
- Override the cluster's default PSP.
|
||||
- Apply the PSP to the project.
|
||||
- Apply the PSP to any namespaces you add to the project later.
|
||||
|
||||
[What are Pod Security Policies?]({{< baseurl >}}/rancher/v2.x/en/admin-settings/pod-security-policies)
|
||||
|
||||
|
||||
>**Note:** This option is only available if you've already created a Pod Security Policy. For instruction, see [Creating Pod Security Policies]({{< baseurl >}}/rancher/v2.x/en/admin-settings/pod-security-policies/#creating-pod-security-policies).
|
||||
|
||||
1. **Recommended:** Add project members.
|
||||
|
||||
Use the **Members** accordion to provide other users with project access and roles.
|
||||
|
||||
By default, your user is added as the project `Owner`.
|
||||
|
||||
1. Click **Add Member**.
|
||||
|
||||
1. From the **Name** combo box, search for a user or group that you want to assign project access.
|
||||
|
||||
>**Note:** You can only search for groups if external authentication is enabled.
|
||||
|
||||
1. From the **Role** drop-down, choose a role.
|
||||
|
||||
[What are Roles?]({{< baseurl >}}/rancher/v2.x/en/admin-settings/rbac/cluster-project-roles/)
|
||||
|
||||
>**Tip:** Choose Custom to create a custom role on the fly: [Custom Project Roles]({{< baseurl >}}/rancher/v2.x/en/admin-settings/rbac/cluster-project-roles/#custom-project-roles).
|
||||
|
||||
1. To add more members, repeat substeps a—c.
|
||||
|
||||
|
||||
1. Click **Create**.
|
||||
|
||||
**Result:** Your project is created. You can view it from the cluster's **Projects/Namespaces** view.
|
||||
|
||||
## Switching projects
|
||||
|
||||
To switch between clusters, use the **Global** drop-down available in the main menu.
|
||||
|
||||
|
||||
|
||||
Alternatively, you can switch between projects and clusters using the main menu.
|
||||
|
||||
- To switch between clusters, open the **Global** view and select **Clusters** from the main menu. Then open a cluster.
|
||||
- To switch between projects, open a cluster, and then select **Projects/Namespaces** from the main menu. Select the link for the project that you want to open.
|
||||
|
||||
|
||||
## Editing the Pod Security Policy
|
||||
|
||||
You can always assign a PSP to an existing project if you didn't assign one during creation.
|
||||
|
||||
>**Prerequisites:**
|
||||
>
|
||||
> - Create a Pod Security Policy within Rancher. Before you can assign a default PSP to an existing project, you must have a PSP available for assignment. For instruction, see [Creating Pod Security Policies]({{< baseurl >}}/rancher/v2.x/en/admin-settings/pod-security-policies/).
|
||||
> - Assign a default Pod Security Policy to the project's cluster. You can't assign a PSP to a project until one is already applied to the cluster. For more information, see [Existing Cluster: Adding a Pod Security Policy](#existing-cluster--adding-a-pod-security-policy).
|
||||
|
||||
1. From the **Global** view, find the cluster containing the project you want to apply a PSP to.
|
||||
|
||||
1. From the main menu, select **Projects/Namespaces**.
|
||||
|
||||
3. Find the project that you want to add a PSP to. From that project, select **Vertical Ellipsis (...) > Edit**.
|
||||
|
||||
4. From the **Pod Security Policy** drop-down, select the PSP you want to apply to the project.
|
||||
Assigning a PSP to a project will:
|
||||
|
||||
- Override the cluster's default PSP.
|
||||
- Apply the PSP to the project.
|
||||
- Apply the PSP to any namespaces you add to the project later.
|
||||
|
||||
>**Prerequisites:**
|
||||
>
|
||||
> - Create a Pod Security Policy within Rancher. Before you can assign a default PSP to a new project, you must have a PSP available for assignment. For instruction, see [Creating Pod Security Policies]({{< baseurl >}}/rancher/v2.x/en/admin-settings/pod-security-policies/).
|
||||
> - Assign a default Pod Security Policy to the project's cluster. You can't assign a PSP to a project until one is already applied to the cluster.
|
||||
|
||||
5. Click **Save**.
|
||||
|
||||
**Result:** The PSP is applied to the project and any namespaces added to the project.
|
||||
|
||||
>**Note:** Any workloads that are already running in a cluster or project before a PSP is assigned will not be checked if it complies with the PSP. Workloads would need to be cloned or upgraded to see if they pass the PSP.
|
||||
+75
@@ -0,0 +1,75 @@
|
||||
---
|
||||
title: Creating and Managing Projects
|
||||
weight: 3021
|
||||
aliases:
|
||||
- /rancher/v2.x/en/tasks/projects/create-project/
|
||||
---
|
||||
|
||||
After projects are created, there are certain aspects that can be changed later.
|
||||
|
||||
## Adding Members
|
||||
|
||||
Following project creation, you can add users as project members so that they can access its resources.
|
||||
|
||||
1. From the **Global** view, open the project that you want to add members to.
|
||||
|
||||
2. From the main menu, select **Members**. Then click **Add Member**.
|
||||
|
||||
3. Search for the user or group that you want to add to the project.
|
||||
|
||||
If external authentication is configured:
|
||||
|
||||
- Rancher returns users from your external authentication source as you type.
|
||||
|
||||
- A drop-down allows you to add groups instead of individual users. The dropdown only lists groups that you, the logged in user, are included in.
|
||||
|
||||
>**Note:** If you are logged in as a local user, external users do not display in your search results.
|
||||
|
||||
1. Assign the user or group **Project** roles.
|
||||
|
||||
[What are Project Roles?]({{< baseurl >}}/rancher/v2.x/en/admin-settings/rbac/cluster-project-roles/)
|
||||
|
||||
>**Tip:** For Custom Roles, you can modify the list of individual roles available for assignment.
|
||||
>
|
||||
> - To add roles to the list, [Add a Custom Role]({{< baseurl >}}/rancher/v2.x/en/admin-settings/rbac/default-custom-roles).
|
||||
> - To remove roles from the list, [Lock/Unlock Roles]({{< baseurl >}}/rancher/v2.x/en/admin-settings/rbac/locked-roles/).
|
||||
|
||||
**Result:** The chosen users are added to the project.
|
||||
|
||||
- To revoke project membership, select the user and click **Delete**. This action deletes membership, not the user.
|
||||
- To modify a user's roles in the project, delete them from the project, and then re-add them with modified roles.
|
||||
|
||||
## Editing the Pod Security Policy
|
||||
|
||||
>**Note:** These cluster options are only available for [clusters that Rancher has launched Kubernetes]({{< baseurl >}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/).
|
||||
|
||||
You can always assign a PSP to an existing project if you didn't assign one during creation.
|
||||
|
||||
>**Prerequisites:**
|
||||
>
|
||||
> - Create a Pod Security Policy within Rancher. Before you can assign a default PSP to an existing project, you must have a PSP available for assignment. For instruction, see [Creating Pod Security Policies]({{< baseurl >}}/rancher/v2.x/en/admin-settings/pod-security-policies/).
|
||||
> - Assign a default Pod Security Policy to the project's cluster. You can't assign a PSP to a project until one is already applied to the cluster. For more information, see [Existing Cluster: Adding a Pod Security Policy](#existing-cluster--adding-a-pod-security-policy).
|
||||
|
||||
1. From the **Global** view, find the cluster containing the project you want to apply a PSP to.
|
||||
|
||||
1. From the main menu, select **Projects/Namespaces**.
|
||||
|
||||
3. Find the project that you want to add a PSP to. From that project, select **Vertical Ellipsis (...) > Edit**.
|
||||
|
||||
4. From the **Pod Security Policy** drop-down, select the PSP you want to apply to the project.
|
||||
Assigning a PSP to a project will:
|
||||
|
||||
- Override the cluster's default PSP.
|
||||
- Apply the PSP to the project.
|
||||
- Apply the PSP to any namespaces you add to the project later.
|
||||
|
||||
>**Prerequisites:**
|
||||
>
|
||||
> - Create a Pod Security Policy within Rancher. Before you can assign a default PSP to a new project, you must have a PSP available for assignment. For instruction, see [Creating Pod Security Policies]({{< baseurl >}}/rancher/v2.x/en/admin-settings/pod-security-policies/).
|
||||
> - Assign a default Pod Security Policy to the project's cluster. You can't assign a PSP to a project until one is already applied to the cluster.
|
||||
|
||||
5. Click **Save**.
|
||||
|
||||
**Result:** The PSP is applied to the project and any namespaces added to the project.
|
||||
|
||||
>**Note:** Any workloads that are already running in a cluster or project before a PSP is assigned will not be checked if it complies with the PSP. Workloads would need to be cloned or upgraded to see if they pass the PSP.
|
||||
+3
-35
@@ -11,42 +11,10 @@ If you want to provide a user with access and permissions to _specific_ projects
|
||||
|
||||
There are two contexts where you can add project members:
|
||||
|
||||
- [Adding Members to a New Project]({{< baseurl >}}/rancher/v2.x/en/kubernetes-in-rancher/projects-and-namespaces/project-members/)
|
||||
- [Adding Members when Creating New Projects]({{< baseurl >}}/rancher/v2.x/en/kubernetes-in-rancher/projects-and-namespaces/)
|
||||
|
||||
You can add members to a project as you create it (recommended if possible).
|
||||
|
||||
- [Adding Members to an Existing Project](#adding-members-to-an-existing-project)
|
||||
- [Adding Members to an Existing Project]({{< baseurl >}}/rancher/v2.x/en/kubernetes-in-rancher/projects-and-namespaces/editing-projects/)
|
||||
|
||||
You can always add members to a project later. See below.
|
||||
|
||||
### Adding Members to an Existing project
|
||||
|
||||
Following project creation, you can add users as project members so that they can access its resources.
|
||||
|
||||
1. From the **Global** view, open the project that you want to add members to.
|
||||
|
||||
2. From the main menu, select **Members**. Then click **Add Member**.
|
||||
|
||||
3. Search for the user or group that you want to add to the project.
|
||||
|
||||
If external authentication is configured:
|
||||
|
||||
- Rancher returns users from your external authentication source as you type.
|
||||
|
||||
- A drop-down allows you to add groups instead of individual users. The dropdown only lists groups that you, the logged in user, are included in.
|
||||
|
||||
>**Note:** If you are logged in as a local user, external users do not display in your search results.
|
||||
|
||||
1. Assign the user or group **Project** roles.
|
||||
|
||||
[What are Project Roles?]({{< baseurl >}}/rancher/v2.x/en/admin-settings/rbac/cluster-project-roles/)
|
||||
|
||||
>**Tip:** For Custom Roles, you can modify the list of individual roles available for assignment.
|
||||
>
|
||||
> - To add roles to the list, [Add a Custom Role]({{< baseurl >}}/rancher/v2.x/en/admin-settings/rbac/creating-roles/#adding-a-custom-role).
|
||||
> - To remove roles from the list, [Lock/Unlock Roles]({{< baseurl >}}/rancher/v2.x/en/admin-settings/rbac/creating-roles/#locking-unlocking-roles).
|
||||
|
||||
**Result:** The chosen users are added to the project.
|
||||
|
||||
- To revoke project membership, select the user and click **Delete**. This action deletes membership, not the user.
|
||||
- To modify a user's roles in the project, delete them from the project, and then re-add them with modified roles.
|
||||
You can always add members to a project later.
|
||||
|
||||
Reference in New Issue
Block a user