deploy: 5693bf2c1a

v2.5/explanations/integrations-in-rancher/cis-scans/rbac-for-cis-scans.html

@@ -12,7 +12,7 @@
 
 <script src="https://cdn.cookielaw.org/scripttemplates/otSDKStub.js" charset="UTF-8" data-domain-script="0f98beb0-fc4c-417d-a42e-564e2cae42d2" async></script>
 <script src="/scripts/optanonwrapper.js" async></script><link rel="stylesheet" href="/assets/css/styles.efd70281.css">
-<link rel="preload" href="/assets/js/runtime~main.105b7aa1.js" as="script">
+<link rel="preload" href="/assets/js/runtime~main.54224207.js" as="script">
 <link rel="preload" href="/assets/js/main.909f3494.js" as="script">
 </head>
 <body class="navigation-with-keyboard">
@@ -24,7 +24,7 @@ Rancher v2.5.2 because it essentially is same as <code>cis-admin</code>. If you
 for <code>cis-edit</code>, please update them to use <code>cis-admin</code> ClusterRole instead.</p><h2 class="anchor anchorWithStickyNavbar_LWe7" id="cluster-admin-access">Cluster-Admin Access<a href="#cluster-admin-access" class="hash-link" aria-label="Direct link to Cluster-Admin Access" title="Direct link to Cluster-Admin Access">​</a></h2><p>Rancher CIS Scans is a cluster-admin only feature by default.
 This means only the Rancher global admins, and the cluster’s cluster-owner can:</p><ul><li>Install/Uninstall the rancher-cis-benchmark App</li><li>See the navigation links for CIS Benchmark CRDs - ClusterScanBenchmarks, ClusterScanProfiles, ClusterScans</li><li>List the default ClusterScanBenchmarks and ClusterScanProfiles</li><li>Create/Edit/Delete new ClusterScanProfiles</li><li>Create/Edit/Delete a new ClusterScan to run the CIS scan on the cluster</li><li>View and Download the ClusterScanReport created after the ClusterScan is complete</li></ul><h2 class="anchor anchorWithStickyNavbar_LWe7" id="summary-of-default-permissions-for-kubernetes-default-roles">Summary of Default Permissions for Kubernetes Default Roles<a href="#summary-of-default-permissions-for-kubernetes-default-roles" class="hash-link" aria-label="Direct link to Summary of Default Permissions for Kubernetes Default Roles" title="Direct link to Summary of Default Permissions for Kubernetes Default Roles">​</a></h2><p>The rancher-cis-benchmark creates three <code>ClusterRoles</code> and adds the CIS Benchmark CRD access to the following default K8s <code>ClusterRoles</code>:</p><table><thead><tr><th>ClusterRole created by chart</th><th>Default K8s ClusterRole</th><th>Permissions given with Role</th></tr></thead><tbody><tr><td><code>cis-admin</code></td><td><code>admin</code></td><td>Ability to CRUD clusterscanbenchmarks, clusterscanprofiles, clusterscans, clusterscanreports CR</td></tr><tr><td><code>cis-view</code></td><td><code>view </code></td><td>Ability to List(R) clusterscanbenchmarks, clusterscanprofiles, clusterscans, clusterscanreports CR</td></tr></tbody></table><p>By default only cluster-owner role will have ability to manage and use <code>rancher-cis-benchmark</code> feature.</p><p>The other Rancher roles (cluster-member, project-owner, project-member) do not have any default permissions to manage and use rancher-cis-benchmark resources.</p><p>But if a cluster-owner wants to delegate access to other users, they can do so by creating ClusterRoleBindings between these users and the above CIS ClusterRoles manually.
 There is no automatic role aggregation supported for the <code>rancher-cis-benchmark</code> ClusterRoles.</p></div><footer class="theme-doc-footer docusaurus-mt-lg"><div class="theme-doc-footer-edit-meta-row row"><div class="col"><a href="https://github.com/rancher/rancher-docs/edit/main/versioned_docs/version-2.5/explanations/integrations-in-rancher/cis-scans/rbac-for-cis-scans.md" target="_blank" rel="noreferrer noopener" class="theme-edit-this-page"><svg fill="currentColor" height="20" width="20" viewBox="0 0 40 40" class="iconEdit_Z9Sw" aria-hidden="true"><g><path d="m34.5 11.7l-3 3.1-6.3-6.3 3.1-3q0.5-0.5 1.2-0.5t1.1 0.5l3.9 3.9q0.5 0.4 0.5 1.1t-0.5 1.2z m-29.5 17.1l18.4-18.5 6.3 6.3-18.4 18.4h-6.3v-6.2z"></path></g></svg>Edit this page</a></div><div class="col lastUpdated_vwxv"><span class="theme-last-updated">Last updated<!-- --> on <b><time datetime="2022-09-23T17:11:24.000Z">Sep 23, 2022</time></b></span></div></div></footer></article><nav class="pagination-nav docusaurus-mt-lg" aria-label="Docs pages navigation"><a class="pagination-nav__link pagination-nav__link--prev" href="/v2.5/explanations/integrations-in-rancher/cis-scans/configuration-reference"><div class="pagination-nav__sublabel">Previous</div><div class="pagination-nav__label">Configuration</div></a><a class="pagination-nav__link pagination-nav__link--next" href="/v2.5/explanations/integrations-in-rancher/cis-scans/skipped-and-not-applicable-tests"><div class="pagination-nav__sublabel">Next</div><div class="pagination-nav__label">Skipped and Not Applicable Tests</div></a></nav></div></div><div class="col col--3"><div class="tableOfContents_bqdL thin-scrollbar theme-doc-toc-desktop"><ul class="table-of-contents table-of-contents__left-border"><li><a href="#cluster-admin-access" class="table-of-contents__link toc-highlight">Cluster-Admin Access</a></li><li><a href="#summary-of-default-permissions-for-kubernetes-default-roles" class="table-of-contents__link toc-highlight">Summary of Default Permissions for Kubernetes Default Roles</a></li></ul></div></div></div></div></main></div></div><footer class="footer footer--dark"><div class="container container-fluid"><div class="footer__bottom text--center"><div class="footer__copyright">Copyright © 2023 SUSE Rancher. All Rights Reserved.</div></div></div></footer></div>
-<script src="/assets/js/runtime~main.105b7aa1.js"></script>
+<script src="/assets/js/runtime~main.54224207.js"></script>
 <script src="/assets/js/main.909f3494.js"></script>
 </body>
 </html>