From 2a770e00c2e321d7e5acba1dd10019ba77e38ac8 Mon Sep 17 00:00:00 2001 From: Alessio Greggi Date: Wed, 4 Jun 2025 18:38:38 +0200 Subject: [PATCH] docs: add manage users disclaimer (#1765) * docs: add manage users disclaimer Signed-off-by: Alessio Greggi Co-authored-by: Lucas Saintarbor --- .../global-permissions.md | 6 ++++++ .../global-permissions.md | 6 ++++++ 2 files changed, 12 insertions(+) diff --git a/docs/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/manage-role-based-access-control-rbac/global-permissions.md b/docs/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/manage-role-based-access-control-rbac/global-permissions.md index 19e9ee261f8..b1da7de996f 100644 --- a/docs/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/manage-role-based-access-control-rbac/global-permissions.md +++ b/docs/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/manage-role-based-access-control-rbac/global-permissions.md @@ -100,6 +100,12 @@ For details on which Kubernetes resources correspond to each global permission, ::: +:::danger + +The built-in GlobalRole `Manage Users` allows users to create, modify and delete other users within the Rancher environment. While this permission may be necessary for administrative workflows in trusted environments, granting it to non-trusted or lower-privileged users, such as standard users, poses a serious security risk and may result in privilege escalation. + +::: + ### Custom GlobalRoles You can create custom GlobalRoles to satisfy use cases not directly addressed by built-in GlobalRoles. diff --git a/versioned_docs/version-2.11/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/manage-role-based-access-control-rbac/global-permissions.md b/versioned_docs/version-2.11/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/manage-role-based-access-control-rbac/global-permissions.md index 19e9ee261f8..b1da7de996f 100644 --- a/versioned_docs/version-2.11/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/manage-role-based-access-control-rbac/global-permissions.md +++ b/versioned_docs/version-2.11/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/manage-role-based-access-control-rbac/global-permissions.md @@ -100,6 +100,12 @@ For details on which Kubernetes resources correspond to each global permission, ::: +:::danger + +The built-in GlobalRole `Manage Users` allows users to create, modify and delete other users within the Rancher environment. While this permission may be necessary for administrative workflows in trusted environments, granting it to non-trusted or lower-privileged users, such as standard users, poses a serious security risk and may result in privilege escalation. + +::: + ### Custom GlobalRoles You can create custom GlobalRoles to satisfy use cases not directly addressed by built-in GlobalRoles.