diff --git a/content/rancher/v2.x/en/admin-settings/rbac/cluster-project-roles/_index.md b/content/rancher/v2.x/en/admin-settings/rbac/cluster-project-roles/_index.md index 27b28bcb7c8..dcd2e893f9c 100644 --- a/content/rancher/v2.x/en/admin-settings/rbac/cluster-project-roles/_index.md +++ b/content/rancher/v2.x/en/admin-settings/rbac/cluster-project-roles/_index.md @@ -38,14 +38,16 @@ The following table lists each built-in custom cluster role available in Rancher | Manage Cluster Members | ✓ | | | Manage Cluster Catalogs | ✓ | | Manage Nodes | ✓ | | +| Manage Snapshots | ✓ || | Manage Storage | ✓ | | | View All Projects | ✓ | | | Create Project | ✓ | ✓ | | View Cluster Members | ✓ | ✓ | | View Cluster Catalogs | ✓ | ✓ | | View Nodes | ✓ | ✓ | +| View Snapshots | ✓ | ✓ | -> **Notes:** +> **Notes:** > >- Each cluster role listed above, including `Owner` and `Member`, is comprised of multiple rules granting access to various resources. You can view the roles and their rules on the Global > Security > Roles page. >- When viewing the resources associated with default roles created by Rancher, if there are multiple Kuberenetes API resources on one line item, the resource will have `(Custom)` appended to it. These are not custom resources but just an indication that there are multiple Kubernetes API resources as one resource. @@ -65,11 +67,11 @@ _Project roles_ are roles that can be used to grant users access to a project. T - **Read Only:** These users can view everything in the project but cannot create, update, or delete anything. - + >**Caveat:** > >Users assigned the `Owner` or `Member` role for a project automatically inherit the `namespace creation` role. However, this role is a [Kubernetes ClusterRole](https://kubernetes.io/docs/reference/access-authn-authz/rbac/#role-and-clusterrole), meaning its scope extends to all projects in the cluster. Therefore, users explicitly assigned the `owner` or `member` role for a project can create namespaces in other projects they're assigned to, even with only the `Read Only` role assigned. - + #### Custom Project Roles @@ -101,7 +103,7 @@ The following table lists each built-in custom project role available in Rancher | View Volumes | ✓ | ✓ | ✓ | | View Workloads | ✓ | ✓ | ✓ | -> **Notes:** +> **Notes:** > >- Each project role listed above, including `Owner`, `Member`, and `Read Only`, is comprised of multiple rules granting access to various resources. You can view the roles and their rules on the Global > Security > Roles page. >- When viewing the resources associated with default roles created by Rancher, if there are multiple Kuberenetes API resources on one line item, the resource will have `(Custom)` appended to it. These are not custom resources but just an indication that there are multiple Kubernetes API resources as one resource. @@ -123,7 +125,7 @@ There are two methods for changing default cluster/project roles: For example, instead of assigning a role that inherits other roles (such as `cluster owner`), you can choose a mix of individual roles (such as `manage nodes` and `manage storage`). ->**Note:** +>**Note:** > >- Although you can [lock]({{< baseurl >}}/rancher/v2.x/en/admin-settings/rbac/locked-roles/) a default role, the system still assigns the role to users who create a cluster/project. >- Only users that create clusters/projects inherit their roles. Users added to the cluster/project membership afterward must be explicitly assigned their roles. @@ -139,7 +141,7 @@ You can change the cluster or project role(s) that are automatically assigned to 1. Enable the role as default. {{% accordion id="cluster" label="For Clusters" %}} 1. From **Clustor Creator Default**, choose **Yes: Default role for new cluster creation**. -1. Click **Save**. +1. Click **Save**. {{% /accordion %}} {{% accordion id="project" label="For Projects" %}} 1. From **Project Creator Default**, choose **Yes: Default role for new project creation**.