public/rancher-docs
1
0
Fork 0
mirror of https://github.com/rancher/rancher-docs.git synced 2026-09-25 12:38:05 +00:00
Code Issues Packages Projects Releases Wiki Activity

Revert "docs: updatepsa for project level (#1832)" (#1859)

Browse Source 
This reverts commit 9002cec58f.
This commit is contained in:
Lucas Saintarbor
2025-07-11 13:39:15 -07:00
committed by GitHub
parent 24d9793bbe
commit 399d9683d0
1 changed files with 0 additions and 28 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/manage-role-based-access-control-rbac/cluster-and-project-roles.md
-28
View File
@@ -196,34 +196,6 @@ As previously mentioned, custom roles can be defined for use at the cluster or p
When defining a custom role, you can grant access to specific resources or specify roles from which the custom role should inherit. A custom role can be made up of a combination of specific grants and inherited roles. All grants are additive. This means that defining a narrower grant for a specific resource **will not** override a broader grant defined in a role that the custom role is inheriting from.
#### UpdatePSA For Project Level
About defining custom roles, you can grant permission to a user to create or update *PSA* policies when defining namespaces within projects.
To do so, you can use the following `RoleTemplate` to be applied on the cluster:
```yaml
apiVersion: management.cattle.io/v3
builtin: false
context: project
description: ''
displayName: Manage PSA Labels
external: false
hidden: false
kind: RoleTemplate
metadata:
name: namespaces-psa
rules:
- apiGroups:
- management.cattle.io
resources:
- projects
verbs:
- updatepsa
```
When creating a new project (from the **Members** tab), click **Add** to add the user and select **Custom** > **Create Namespaces** (to allow the user to create namespaces).
Then click **Add** again and select `UpdatePSA` project role template from the list of **Project Permissions**.
### Default Cluster and Project Roles
By default, when a standard user creates a new cluster or project, they are automatically assigned an ownership role: either [cluster owner](#cluster-roles) or [project owner](#project-roles). However, in some organizations, these roles may overextend administrative access. In this use case, you can change the default role to something more restrictive, such as a set of individual roles or a custom role.