public/rancher-docs
1
0
Fork 0
mirror of https://github.com/rancher/rancher-docs.git synced 2026-04-29 01:33:12 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #2074 from andreas-kupries/rancher-45110-global-resource-docs

Browse Source 
initial page listing some of rancher's global resources
This commit is contained in:
Billy Tat
2026-02-24 08:59:10 -08:00
committed by GitHub
parent ba36e5a3cc f8442a4de8
commit 55eaa901b9
18 changed files with 262 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/manage-role-based-access-control-rbac/global-permissions.md
+2
View File
@@ -114,6 +114,8 @@ You can create custom GlobalRoles to satisfy use cases not directly addressed by
Create custom GlobalRoles through the UI or through automation (such as the Rancher Kubernetes API). You can specify the same type of rules as the rules for upstream roles and clusterRoles.
See the list [Global Resources](global-resources.md) for relevant resources.
#### Escalate and Bind verbs
When giving permissions on GlobalRoles, keep in mind that Rancher respects the `escalate` and `bind` verbs, in a similar fashion to [Kubernetes](https://kubernetes.io/docs/reference/access-authn-authz/rbac/#restrictions-on-role-creation-or-update).
docs/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/manage-role-based-access-control-rbac/global-resources.md
+44
View File
@@ -0,0 +1,44 @@
---
title: Global Resources
---
<head>
<link rel="canonical" href="https://ranchermanager.docs.rancher.com/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/manage-role-based-access-control-rbac/global-resources"/>
</head>
Global Resources are non-namespaced resources provided by Rancher. Users who are
cluster-owners/project-owners do not have access to several of these by
default. For example principals and roletemplates.
The resources are documented here to support administrators creating and/or
modifying custom sets of permissions with finding the minimum set of permissions
needed for a particular task in the dashboard.
As an example, to use the cluster/project permissions pages of the dashboard
requires permissions on principals to search/display a readable name for users,
and on roleTemplates, to see a list of usable roleTemplates as well as to
display a readable name for the role.
Please see the list below to determine what permissions you may need when creating a least-privilege user.
| Group | Resource | Purpose |
| -------------------- | ------------------------------ | --------------------------------------------------------------------------- |
| auditlog.cattle.io | auditpolicies | Specification of log filers, redactions, verbosity |
| catalog.cattle.io | clusterrepos | Helm chart repository location and credentials |
| ext.cattle.io | groupmembershiprefreshrequests | Creation triggers refresh of group membership for specific or all users |
| ext.cattle.io | kubeconfigs | Kubeconfig file for access to remote clusters |
| ext.cattle.io | passwordchangerequests | Creation triggers update of the referenced User's password |
| ext.cattle.io | selfusers | Get delivers User making the request |
| ext.cattle.io | tokens | Raw API key. See Kubeconfig for wrapped API keys |
| management.cattle.io | authconfigs | Configuration of external auth service providers |
| management.cattle.io | clusters | Remote cluster management |
| management.cattle.io | features | Feature controlling rancher behaviour |
| management.cattle.io | globalrolebindings | Binding of user/group to a global role |
| management.cattle.io | globalroles | Custom role for global permissions (applied local and remote) |
| management.cattle.io | nodedrivers | Configuration of driver to provision clusters with a cloud service provider |
| management.cattle.io | roletemplates | Template for custom roles managing project- or cluster-specific permissions |
| management.cattle.io | settings | Setting controlling Rancher behaviour |
| management.cattle.io | tokens | Raw API key, old style. |
| management.cattle.io | userattributes | Additional information about a managed User |
| management.cattle.io | users | User known to and managed by Rancher |
| telemetry.cattle.io | secretrequests | Request creation of a secret with arbitrary name, in any namespace |
sidebars.js
+1
View File
@@ -280,6 +280,7 @@ const sidebars = {
},
items: [
"how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/manage-role-based-access-control-rbac/global-permissions",
"how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/manage-role-based-access-control-rbac/global-resources",
"how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/manage-role-based-access-control-rbac/cluster-and-project-roles",
"how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/manage-role-based-access-control-rbac/custom-roles",
"how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/manage-role-based-access-control-rbac/locked-roles",
versioned_docs/version-2.10/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/manage-role-based-access-control-rbac/global-permissions.md
+2
View File
@@ -110,6 +110,8 @@ You can create custom GlobalRoles to satisfy use cases not directly addressed by
Create custom GlobalRoles through the UI or through automation (such as the Rancher Kubernetes API). You can specify the same type of rules as the rules for upstream roles and clusterRoles.
See the list [Global Resources](global-resources.md) for relevant resources.
#### Escalate and Bind verbs
When giving permissions on GlobalRoles, keep in mind that Rancher respects the `escalate` and `bind` verbs, in a similar fashion to [Kubernetes](https://kubernetes.io/docs/reference/access-authn-authz/rbac/#restrictions-on-role-creation-or-update).
versioned_docs/version-2.10/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/manage-role-based-access-control-rbac/global-resources.md
+39
View File
@@ -0,0 +1,39 @@
---
title: Global Resources1
---
<head>
<link rel="canonical" href="https://ranchermanager.docs.rancher.com/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/manage-role-based-access-control-rbac/global-resources"/>
</head>
Global Resources are non-namespaced resources provided by Rancher. Users who are
cluster-owners/project-owners do not have access to several of these by
default. For example principals and roletemplates.
The resources are documented here to support administrators creating and/or
modifying custom sets of permissions with finding the minimum set of permissions
needed for a particular task in the dashboard.
As an example, to use the cluster/project permissions pages of the dashboard
requires permissions on principals to search/display a readable name for users,
and on roleTemplates, to see a list of usable roleTemplates as well as to
display a readable name for the role.
Please see the list below to determine what permissions you may need when creating a least-privilege user.
| Group | Resource | Purpose |
| -------------------- | ------------------------------ | --------------------------------------------------------------------------- |
| auditlog.cattle.io | auditpolicies | Specification of log filers, redactions, verbosity |
| catalog.cattle.io | clusterrepos | Helm chart repository location and credentials |
| management.cattle.io | authconfigs | Configuration of external auth service providers |
| management.cattle.io | clusters | Remote cluster management |
| management.cattle.io | features | Feature controlling rancher behaviour |
| management.cattle.io | globalrolebindings | Binding of user/group to a global role |
| management.cattle.io | globalroles | Custom role for global permissions (applied local and remote) |
| management.cattle.io | nodedrivers | Configuration of driver to provision clusters with a cloud service provider |
| management.cattle.io | roletemplates | Template for custom roles managing project- or cluster-specific permissions |
| management.cattle.io | settings | Setting controlling Rancher behaviour |
| management.cattle.io | tokens | Raw API key, old style. |
| management.cattle.io | userattributes | Additional information about a managed User |
| management.cattle.io | users | User known to and managed by Rancher |
| telemetry.cattle.io | secretrequests | Request creation of a secret with arbitrary name, in any namespace |
versioned_docs/version-2.11/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/manage-role-based-access-control-rbac/global-permissions.md
+2
View File
@@ -114,6 +114,8 @@ You can create custom GlobalRoles to satisfy use cases not directly addressed by
Create custom GlobalRoles through the UI or through automation (such as the Rancher Kubernetes API). You can specify the same type of rules as the rules for upstream roles and clusterRoles.
See the list [Global Resources](global-resources.md) for relevant resources.
#### Escalate and Bind verbs
When giving permissions on GlobalRoles, keep in mind that Rancher respects the `escalate` and `bind` verbs, in a similar fashion to [Kubernetes](https://kubernetes.io/docs/reference/access-authn-authz/rbac/#restrictions-on-role-creation-or-update).
versioned_docs/version-2.11/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/manage-role-based-access-control-rbac/global-resources.md
+39
View File
@@ -0,0 +1,39 @@
---
title: Global Resources1
---
<head>
<link rel="canonical" href="https://ranchermanager.docs.rancher.com/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/manage-role-based-access-control-rbac/global-resources"/>
</head>
Global Resources are non-namespaced resources provided by Rancher. Users who are
cluster-owners/project-owners do not have access to several of these by
default. For example principals and roletemplates.
The resources are documented here to support administrators creating and/or
modifying custom sets of permissions with finding the minimum set of permissions
needed for a particular task in the dashboard.
As an example, to use the cluster/project permissions pages of the dashboard
requires permissions on principals to search/display a readable name for users,
and on roleTemplates, to see a list of usable roleTemplates as well as to
display a readable name for the role.
Please see the list below to determine what permissions you may need when creating a least-privilege user.
| Group | Resource | Purpose |
| -------------------- | ------------------------------ | --------------------------------------------------------------------------- |
| auditlog.cattle.io | auditpolicies | Specification of log filers, redactions, verbosity |
| catalog.cattle.io | clusterrepos | Helm chart repository location and credentials |
| management.cattle.io | authconfigs | Configuration of external auth service providers |
| management.cattle.io | clusters | Remote cluster management |
| management.cattle.io | features | Feature controlling rancher behaviour |
| management.cattle.io | globalrolebindings | Binding of user/group to a global role |
| management.cattle.io | globalroles | Custom role for global permissions (applied local and remote) |
| management.cattle.io | nodedrivers | Configuration of driver to provision clusters with a cloud service provider |
| management.cattle.io | roletemplates | Template for custom roles managing project- or cluster-specific permissions |
| management.cattle.io | settings | Setting controlling Rancher behaviour |
| management.cattle.io | tokens | Raw API key, old style. |
| management.cattle.io | userattributes | Additional information about a managed User |
| management.cattle.io | users | User known to and managed by Rancher |
| telemetry.cattle.io | secretrequests | Request creation of a secret with arbitrary name, in any namespace |
versioned_docs/version-2.12/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/manage-role-based-access-control-rbac/global-permissions.md
+2
View File
@@ -114,6 +114,8 @@ You can create custom GlobalRoles to satisfy use cases not directly addressed by
Create custom GlobalRoles through the UI or through automation (such as the Rancher Kubernetes API). You can specify the same type of rules as the rules for upstream roles and clusterRoles.
See the list [Global Resources](global-resources.md) for relevant resources.
#### Escalate and Bind verbs
When giving permissions on GlobalRoles, keep in mind that Rancher respects the `escalate` and `bind` verbs, in a similar fashion to [Kubernetes](https://kubernetes.io/docs/reference/access-authn-authz/rbac/#restrictions-on-role-creation-or-update).
versioned_docs/version-2.12/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/manage-role-based-access-control-rbac/global-resources.md
+39
View File
@@ -0,0 +1,39 @@
---
title: Global Resources1
---
<head>
<link rel="canonical" href="https://ranchermanager.docs.rancher.com/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/manage-role-based-access-control-rbac/global-resources"/>
</head>
Global Resources are non-namespaced resources provided by Rancher. Users who are
cluster-owners/project-owners do not have access to several of these by
default. For example principals and roletemplates.
The resources are documented here to support administrators creating and/or
modifying custom sets of permissions with finding the minimum set of permissions
needed for a particular task in the dashboard.
As an example, to use the cluster/project permissions pages of the dashboard
requires permissions on principals to search/display a readable name for users,
and on roleTemplates, to see a list of usable roleTemplates as well as to
display a readable name for the role.
Please see the list below to determine what permissions you may need when creating a least-privilege user.
| Group | Resource | Purpose |
| -------------------- | ------------------------------ | --------------------------------------------------------------------------- |
| auditlog.cattle.io | auditpolicies | Specification of log filers, redactions, verbosity |
| catalog.cattle.io | clusterrepos | Helm chart repository location and credentials |
| management.cattle.io | authconfigs | Configuration of external auth service providers |
| management.cattle.io | clusters | Remote cluster management |
| management.cattle.io | features | Feature controlling rancher behaviour |
| management.cattle.io | globalrolebindings | Binding of user/group to a global role |
| management.cattle.io | globalroles | Custom role for global permissions (applied local and remote) |
| management.cattle.io | nodedrivers | Configuration of driver to provision clusters with a cloud service provider |
| management.cattle.io | roletemplates | Template for custom roles managing project- or cluster-specific permissions |
| management.cattle.io | settings | Setting controlling Rancher behaviour |
| management.cattle.io | tokens | Raw API key, old style. |
| management.cattle.io | userattributes | Additional information about a managed User |
| management.cattle.io | users | User known to and managed by Rancher |
| telemetry.cattle.io | secretrequests | Request creation of a secret with arbitrary name, in any namespace |
versioned_docs/version-2.13/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/manage-role-based-access-control-rbac/global-permissions.md
+2
View File
@@ -114,6 +114,8 @@ You can create custom GlobalRoles to satisfy use cases not directly addressed by
Create custom GlobalRoles through the UI or through automation (such as the Rancher Kubernetes API). You can specify the same type of rules as the rules for upstream roles and clusterRoles.
See the list [Global Resources](global-resources.md) for relevant resources.
#### Escalate and Bind verbs
When giving permissions on GlobalRoles, keep in mind that Rancher respects the `escalate` and `bind` verbs, in a similar fashion to [Kubernetes](https://kubernetes.io/docs/reference/access-authn-authz/rbac/#restrictions-on-role-creation-or-update).
versioned_docs/version-2.13/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/manage-role-based-access-control-rbac/global-resources.md
+44
View File
@@ -0,0 +1,44 @@
---
title: Global Resources1
---
<head>
<link rel="canonical" href="https://ranchermanager.docs.rancher.com/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/manage-role-based-access-control-rbac/global-resources"/>
</head>
Global Resources are non-namespaced resources provided by Rancher. Users who are
cluster-owners/project-owners do not have access to several of these by
default. For example principals and roletemplates.
The resources are documented here to support administrators creating and/or
modifying custom sets of permissions with finding the minimum set of permissions
needed for a particular task in the dashboard.
As an example, to use the cluster/project permissions pages of the dashboard
requires permissions on principals to search/display a readable name for users,
and on roleTemplates, to see a list of usable roleTemplates as well as to
display a readable name for the role.
Please see the list below to determine what permissions you may need when creating a least-privilege user.
| Group | Resource | Purpose |
| -------------------- | ------------------------------ | --------------------------------------------------------------------------- |
| auditlog.cattle.io | auditpolicies | Specification of log filers, redactions, verbosity |
| catalog.cattle.io | clusterrepos | Helm chart repository location and credentials |
| ext.cattle.io | groupmembershiprefreshrequests | Creation triggers refresh of group membership for specific or all users |
| ext.cattle.io | kubeconfigs | Kubeconfig file for access to remote clusters |
| ext.cattle.io | passwordchangerequests | Creation triggers update of the referenced User's password |
| ext.cattle.io | selfusers | Get delivers User making the request |
| ext.cattle.io | tokens | Raw API key. See Kubeconfig for wrapped API keys |
| management.cattle.io | authconfigs | Configuration of external auth service providers |
| management.cattle.io | clusters | Remote cluster management |
| management.cattle.io | features | Feature controlling rancher behaviour |
| management.cattle.io | globalrolebindings | Binding of user/group to a global role |
| management.cattle.io | globalroles | Custom role for global permissions (applied local and remote) |
| management.cattle.io | nodedrivers | Configuration of driver to provision clusters with a cloud service provider |
| management.cattle.io | roletemplates | Template for custom roles managing project- or cluster-specific permissions |
| management.cattle.io | settings | Setting controlling Rancher behaviour |
| management.cattle.io | tokens | Raw API key, old style. |
| management.cattle.io | userattributes | Additional information about a managed User |
| management.cattle.io | users | User known to and managed by Rancher |
| telemetry.cattle.io | secretrequests | Request creation of a secret with arbitrary name, in any namespace |
versioned_docs/version-2.9/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/manage-role-based-access-control-rbac/global-permissions.md
+2
View File
@@ -110,6 +110,8 @@ You can create custom GlobalRoles to satisfy use cases not directly addressed by
Create custom GlobalRoles through the UI or through automation (such as the Rancher Kubernetes API). You can specify the same type of rules as the rules for upstream roles and clusterRoles.
See the list [Global Resources](global-resources.md) for relevant resources.
#### Escalate and Bind verbs
When giving permissions on GlobalRoles, keep in mind that Rancher respects the `escalate` and `bind` verbs, in a similar fashion to [Kubernetes](https://kubernetes.io/docs/reference/access-authn-authz/rbac/#restrictions-on-role-creation-or-update).
versioned_docs/version-2.9/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/manage-role-based-access-control-rbac/global-resources.md
+39
View File
@@ -0,0 +1,39 @@
---
title: Global Resources1
---
<head>
<link rel="canonical" href="https://ranchermanager.docs.rancher.com/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/manage-role-based-access-control-rbac/global-resources"/>
</head>
Global Resources are non-namespaced resources provided by Rancher. Users who are
cluster-owners/project-owners do not have access to several of these by
default. For example principals and roletemplates.
The resources are documented here to support administrators creating and/or
modifying custom sets of permissions with finding the minimum set of permissions
needed for a particular task in the dashboard.
As an example, to use the cluster/project permissions pages of the dashboard
requires permissions on principals to search/display a readable name for users,
and on roleTemplates, to see a list of usable roleTemplates as well as to
display a readable name for the role.
Please see the list below to determine what permissions you may need when creating a least-privilege user.
| Group | Resource | Purpose |
| -------------------- | ------------------------------ | --------------------------------------------------------------------------- |
| auditlog.cattle.io | auditpolicies | Specification of log filers, redactions, verbosity |
| catalog.cattle.io | clusterrepos | Helm chart repository location and credentials |
| management.cattle.io | authconfigs | Configuration of external auth service providers |
| management.cattle.io | clusters | Remote cluster management |
| management.cattle.io | features | Feature controlling rancher behaviour |
| management.cattle.io | globalrolebindings | Binding of user/group to a global role |
| management.cattle.io | globalroles | Custom role for global permissions (applied local and remote) |
| management.cattle.io | nodedrivers | Configuration of driver to provision clusters with a cloud service provider |
| management.cattle.io | roletemplates | Template for custom roles managing project- or cluster-specific permissions |
| management.cattle.io | settings | Setting controlling Rancher behaviour |
| management.cattle.io | tokens | Raw API key, old style. |
| management.cattle.io | userattributes | Additional information about a managed User |
| management.cattle.io | users | User known to and managed by Rancher |
| telemetry.cattle.io | secretrequests | Request creation of a secret with arbitrary name, in any namespace |
versioned_sidebars/version-2.10-sidebars.json
+1
View File
@@ -261,6 +261,7 @@
},
"items": [
"how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/manage-role-based-access-control-rbac/global-permissions",
"how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/manage-role-based-access-control-rbac/global-resources",
"how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/manage-role-based-access-control-rbac/cluster-and-project-roles",
"how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/manage-role-based-access-control-rbac/custom-roles",
"how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/manage-role-based-access-control-rbac/locked-roles"
versioned_sidebars/version-2.11-sidebars.json
+1
View File
@@ -261,6 +261,7 @@
},
"items": [
"how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/manage-role-based-access-control-rbac/global-permissions",
"how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/manage-role-based-access-control-rbac/global-resources",
"how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/manage-role-based-access-control-rbac/cluster-and-project-roles",
"how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/manage-role-based-access-control-rbac/custom-roles",
"how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/manage-role-based-access-control-rbac/locked-roles"
versioned_sidebars/version-2.12-sidebars.json
+1
View File
@@ -260,6 +260,7 @@
},
"items": [
"how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/manage-role-based-access-control-rbac/global-permissions",
"how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/manage-role-based-access-control-rbac/global-resources",
"how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/manage-role-based-access-control-rbac/cluster-and-project-roles",
"how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/manage-role-based-access-control-rbac/custom-roles",
"how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/manage-role-based-access-control-rbac/locked-roles"
versioned_sidebars/version-2.13-sidebars.json
+1
View File
@@ -261,6 +261,7 @@
},
"items": [
"how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/manage-role-based-access-control-rbac/global-permissions",
"how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/manage-role-based-access-control-rbac/global-resources",
"how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/manage-role-based-access-control-rbac/cluster-and-project-roles",
"how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/manage-role-based-access-control-rbac/custom-roles",
"how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/manage-role-based-access-control-rbac/locked-roles"
versioned_sidebars/version-2.9-sidebars.json
+1
View File
@@ -261,6 +261,7 @@
},
"items": [
"how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/manage-role-based-access-control-rbac/global-permissions",
"how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/manage-role-based-access-control-rbac/global-resources",
"how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/manage-role-based-access-control-rbac/cluster-and-project-roles",
"how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/manage-role-based-access-control-rbac/custom-roles",
"how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/manage-role-based-access-control-rbac/locked-roles"