Remove reference to inheritance for cloned roles

2026-05-26 22:58:45 +00:00 · 2019-12-17 15:23:35 -07:00
parent 1f0824553e
commit 63ba7b1fd5
2 changed files with 12 additions and 12 deletions
@@ -13,8 +13,8 @@ This section covers the following topics:

 - [Prerequisites](#prerequisites)
 - [Creating a custom role for a cluster or project](#creating-a-custom-role-for-a-cluster-or-project)
- [Creating a custom global role that inherits from an existing role](#creating-a-custom-global-role-that-inherits-from-an-existing-role)
- [Creating a custom global role that does not inherit from another role](#creating-a-custom-global-role-that-does-not-inherit-from-another-role)
+- [Creating a custom global role that copies rules from an existing role](#creating-a-custom-global-role-that-copies-rules-from-an-existing-role)
+- [Creating a custom global role that does not copy rules from another role](#creating-a-custom-global-role-that-does-not-copy-rules-from-another-role)
 - [Deleting a custom global role](#deleting-a-custom-global-role)
 - [Assigning a custom global role to a group](#assigning-a-custom-global-role-to-a-group)

@@ -51,11 +51,11 @@ The steps to add custom roles differ depending on the version of Rancher.

 1.  Use the **Grant Resources** options to assign individual [Kubernetes API endpoints](https://kubernetes.io/docs/reference/) to the role.

-    > When viewing the resources associated with default roles created by Rancher, if there are multiple Kuberenetes API resources on one line item, the resource will have `(Custom)` appended to it. These are not custom resources but just an indication that there are multiple Kubernetes API resources as one resource.
+    > When viewing the resources associated with default roles created by Rancher, if there are multiple Kubernetes API resources on one line item, the resource will have `(Custom)` appended to it. These are not custom resources but just an indication that there are multiple Kubernetes API resources as one resource.

    You can also choose the individual cURL methods (`Create`, `Delete`, `Get`, etc.) available for use with each endpoint you assign.

-1.  Use the **Inherit from a Role** options to assign individual Rancher roles to your custom roles.
+1.  Use the **Inherit from a Role** options to assign individual Rancher roles to your custom roles. Note: When a custom role inherits from a parent role, the parent role cannot be deleted until the child role is deleted.

 1.  Click **Create**.

@@ -82,22 +82,22 @@ The steps to add custom roles differ depending on the version of Rancher.

 1.  Use the **Grant Resources** options to assign individual [Kubernetes API endpoints](https://kubernetes.io/docs/reference/) to the role.

-    > When viewing the resources associated with default roles created by Rancher, if there are multiple Kuberenetes API resources on one line item, the resource will have `(Custom)` appended to it. These are not custom resources but just an indication that there are multiple Kubernetes API resources as one resource.
+    > When viewing the resources associated with default roles created by Rancher, if there are multiple Kubernetes API resources on one line item, the resource will have `(Custom)` appended to it. These are not custom resources but just an indication that there are multiple Kubernetes API resources as one resource.

    You can also choose the individual cURL methods (`Create`, `Delete`, `Get`, etc.) available for use with each endpoint you assign.

-1.  Use the **Inherit from a Role** options to assign individual Rancher roles to your custom roles.
+1.  Use the **Inherit from a Role** options to assign individual Rancher roles to your custom roles. Note: When a custom role inherits from a parent role, the parent role cannot be deleted until the child role is deleted.

 1.  Click **Create**.

 {{% /tab %}}
 {{% /tabs %}}

-## Creating a Custom Global Role that Inherits from an Existing Role
+## Creating a Custom Global Role that Copies Rules from an Existing Role

 _Available as of v2.3.4_

-If you have a group of individuals that need the same level of access in Rancher, it can save time to create a custom global role that inherits from another role, such as the administrator role, so that you only have to configure the variations between the new and existing roles.
+If you have a group of individuals that need the same level of access in Rancher, it can save time to create a custom global role in which all of the rules from another role, such as the administrator role, are copied into a new role. This allows you to only configure the variations between the existing role and the new role.

 The custom global role can then be assigned to a user or group so that the custom global role takes effect the first time the user or users sign into Rancher.

@@ -105,12 +105,12 @@ To create a custom global role based on an existing role,

 1. Go to the **Global** view and click **Security > Roles.**
 1. On the **Global** tab, go to the role that the custom global role will be based on. Click **Ellipsis (…) > Clone.**
-Enter a name for the role.
+1. Enter a name for the role.
 1. Optional: To assign the custom role default for new users, go to the **New User Default** section and click **Yes: Default role for new users.**
 1. In the **Grant Resources** section, select the Kubernetes resource operations that will be enabled for users with the custom role.
 1. Click **Save.**

-## Creating a Custom Global Role that Does Not Inherit from Another Role
+## Creating a Custom Global Role that Does Not Copy Rules from Another Role

 _Available as of v2.3.4_

@@ -33,7 +33,7 @@ Assignment of global permissions to a user depends on their authentication sourc

 Using custom permissions is convenient for providing users with narrow or specialized access to Rancher.

-When a user from an [external authentication source]({{<baseurl>}}/rancher/v2.x/en/admin-settings/authentication/) signs into Rancher for the first time, they're automatically assigned a set of global permissions (hereafter, permissions). By default, after a user logs in from the first time, they are created as a user and assigned the default `user` permission. The standard `user` permission allows users to login and create clusters.
+When a user from an [external authentication source]({{<baseurl>}}/rancher/v2.x/en/admin-settings/authentication/) signs into Rancher for the first time, they're automatically assigned a set of global permissions (hereafter, permissions). By default, after a user logs in for the first time, they are created as a user and assigned the default `user` permission. The standard `user` permission allows users to login and create clusters.

 However, in some organizations, these permissions may extend too much access. Rather than assigning users the default global permissions of `Administrator` or `Standard User`, you can assign them a more restrictive set of custom global permissions.

@@ -74,7 +74,7 @@ For details on which Kubernetes resources correspond to each global permission,
 > **Notes:**
 >
 > - Each permission listed above is comprised of multiple individual permissions not listed in the Rancher UI. For a full list of these permissions and the rules they are comprised of, access through the API at `/v3/globalRoles`.
-> - When viewing the resources associated with default roles created by Rancher, if there are multiple Kuberenetes API resources on one line item, the resource will have `(Custom)` appended to it. These are not custom resources but just an indication that there are multiple Kubernetes API resources as one resource.
+> - When viewing the resources associated with default roles created by Rancher, if there are multiple Kubernetes API resources on one line item, the resource will have `(Custom)` appended to it. These are not custom resources but just an indication that there are multiple Kubernetes API resources as one resource.

 ### Configuring Default Global Permissions