diff --git a/docs/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/manage-role-based-access-control-rbac/global-permissions.md b/docs/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/manage-role-based-access-control-rbac/global-permissions.md index bcbfa624eb7..724dcc7e410 100644 --- a/docs/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/manage-role-based-access-control-rbac/global-permissions.md +++ b/docs/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/manage-role-based-access-control-rbac/global-permissions.md @@ -114,6 +114,8 @@ You can create custom GlobalRoles to satisfy use cases not directly addressed by Create custom GlobalRoles through the UI or through automation (such as the Rancher Kubernetes API). You can specify the same type of rules as the rules for upstream roles and clusterRoles. +See the list [Global Resources](global-resources.md) for relevant resources. + #### Escalate and Bind verbs When giving permissions on GlobalRoles, keep in mind that Rancher respects the `escalate` and `bind` verbs, in a similar fashion to [Kubernetes](https://kubernetes.io/docs/reference/access-authn-authz/rbac/#restrictions-on-role-creation-or-update). diff --git a/docs/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/manage-role-based-access-control-rbac/global-resources.md b/docs/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/manage-role-based-access-control-rbac/global-resources.md new file mode 100644 index 00000000000..09c50e90d21 --- /dev/null +++ b/docs/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/manage-role-based-access-control-rbac/global-resources.md @@ -0,0 +1,35 @@ +--- +title: Global Resources +--- + + + + + +Global Resources are resources provided by Rancher which are not namespaced. + +Users who are cluster-owners/project-owners do not have access to them by default. + +Please see the list below to determine what permissions you may need when creating a least-privilege user. + +| Group | Resource | Purpose | +| -------------------- | ------------------------------ | --------------------------------------------------------------------------- | +| auditlog.cattle.io | auditpolicies | Specification of log filers, redactions, verbosity | +| catalog.cattle.io | clusterrepos | Helm chart repository location and credentials | +| ext.cattle.io | groupmembershiprefreshrequests | Creation triggers refresh of group membership for specific or all users | +| ext.cattle.io | kubeconfigs | Kubeconfig file for access to remote clusters | +| ext.cattle.io | passwordchangerequests | Creation triggers update of the referenced User's password | +| ext.cattle.io | selfusers | Get delivers User making the request | +| ext.cattle.io | tokens | Raw API key. See Kubeconfig for wrapped API keys | +| management.cattle.io | authconfigs | Configuration of external auth service providers | +| management.cattle.io | clusters | Remote cluster management | +| management.cattle.io | features | Feature controlling rancher behaviour | +| management.cattle.io | globalrolebindings | Binding of user/group to a global role | +| management.cattle.io | globalroles | Custom role for global permissions (applied local and remote) | +| management.cattle.io | nodedrivers | Configuration of driver to provision clusters with a cloud service provider | +| management.cattle.io | roletemplates | Template for custom roles managing project- or cluster-specific permissions | +| management.cattle.io | settings | Setting controlling Rancher behaviour | +| management.cattle.io | tokens | Raw API key, old style. | +| management.cattle.io | userattributes | Additional information about a managed User | +| management.cattle.io | users | User known to and managed by Rancher | +| telemetry.cattle.io | secretrequests | Request creation of a secret with arbitrary name, in any namespace | diff --git a/sidebars.js b/sidebars.js index 73b0e3411a3..3d3dae11ec2 100644 --- a/sidebars.js +++ b/sidebars.js @@ -280,6 +280,7 @@ const sidebars = { }, items: [ "how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/manage-role-based-access-control-rbac/global-permissions", + "how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/manage-role-based-access-control-rbac/global-resources", "how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/manage-role-based-access-control-rbac/cluster-and-project-roles", "how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/manage-role-based-access-control-rbac/custom-roles", "how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/manage-role-based-access-control-rbac/locked-roles",