mirror of
https://github.com/rancher/rancher-docs.git
synced 2026-09-12 20:17:13 +00:00
Denise
@@ -0,0 +1,14 @@
|
||||
---
|
||||
title: Admin Settings
|
||||
weight: 1100
|
||||
aliases:
|
||||
- /rancher/v2.x/en/concepts/global-configuration
|
||||
---
|
||||
|
||||
After installing Rancher 2.0, you should
|
||||
|
||||
1. Set a Rancher Server URL, which your cluster nodes will use to resolve with Rancher. You'll be prompted to set this URL upon your first log in.
|
||||
|
||||
2. Set up external user authentication and permissions so that your organization can log into Rancher.
|
||||
|
||||
After making these initial configurations, you might also want to configure one or more _pod security policies_, which are sets of conditions that your pods must meet for Kubernetes to allow them to run.
|
||||
+8
-6
@@ -1,7 +1,11 @@
|
||||
---
|
||||
title: Authentication
|
||||
weight: 10
|
||||
weight: 50
|
||||
aliases:
|
||||
-/rancher/v2.x/en/concepts/global-configuration/authentication/
|
||||
-/rancher/v2.x/en/tasks/global-configuration/authentication/
|
||||
---
|
||||
|
||||
One of the key features that Rancher adds to Kubernetes is centralized user authentication. This feature allows your users to use one set of credentials to authenticate with any of your Kubernetes clusters.
|
||||
|
||||
This centralized user authentication is accomplished using the Rancher authentication proxy, which is installed along with the rest of Rancher. This proxy authenticates your users and forwards their requests to your Kubernetes clusters using a service account.
|
||||
@@ -22,7 +26,9 @@ However, Rancher also provides local authentication.
|
||||
|
||||
In most cases, you should use an external authentication service over local, as external authentication allows user management from a central location. However, you may want a few local authentication users for managing Rancher under rare circumstances, such as if Active Directory is down.
|
||||
|
||||
## External Authentication Configuration and Principal Users
|
||||
For more information on how to configure external authentication or local authentication, see [Authentication](../../../tasks/global-configuration/authentication/).
|
||||
|
||||
### External Authentication Configuration and Principal Users
|
||||
|
||||
Configuration of external authentication requires:
|
||||
|
||||
@@ -53,7 +59,3 @@ Configuration of external authentication affects how principal users are managed
|
||||
|
||||
6. The external principal and the local principal share the same access rights.
|
||||
|
||||
|
||||
## Related Links
|
||||
|
||||
- [Configuring Authentication]({{< baseurl >}}/rancher/v2.x/en/tasks/global-configuration/authentication)
|
||||
+14
-12
@@ -1,23 +1,25 @@
|
||||
---
|
||||
title: Configuring Active Directory (AD)
|
||||
weight: 51
|
||||
weight: 50
|
||||
aliases:
|
||||
-/rancher/v2.x/en/tasks/global-configuration/authentication/active-directory/
|
||||
---
|
||||
|
||||
In environments using Microsoft Active Directory (AD), you can configure Rancher to allow sign on using AD credentials.
|
||||
In environments using Microsoft AD, you can configure Rancher to allow sign on using AD credentials.
|
||||
|
||||
>**Prerequisites:**
|
||||
>
|
||||
>- Have an Active Directory server configured.
|
||||
>- Create a service account in Active Directory with `read-only` access. Rancher uses this account to verify group membership when a user makes a request using an API key.
|
||||
>- Read [External Authentication Configuration and Principal Users]({{< baseurl >}}/rancher/v2.x/en/concepts/global-configuration/authentication/#external-authentication-configuration-and-principal-users).
|
||||
>- Have an AD server configured.
|
||||
>- Create a service account in AD with `read-only` access. Rancher uses this account to verify group membership when a user makes a request using an API key.
|
||||
>- Read [External Authentication Configuration and Principal Users]({{< baseurl >}}/rancher/v2.x/en/admin-settings/authentication/#external-authentication-configuration-and-principal-users).
|
||||
|
||||
1. Sign into Rancher using a local user assigned `administrator` global permissions (i.e., the _local principal_).
|
||||
|
||||
2. From the **Global** view, select **Security > Authentication** from the main menu.
|
||||
|
||||
3. Select **Active Directory**.
|
||||
3. Select **AD**.
|
||||
|
||||
4. Complete the **Configure an Active Directory server** form.
|
||||
4. Complete the **Configure an AD server** form.
|
||||
|
||||
You may need to log in to your domain controller to find the information requested in the form.
|
||||
|
||||
@@ -27,12 +29,12 @@ In environments using Microsoft Active Directory (AD), you can configure Rancher
|
||||
<br/>
|
||||
>**User Search Base vs. Group Search Base**
|
||||
>
|
||||
>Search base allows Rancher to search for users and groups that are in your Active Directory. These fields are only for search bases and not for search filters.
|
||||
>Search base allows Rancher to search for users and groups that are in your AD. These fields are only for search bases and not for search filters.
|
||||
>
|
||||
>* If your users and groups are in the same search base, complete only the User Search Base.
|
||||
>* If your groups are in a different search base, you can optionally complete the Group Search Base. This field is dedicated to searching groups, but is not required.
|
||||
|
||||
5. If your Active Directory deviates from the standard AD schema, complete the **Customize Schema** form to match it. Otherwise, skip this step.
|
||||
5. If your AD deviates from the standard AD schema, complete the **Customize Schema** form to match it. Otherwise, skip this step.
|
||||
|
||||
>**Search Attribute** As of Rancher v2.0.1, the Search Attribute field defaults with three specific values: `sAMAccountName|sn|givenName`. After AD is configured, when a user enters text to add users or groups, Rancher automatically queries the AD server and attempts to match fields by sAMAccountName, last name, or first name. Rancher specifically searches for users/groups that begin with the text entered in the search field.
|
||||
>
|
||||
@@ -44,9 +46,9 @@ In environments using Microsoft Active Directory (AD), you can configure Rancher
|
||||
>
|
||||
> With this search attribute, Rancher creates search filters for users and groups, but you *cannot* add your own search filters in this field.
|
||||
|
||||
6. Enter your AD username and password in **Authenticate with Active Directory** to confirm that Rancher is configured to use AD authentication.
|
||||
6. Enter your AD username and password in **Authenticate with AD** to confirm that Rancher is configured to use AD authentication.
|
||||
|
||||
**Result:**
|
||||
|
||||
- Active Directory authentication is configured.
|
||||
- You are signed into Rancher with your Active Directory account (i.e., the _external principal_).
|
||||
- AD authentication is configured.
|
||||
- You are signed into Rancher with your AD account (i.e., the _external principal_).
|
||||
+4
-2
@@ -1,6 +1,8 @@
|
||||
---
|
||||
title: Configuring Azure Active Directory (Azure AD)
|
||||
weight: 52
|
||||
title: Configuring Azure AD
|
||||
weight: 75
|
||||
aliases:
|
||||
-/rancher/v2.x/en/tasks/global-configuration/authentication/azure-ad/
|
||||
---
|
||||
|
||||
_Available as of v2.0.3_
|
||||
+4
-2
@@ -1,6 +1,8 @@
|
||||
---
|
||||
title: Configuring FreeIPA
|
||||
weight: 55
|
||||
weight: 150
|
||||
aliases:
|
||||
-/rancher/v2.x/en/tasks/global-configuration/authentication/freeipa/
|
||||
---
|
||||
|
||||
_Available as of v2.0.5_
|
||||
@@ -11,7 +13,7 @@ If your organization uses FreeIPA for user authentication, you can configure Ran
|
||||
>
|
||||
>- You must have a [FreeIPA Server](https://www.freeipa.org/) configured.
|
||||
>- Create a service account in FreeIPA with `read-only` access. Rancher uses this account to verify group membership when a user makes a request using an API key.
|
||||
>- Read [External Authentication Configuration and Principal Users]({{< baseurl >}}/rancher/v2.x/en/concepts/global-configuration/authentication/#external-authentication-configuration-and-principal-users).
|
||||
>- Read [External Authentication Configuration and Principal Users]({{< baseurl >}}/rancher/v2.x/en/admin-settings/authentication/#external-authentication-configuration-and-principal-users).
|
||||
|
||||
1. Sign into Rancher using a local user assigned the `administrator` role (i.e., the _local principal_).
|
||||
|
||||
+5
-3
@@ -1,11 +1,13 @@
|
||||
---
|
||||
title: Configuring GitHub
|
||||
weight: 53
|
||||
title: Configuring GitHub
|
||||
weight: 100
|
||||
aliases:
|
||||
-/rancher/v2.x/en/tasks/global-configuration/authentication/github/
|
||||
---
|
||||
|
||||
In environments using GitHub, you can configure Rancher to allow sign on using GitHub credentials.
|
||||
|
||||
>**Prerequisites:** Read [External Authentication Configuration and Principal Users]({{< baseurl >}}/rancher/v2.x/en/concepts/global-configuration/authentication/#external-authentication-configuration-and-principal-users).
|
||||
>**Prerequisites:** Read [External Authentication Configuration and Principal Users]({{< baseurl >}}/rancher/v2.x/en/admin-settings/authentication/#external-authentication-configuration-and-principal-users).
|
||||
|
||||
1. Sign into Rancher using a local user assigned the `administrator` role (i.e., the _local principal_).
|
||||
|
||||
+4
-2
@@ -1,10 +1,12 @@
|
||||
---
|
||||
title: Configuring Local Authentication
|
||||
weight: 56
|
||||
weight: 25
|
||||
aliases:
|
||||
-/rancher/v2.x/en/tasks/global-configuration/authentication/local-authentication/
|
||||
---
|
||||
|
||||
Regardless of whether you use external authentication, you should create a few local authentication users so that you can continue using Rancher if you your external authentication service encounters issues.
|
||||
|
||||
1. From the **Global** view, select **Users** from the main menu.
|
||||
|
||||
2. Click **Add User**. Then complete the **Add User** form. Click **Create** when you're done.
|
||||
2. Click **Add User**. Then complete the **Add User** form. Click **Create** when you're done.
|
||||
+4
-2
@@ -1,6 +1,8 @@
|
||||
---
|
||||
title: Configuring OpenLDAP
|
||||
weight: 54
|
||||
weight: 125
|
||||
aliases:
|
||||
-/rancher/v2.x/en/tasks/global-configuration/authentication/openLDAP/
|
||||
---
|
||||
|
||||
_Available as of v2.0.5_
|
||||
@@ -11,7 +13,7 @@ If your organization uses OpenLDAP for user authentication, you can configure Ra
|
||||
>
|
||||
>- You must have an [OpenLDAP Server](https://www.openldap.org/) configured.
|
||||
>- Create a service account in OpenLDAP with `read-only` access. Rancher uses this account to verify group membership when a user makes a request using an API key.
|
||||
>- Read [External Authentication Configuration and Principal Users]({{< baseurl >}}/rancher/v2.x/en/concepts/global-configuration/authentication/#external-authentication-configuration-and-principal-users).
|
||||
>- Read [External Authentication Configuration and Principal Users]({{< baseurl >}}/rancher/v2.x/en/admin-settings/authentication/#external-authentication-configuration-and-principal-users).
|
||||
|
||||
1. Sign into Rancher using a local user assigned the `administrator` role (i.e., the _local principal_).
|
||||
|
||||
+20
-1
@@ -1,7 +1,26 @@
|
||||
---
|
||||
title: Pod Security Policies
|
||||
weight: 125
|
||||
weight: 100
|
||||
aliases:
|
||||
-/rancher/v2.x/en/concepts/global-configuration/pod-security-policies
|
||||
-/rancher/v2.x/en/tasks/global-configuration/pod-security-policies
|
||||
---
|
||||
|
||||
_Pod Security Policies_ (or PSPs) are objects that control security-sensitive aspects of pod specification (like root privileges). If a pod does not meet the conditions specified in the PSP, Kubernetes will not allow it to start, and Rancher will display an error message of `Pod <NAME> is forbidden: unable to validate...`.
|
||||
|
||||
- You can assign PSPs at the cluster or project level.
|
||||
- PSPs work through inheritance.
|
||||
|
||||
- By default, PSPs assigned to a cluster are inherited by its projects, as well as any namespaces added to those projects.
|
||||
- **Exception:** Namespaces that are not assigned to projects do not inherit PSPs, regardless of whether the PSP is assigned to a cluster or project. Because these namespaces have no PSPs, workload deployments to these namespaces will fail, which is the default Kubernetes behavior.
|
||||
- You can override the default PSP by assigning a different PSP directly to the project.
|
||||
- Any workloads that are already running in a cluster or project before a PSP is assigned will not be checked if it complies with the PSP. Workloads would need to be cloned or upgraded to see if they pass the PSP.
|
||||
|
||||
Read more about Pod Security Policies in the [Kubernetes Documentation](https://kubernetes.io/docs/concepts/policy/pod-security-policy/).
|
||||
|
||||
>**Best Practice:**
|
||||
>Set Pod Security at the cluster level.
|
||||
|
||||
Using Rancher, you can create a Pod Security Policy using our GUI rather than creating a YAML file.
|
||||
|
||||
## Creating Pod Security Policies
|
||||
+8
@@ -1,8 +1,16 @@
|
||||
---
|
||||
title: Rancher Server URL
|
||||
weight: 25
|
||||
aliases:
|
||||
-/rancher/v2.x/en/concepts/global-configuration/server-url
|
||||
-/rancher/v2.x/en/tasks/global-configuration/server-url
|
||||
---
|
||||
|
||||
This is the URL of your Rancher Server. All nodes in your cluster must resolve to this URL.
|
||||
|
||||
- You are prompted for this URL upon the very first Rancher login.
|
||||
- You can edit this URL later by selecting **Settings**.
|
||||
|
||||
The first time that you log into {{< product >}}, the system prompts you for the Rancher Server URL, which is the IP address or host name that your Kubernetes nodes register with.
|
||||
|
||||
If you need to update this URL, select **Settings** from the **Global** view.
|
||||
+5
-8
@@ -1,9 +1,11 @@
|
||||
---
|
||||
title: Users, Global Permissions, and Roles
|
||||
weight: 15
|
||||
title: RBAC
|
||||
weight: 75
|
||||
aliases:
|
||||
-/rancher/v2.x/en/admin-settings/rbac/
|
||||
---
|
||||
|
||||
Within Rancher, each user authenticates as a _user_, which is a login that grants you access to Rancher. As mentioned in [Authentication]({{< baseurl >}}/rancher/v2.x/en/concepts/global-configuration/authentication), users can either be local or external.
|
||||
Within Rancher, each person authenticates as a _user_, which is a login that grants you access to Rancher. As mentioned in [Authentication]({{< baseurl >}}/rancher/v2.x/en/concepts/global-configuration/authentication), users can either be local or external.
|
||||
|
||||
After you configure external authentication, the users that display on the **Users** page changes.
|
||||
|
||||
@@ -195,8 +197,3 @@ Roles can be locked by the following users:
|
||||
- Any user assigned the `Administrator` global permission.
|
||||
- Any user assigned the `Custom Users` permission, along with the `Manage Roles` role.
|
||||
|
||||
## Related Links
|
||||
|
||||
- [Adding Project Members]({{< baseurl >}}/rancher/v2.x/en/tasks/projects/add-project-members)
|
||||
- [Adding Project Members]({{< baseurl >}}/rancher/v2.x/en/tasks/clusters/adding-managing-cluster-members)
|
||||
- [Roles]({{< baseurl >}}/rancher/v2.x/en/tasks/global-configuration/roles)
|
||||
+9
-6
@@ -1,7 +1,10 @@
|
||||
---
|
||||
title: Roles
|
||||
weight: 100
|
||||
title: Creating Roles
|
||||
weight: 25
|
||||
aliases:
|
||||
-/rancher/v2.x/en/tasks/global-configuration/roles/
|
||||
---
|
||||
|
||||
Within Rancher, _roles_ determine what actions a user can make within a cluster or project.
|
||||
|
||||
Note that _roles_ are different from _permissions_, which determine what clusters and projects you can access.
|
||||
@@ -10,8 +13,8 @@ Note that _roles_ are different from _permissions_, which determine what cluster
|
||||
>
|
||||
>To complete the tasks on this page, the following permissions are required:
|
||||
>
|
||||
>- [Administrator Global Permissions]({{< baseurl >}}/rancher/v2.x/en/concepts/global-configuration/users-permissions-roles/#global-permissions).
|
||||
>- [Custom Global Permissions]({{< baseurl >}}/rancher/v2.x/en/concepts/global-configuration/users-permissions-roles/#custom-global-permissions) with the [Manage Roles]({{< baseurl >}}/rancher/v2.x/en/concepts/global-configuration/users-permissions-roles/#global-permissions-reference) role assigned.
|
||||
>- [Administrator Global Permissions]({{< baseurl >}}/rancher/v2.x/en/admin-settings/rbac/#global-permissions).
|
||||
>- [Custom Global Permissions]({{< baseurl >}}/rancher/v2.x/en/admin-settings/rbac/#custom-global-permissions) with the [Manage Roles]({{< baseurl >}}/rancher/v2.x/en/admin-settings/rbac/#global-permissions-reference) role assigned.
|
||||
|
||||
## Adding A Custom Role
|
||||
|
||||
@@ -23,7 +26,7 @@ While Rancher comes out-of-the-box with a set of default user roles, you can als
|
||||
|
||||
3. **Name** the role.
|
||||
|
||||
4. Choose whether to set the role to a status of [locked]({{< baseurl >}}/rancher/v2.x/en/concepts/global-configuration/users-permissions-roles/#locked-roles).
|
||||
4. Choose whether to set the role to a status of [locked]({{< baseurl >}}/rancher/v2.x/en/admin-settings/rbac/#locked-roles).
|
||||
|
||||
Locked roles cannot be assigned to users.
|
||||
|
||||
@@ -51,7 +54,7 @@ While Rancher comes out-of-the-box with a set of default user roles, you can als
|
||||
|
||||
## Locking/Unlocking Roles
|
||||
|
||||
If you want to prevent a role from being assigned to users, you can set it to a status of `locked`. For more information about what this status means, see [Locked Roles]({{< baseurl >}}/rancher/v2.x/en/concepts/global-configuration/users-permissions-roles/#locked-roles).
|
||||
If you want to prevent a role from being assigned to users, you can set it to a status of `locked`. For more information about what this status means, see [Locked Roles]({{< baseurl >}}/rancher/v2.x/en/admin-settings/rbac/#locked-roles).
|
||||
|
||||
You can lock roles in two contexts:
|
||||
|
||||
@@ -1,13 +0,0 @@
|
||||
---
|
||||
title: Global Configuration
|
||||
weight: 1
|
||||
---
|
||||
After installing Rancher 2.0, you should configure it to support your users and environment. This section describes the global configurations you should make after installation.
|
||||
|
||||
- [Rancher Server URL]({{< baseurl >}}/rancher/v2.x/en/concepts/global-configuration/server-url)
|
||||
- [Authentication]({{< baseurl >}}/rancher/v2.x/en/concepts/global-configuration/authentication/)
|
||||
- [Users, Roles, and Permissions]({{< baseurl >}}/rancher/v2.x/en/concepts/global-configuration/users-roles-permissions)
|
||||
- [Pod Security Policies]({{< baseurl >}}/rancher/v2.x/en/concepts/global-configuration/pod-security-policies)
|
||||
- [Node Drivers]({{< baseurl >}}/rancher/v2.x/en/concepts/global-configuration/node-drivers)
|
||||
- [Node Templates]({{< baseurl >}}/rancher/v2.x/en/concepts/global-configuration/node-templates)
|
||||
|
||||
@@ -1,29 +0,0 @@
|
||||
---
|
||||
title: Pod Security Policies
|
||||
weight: 75
|
||||
---
|
||||
|
||||
_Pod Security Policies_ (or PSPs) are objects that control security-sensitive aspects of pod specification (like root privileges). If a pod does not meet the conditions specified in the PSP, Kubernetes will not allow it to start, and Rancher will display an error message of `Pod <NAME> is forbidden: unable to validate...`.
|
||||
|
||||
- You can assign PSPs at the cluster or project level.
|
||||
- PSPs work through inheritance.
|
||||
|
||||
- By default, PSPs assigned to a cluster are inherited by its projects, as well as any namespaces added to those projects.
|
||||
- **Exception:** Namespaces that are not assigned to projects do not inherit PSPs, regardless of whether the PSP is assigned to a cluster or project. Because these namespaces have no PSPs, workload deployments to these namespaces will fail, which is the default Kubernetes behavior.
|
||||
- You can override the default PSP by assigning a different PSP directly to the project.
|
||||
- Any workloads that are already running in a cluster or project before a PSP is assigned will not be checked if it complies with the PSP. Workloads would need to be cloned or upgraded to see if they pass the PSP.
|
||||
|
||||
Read more about Pod Security Policies in the [Kubernetes Documentation](https://kubernetes.io/docs/concepts/policy/pod-security-policy/).
|
||||
|
||||
>**Best Practice:**
|
||||
>Set Pod Security at the cluster level.
|
||||
|
||||
## Related Links
|
||||
|
||||
### External Links
|
||||
|
||||
- [Pod Security Policies](https://kubernetes.io/docs/concepts/policy/pod-security-policy/)
|
||||
|
||||
### Tutorials
|
||||
|
||||
- [Creating Pod Security Policies]({{< baseurl >}}/rancher/v2.x/en/tasks/clusters/adding-a-pod-security-policy)
|
||||
@@ -1,9 +0,0 @@
|
||||
---
|
||||
title: Rancher Server URL
|
||||
weight: 5
|
||||
---
|
||||
|
||||
This is the URL of your Rancher Server. All nodes in your cluster must resolve to this URL.
|
||||
|
||||
- You are prompted for this URL upon the very first Rancher login.
|
||||
- You can edit this URL later by selecting **Settings**.
|
||||
@@ -3,7 +3,7 @@ title: Projects
|
||||
weight: 2150
|
||||
---
|
||||
|
||||
_Projects_ are a new concept introduced by Rancher. They are not a native Kubernetes construct. A project captures a set of policies for a set of namespaces. A user can be assigned a specific role in a project. A role can be owner, member, read-only, or [custom]({{< baseurl >}}/rancher/v2.x/en/tasks/global-configuration/roles/#adding-a-custom-role). Policies include Kubernetes Role-Based Access Control (RBAC) policies and pod security policies. Rancher 2.0 also implements a canned network policy that isolates containers in different projects. Future versions of Rancher will implement more flexible network policies.
|
||||
_Projects_ are a new concept introduced by Rancher. They are not a native Kubernetes construct. A project captures a set of policies for a set of namespaces. A user can be assigned a specific role in a project. A role can be owner, member, read-only, or [custom]({{< baseurl >}}/rancher/v2.x/en/admin-settings/rbac/creating-roles/#adding-a-custom-role). Policies include Kubernetes Role-Based Access Control (RBAC) policies and pod security policies. Rancher 2.0 also implements a canned network policy that isolates containers in different projects. Future versions of Rancher will implement more flexible network policies.
|
||||
|
||||
### Authorization
|
||||
|
||||
|
||||
@@ -14,14 +14,14 @@ You can add a Pod Security Policy (PSPs hereafter) in the following contexts:
|
||||
|
||||
> **Note:** We recommend adding PSPs during cluster and project creation instead of adding it to an existing one.
|
||||
|
||||
For more information about PSPs, refer to [Pod Security Policy]({{< baseurl >}}/rancher/v2.x/en/concepts/global-configuration/pod-security-policies).
|
||||
For more information about PSPs, refer to [Pod Security Policy]({{< baseurl >}}/rancher/v2.x/en/admin-settings/pod-security-policies).
|
||||
|
||||
## Cluster Creation: Adding a Default Pod Security Policy
|
||||
|
||||
When you create a new cluster, you can configure it to apply a PSP immediately. As you create the cluster, use the **Cluster Options** to enable a PSP. The PSP assigned to the cluster will be the default PSP for projects within the cluster.
|
||||
|
||||
>**Prerequisite:**
|
||||
>Create a Pod Security Policy within Rancher. Before you can assign a default PSP to a new cluster, you must have a PSP available for assignment. For instruction, see [Creating Pod Security Policies]({{< baseurl >}}/rancher/v2.x/en/tasks/global-configuration/pod-security-policies/).
|
||||
>Create a Pod Security Policy within Rancher. Before you can assign a default PSP to a new cluster, you must have a PSP available for assignment. For instruction, see [Creating Pod Security Policies]({{< baseurl >}}/rancher/v2.x/en/admin-settings/pod-security-policies/).
|
||||
>**Note:**
|
||||
>For security purposes, we recommend assigning a PSP as you create your clusters.
|
||||
|
||||
@@ -36,7 +36,7 @@ For detailed instruction about assigning a PSP to a new cluster, see [Creating a
|
||||
If you don't apply a PSP as you create your cluster, you can always add one later.
|
||||
|
||||
>**Prerequisite:**
|
||||
>Create a Pod Security Policy within Rancher. Before you can assign a default PSP to an existing cluster, you must have a PSP available for assignment. For instruction, see [Creating Pod Security Policies]({{< baseurl >}}/rancher/v2.x/en/tasks/global-configuration/pod-security-policies/).
|
||||
>Create a Pod Security Policy within Rancher. Before you can assign a default PSP to an existing cluster, you must have a PSP available for assignment. For instruction, see [Creating Pod Security Policies]({{< baseurl >}}/rancher/v2.x/en/admin-settings/pod-security-policies/).
|
||||
|
||||
1. From the **Global** view, find the cluster that you want to apply your PSP to. Select **Vertical Ellipsis (...) > Edit** for the cluster you want to enable PSPs for.
|
||||
|
||||
@@ -66,7 +66,7 @@ When you create a new project, you can assign a PSP directly to the project. Ass
|
||||
|
||||
>**Prerequisites:**
|
||||
>
|
||||
> - Create a Pod Security Policy within Rancher. Before you can assign a default PSP to a new project, you must have a PSP available for assignment. For instruction, see [Creating Pod Security Policies]({{< baseurl >}}/rancher/v2.x/en/tasks/global-configuration/pod-security-policies/).
|
||||
> - Create a Pod Security Policy within Rancher. Before you can assign a default PSP to a new project, you must have a PSP available for assignment. For instruction, see [Creating Pod Security Policies]({{< baseurl >}}/rancher/v2.x/en/admin-settings/pod-security-policies/).
|
||||
> - Assign a default Pod Security Policy to the project's cluster. You can't assign a PSP to a project until one is already applied to the cluster. For more information, see [Existing Cluster: Adding a Pod Security Policy](#existing-cluster--adding-a-pod-security-policy).
|
||||
|
||||
As you create the project, make a selection from the **Pod Security Policy** drop-down to assign a PSP.
|
||||
@@ -79,7 +79,7 @@ You can always assign a PSP to an existing project if you didn't assign one duri
|
||||
|
||||
>**Prerequisites:**
|
||||
>
|
||||
> - Create a Pod Security Policy within Rancher. Before you can assign a default PSP to an existing project, you must have a PSP available for assignment. For instruction, see [Creating Pod Security Policies]({{< baseurl >}}/rancher/v2.x/en/tasks/global-configuration/pod-security-policies/).
|
||||
> - Create a Pod Security Policy within Rancher. Before you can assign a default PSP to an existing project, you must have a PSP available for assignment. For instruction, see [Creating Pod Security Policies]({{< baseurl >}}/rancher/v2.x/en/admin-settings/pod-security-policies/).
|
||||
> - Assign a default Pod Security Policy to the project's cluster. You can't assign a PSP to a project until one is already applied to the cluster. For more information, see [Existing Cluster: Adding a Pod Security Policy](#existing-cluster--adding-a-pod-security-policy).
|
||||
|
||||
1. From the **Global** view, find the cluster containing the project you want to apply a PSP to.
|
||||
|
||||
@@ -29,23 +29,23 @@ Following cluster creation, you can add users as cluster members so that they ca
|
||||
|
||||
If external authentication is configured:
|
||||
|
||||
- Rancher returns users from your [external authentication]({{< baseurl >}}/rancher/v2.x/en/concepts/global-configuration/authentication/) source as you type.
|
||||
- Rancher returns users from your [external authentication]({{< baseurl >}}/rancher/v2.x/en/admin-settings/authentication/) source as you type.
|
||||
|
||||
>**Using AD but can't find your users?**
|
||||
>There may be an issue with your search attribute configuration. See [Configuring Active Directory Authentication: Step 5]({{< baseurl >}}/rancher/v2.x/en/tasks/global-configuration/authentication/active-directory/).
|
||||
>There may be an issue with your search attribute configuration. See [Configuring Active Directory Authentication: Step 5]({{< baseurl >}}/rancher/v2.x/en/admin-settings/authentication/configuring-ad/).
|
||||
|
||||
- A drop-down allows you to add groups instead of individual users. The drop-down only lists groups that you, the logged in user, are part of.
|
||||
|
||||
>**Note:** If you are logged in as a local user, external users do not display in your search results. For more information, see [External Authentication Configuration and Principal Users]({{< baseurl >}}/rancher/v2.x/en/concepts/global-configuration/authentication/#external-authentication-configuration-and-principal-users).
|
||||
>**Note:** If you are logged in as a local user, external users do not display in your search results. For more information, see [External Authentication Configuration and Principal Users]({{< baseurl >}}/rancher/v2.x/en/admin-settings/authentication/#external-authentication-configuration-and-principal-users).
|
||||
|
||||
4. Assign the user or group **Cluster** roles.
|
||||
|
||||
[What are Cluster Roles?]({{< baseurl >}}/rancher/v2.x/en/concepts/global-configuration/users-permissions-roles/#cluster-roles)
|
||||
[What are Cluster Roles?]({{< baseurl >}}/rancher/v2.x/en/admin-settings/rbac/#cluster-roles)
|
||||
|
||||
>**Tip:** For Custom Roles, you can modify the list of individual roles available for assignment.
|
||||
>
|
||||
> - To add roles to the list, [Add a Custom Role]({{< baseurl >}}/rancher/v2.x/en/tasks/global-configuration/roles/#adding-a-custom-role).
|
||||
> - To remove roles from the list, [Lock/Unlock Roles]({{< baseurl >}}/rancher/v2.x/en/tasks/global-configuration/roles/#locking-unlocking-roles).
|
||||
> - To add roles to the list, [Add a Custom Role]({{< baseurl >}}/rancher/v2.x/en/admin-settings/rbac/creating-roles/#adding-a-custom-role).
|
||||
> - To remove roles from the list, [Lock/Unlock Roles]({{< baseurl >}}/rancher/v2.x/en/admin-settings/rbac/creating-roles/#locking-unlocking-roles).
|
||||
|
||||
**Result:** The chosen users are added to the cluster.
|
||||
|
||||
|
||||
@@ -5,7 +5,7 @@ weight: 3500
|
||||
|
||||
>**Prerequisites:**
|
||||
>
|
||||
>- Working with storage requires the `Manage Volumes` [role]({{< baseurl >}}/rancher/v2.x/en/concepts/global-configuration/users-permissions-roles/#project-role-reference).
|
||||
>- Working with storage requires the `Manage Volumes` [role]({{< baseurl >}}/rancher/v2.x/en/admin-settings/rbac/#project-role-reference).
|
||||
>- You must have a storage medium provisioned. For more information, see [Provisioning Storage](provisioning-storage).
|
||||
|
||||
## Adding a Persistent Volume
|
||||
|
||||
@@ -1,31 +0,0 @@
|
||||
---
|
||||
title: Authentication
|
||||
weight: 50
|
||||
---
|
||||
|
||||
You have multiple options for user authentication in Rancher:
|
||||
|
||||
- [Active Directory](./active-directory/)
|
||||
|
||||
Enterprises can use Active Directory (AD) for authentication, allowing users to sign in using their corporate credentials.
|
||||
|
||||
- [Azure AD](./azure-ad/)
|
||||
|
||||
If you have an instance of Active Directory (AD) hosted in Azure, you can configure Rancher to allow your users to log in using their AD accounts. Configuration of Azure AD external authentication requires you to make configurations in both Azure and Rancher.
|
||||
|
||||
- [GitHub](./github/)
|
||||
|
||||
Open source projects or organizations that use GitHub for source control may prefer that users sign in using their GitHub accounts.
|
||||
|
||||
- [OpenLDAP](./openlap/)
|
||||
|
||||
Organizations can use OpenLDAP for authentication, allowing users to sign in using their corporate credentials.
|
||||
|
||||
- [FreeIPA](./freeipa/)
|
||||
|
||||
Organizations can use FreeIPA for authentication, allowing users to sign in using their corporate credentials.
|
||||
|
||||
|
||||
- [Local Authentication](./local-authentication/)
|
||||
|
||||
If you don't want to use external authentication, you can always add users directly to Rancher. We recommend using external authentication over local authentication.
|
||||
@@ -5,8 +5,8 @@ weight: 150
|
||||
|
||||
>**Prerequisites:** To create, edit, or delete drivers, you need _one_ of the following permissions:
|
||||
>
|
||||
>- [Administrator Global Permissions]({{< baseurl >}}/rancher/v2.x/en/concepts/global-configuration/users-permissions-roles/#global-permissions)
|
||||
>- [Custom Global Permissions]({{< baseurl >}}/rancher/v2.x/en/concepts/global-configuration/users-permissions-roles/#custom-global-permissions) with the [Manage Node Drivers]({{< baseurl >}}/rancher/v2.x/en/concepts/global-configuration/users-permissions-roles/#global-permissions-reference) role assigned.
|
||||
>- [Administrator Global Permissions]({{< baseurl >}}/rancher/v2.x/en/admin-settings/rbac/#global-permissions)
|
||||
>- [Custom Global Permissions]({{< baseurl >}}/rancher/v2.x/en/admin-settings/rbac/#custom-global-permissions) with the [Manage Node Drivers]({{< baseurl >}}/rancher/v2.x/en/admin-settings/rbac/#global-permissions-reference) role assigned.
|
||||
|
||||
## Adding Custom Node Drivers
|
||||
|
||||
|
||||
@@ -37,12 +37,12 @@ Following project creation, you can add users as project members so that they ca
|
||||
|
||||
1. Assign the user or group **Project** roles.
|
||||
|
||||
[What are Project Roles?]({{< baseurl >}}/rancher/v2.x/en/concepts/global-configuration/users-permissions-roles/#cluster-roles)
|
||||
[What are Project Roles?]({{< baseurl >}}/rancher/v2.x/en/admin-settings/rbac/#cluster-roles)
|
||||
|
||||
>**Tip:** For Custom Roles, you can modify the list of individual roles available for assignment.
|
||||
>
|
||||
> - To add roles to the list, [Add a Custom Role]({{< baseurl >}}/rancher/v2.x/en/tasks/global-configuration/roles/#adding-a-custom-role).
|
||||
> - To remove roles from the list, [Lock/Unlock Roles]({{< baseurl >}}/rancher/v2.x/en/tasks/global-configuration/roles/#locking-unlocking-roles).
|
||||
> - To add roles to the list, [Add a Custom Role]({{< baseurl >}}/rancher/v2.x/en/admin-settings/rbac/creating-roles/#adding-a-custom-role).
|
||||
> - To remove roles from the list, [Lock/Unlock Roles]({{< baseurl >}}/rancher/v2.x/en/admin-settings/rbac/creating-roles/#locking-unlocking-roles).
|
||||
|
||||
**Result:** The chosen users are added to the project.
|
||||
|
||||
|
||||
@@ -11,9 +11,9 @@ weight:
|
||||
|
||||
1. **Optional:** Select a **Pod Security Policy**.
|
||||
|
||||
[What are Pod Security Policies?]({{< baseurl >}}/rancher/v2.x/en/concepts/global-configuration/pod-security-policies)
|
||||
[What are Pod Security Policies?]({{< baseurl >}}/rancher/v2.x/en/admin-settings/pod-security-policies)
|
||||
|
||||
>**Note:** This option is only available if you've already created a Pod Security Policy. For instruction, see [Creating Pod Security Policies]({{< baseurl >}}/rancher/v2.x/en/tasks/global-configuration/pod-security-policies/#creating-pod-security-policies).
|
||||
>**Note:** This option is only available if you've already created a Pod Security Policy. For instruction, see [Creating Pod Security Policies]({{< baseurl >}}/rancher/v2.x/en/admin-settings/pod-security-policies/#creating-pod-security-policies).
|
||||
|
||||
1. **Recommended:** Add project members.
|
||||
|
||||
@@ -29,9 +29,9 @@ weight:
|
||||
|
||||
1. From the **Role** drop-down, choose a role.
|
||||
|
||||
[What are Roles?]({{< baseurl >}}/rancher/v2.x/en/concepts/global-configuration/users-permissions-roles/#cluster-and-project-roles)
|
||||
[What are Roles?]({{< baseurl >}}/rancher/v2.x/en/admin-settings/rbac/#cluster-and-project-roles)
|
||||
|
||||
>**Tip:** Choose Custom to create a custom role on the fly: [Custom Project Roles]({{< baseurl >}}/rancher/v2.x/en/concepts/global-configuration/users-permissions-roles/#custom-project-roles).
|
||||
>**Tip:** Choose Custom to create a custom role on the fly: [Custom Project Roles]({{< baseurl >}}/rancher/v2.x/en/admin-settings/rbac/#custom-project-roles).
|
||||
|
||||
1. To add more members, repeat substeps a—c.
|
||||
|
||||
|
||||
Reference in New Issue
Block a user