From 03f5ba5c00773b440084ce75460cd4bcb0a039c0 Mon Sep 17 00:00:00 2001 From: Mark Bishop Date: Tue, 4 Sep 2018 15:18:17 -0700 Subject: [PATCH 1/6] adding docs about cluster membership revokement --- .../rbac/cluster-project-roles/_index.md | 62 ++++++++++--------- 1 file changed, 33 insertions(+), 29 deletions(-) diff --git a/content/rancher/v2.x/en/admin-settings/rbac/cluster-project-roles/_index.md b/content/rancher/v2.x/en/admin-settings/rbac/cluster-project-roles/_index.md index ca77ffb96ed..3e2c72055f9 100644 --- a/content/rancher/v2.x/en/admin-settings/rbac/cluster-project-roles/_index.md +++ b/content/rancher/v2.x/en/admin-settings/rbac/cluster-project-roles/_index.md @@ -33,15 +33,15 @@ Rancher lets you assign _custom cluster roles_ to a user instead of the typical The following table lists each built-in custom cluster role available in Rancher and whether it is also granted by the `Owner` or `Member` role. -| Custom Cluster Role | Owner | Member | -| ---------------------------------- | ------------- | ------------- | -| Manage Cluster Members | ✓ | | -| Manage Nodes | ✓ | | -| Manage Storage | ✓ | | -| View All Projects | ✓ | | -| Create Project | ✓ | ✓ | -| View Cluster Members | ✓ | ✓ | -| View Nodes | ✓ | ✓ | +| Custom Cluster Role | Owner | Member | +| ---------------------------------- | ------------- | --------------------------------- | +| Manage Cluster Members | ✓ | | +| Manage Nodes | ✓ | | +| Manage Storage | ✓ | | +| View All Projects | ✓ | | +| Create Project | ✓ | ✓ | +| View Cluster Members | ✓ | ✓ | +| View Nodes | ✓ | ✓ | > **Note:** Each cluster role listed above, including `Owner` and `Member`, is comprised of multiple rules granting access to various resources. You can view the roles and their rules on the Global > Security > Roles page. @@ -69,25 +69,25 @@ Rancher lets you assign _custom project roles_ to a user instead of the typical The following table lists each built-in custom project role available in Rancher and whether it is also granted by the `Owner`, `Member`, or `Read Only` role. -| Custom Cluster Role | Owner | Member | Read Only | -| ---------------------------------- | ------------- | ------------- | ------------- | -| Manage Project Members | ✓ | | | -| Create Namespaces | ✓ | ✓ | | -| Manage Config Maps | ✓ | ✓ | | -| Manage Ingress | ✓ | ✓ | | -| Manage Secrets | ✓ | ✓ | | -| Manage Service Accounts | ✓ | ✓ | | -| Manage Services | ✓ | ✓ | | -| Manage Volumes | ✓ | ✓ | | -| Manage Workloads | ✓ | ✓ | | -| View Config Maps | ✓ | ✓ | ✓ | -| View Ingress | ✓ | ✓ | ✓ | -| View Project Members | ✓ | ✓ | ✓ | -| View Secrets | ✓ | ✓ | ✓ | -| View Service Accounts | ✓ | ✓ | ✓ | -| View Services | ✓ | ✓ | ✓ | -| View Volumes | ✓ | ✓ | ✓ | -| View Workloads | ✓ | ✓ | ✓ | +| Custom Cluster Role | Owner | Member | Read Only | +| ---------------------------------- | ------------- | ----------------------------- | ------------- | +| Manage Project Members | ✓ | | | +| Create Namespaces | ✓ | ✓ | | +| Manage Config Maps | ✓ | ✓ | | +| Manage Ingress | ✓ | ✓ | | +| Manage Secrets | ✓ | ✓ | | +| Manage Service Accounts | ✓ | ✓ | | +| Manage Services | ✓ | ✓ | | +| Manage Volumes | ✓ | ✓ | | +| Manage Workloads | ✓ | ✓ | | +| View Config Maps | ✓ | ✓ | ✓ | +| View Ingress | ✓ | ✓ | ✓ | +| View Project Members | ✓ | ✓ | ✓ | +| View Secrets | ✓ | ✓ | ✓ | +| View Service Accounts | ✓ | ✓ | ✓ | +| View Services | ✓ | ✓ | ✓ | +| View Volumes | ✓ | ✓ | ✓ | +| View Workloads | ✓ | ✓ | ✓ | > **Note:** Each project role listed above, including Owner, Member, and Read Only, is comprised of multiple rules granting access to various resources. You can view the roles and their rules on the Global > Security > Roles page. @@ -133,4 +133,8 @@ You can change the cluster or project role(s) that are automatically assigned to 1. If you want to remove a default role, edit the permission and select **No** from the default roles option. -**Result:** The default roles are configured based on your changes. Roles assigned to cluster/project creators display a check in the **Cluster/Project Creator Default** column. \ No newline at end of file +**Result:** The default roles are configured based on your changes. Roles assigned to cluster/project creators display a check in the **Cluster/Project Creator Default** column. + +### Cluster Membership Revocation Behavior + +When you revoke the cluster membership for a user assigned the **Member** permission, that user [loses their cluster roles](#clus-roles) for the cluster, but [retains their project roles](#proj-roles). In other words, although you have revoked the user's permissions to access the cluster and its nodes, the user can still access and manage the projects and namespaces they've created previously. This functionality is intended to prevent project and namespace owners from being locked out of their own projects and namespaces. \ No newline at end of file From 6c7210e717e81ed2f50716c5bf894989e62899c6 Mon Sep 17 00:00:00 2001 From: Mark Bishop Date: Thu, 6 Sep 2018 11:48:09 -0700 Subject: [PATCH 2/6] small edits --- .../v2.x/en/admin-settings/rbac/cluster-project-roles/_index.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/rancher/v2.x/en/admin-settings/rbac/cluster-project-roles/_index.md b/content/rancher/v2.x/en/admin-settings/rbac/cluster-project-roles/_index.md index 3e2c72055f9..be3976c4657 100644 --- a/content/rancher/v2.x/en/admin-settings/rbac/cluster-project-roles/_index.md +++ b/content/rancher/v2.x/en/admin-settings/rbac/cluster-project-roles/_index.md @@ -137,4 +137,4 @@ You can change the cluster or project role(s) that are automatically assigned to ### Cluster Membership Revocation Behavior -When you revoke the cluster membership for a user assigned the **Member** permission, that user [loses their cluster roles](#clus-roles) for the cluster, but [retains their project roles](#proj-roles). In other words, although you have revoked the user's permissions to access the cluster and its nodes, the user can still access and manage the projects and namespaces they've created previously. This functionality is intended to prevent project and namespace owners from being locked out of their own projects and namespaces. \ No newline at end of file +When you revoke the cluster membership for a user assigned the **Member** permission, that user [loses their cluster roles](#clus-roles) for the cluster but [retains their project roles](#proj-roles), which the user inherited through their now-revoked cluster membership. In other words, although you have revoked the user's permissions to access the cluster and its nodes, the user can still access and manage the projects and namespaces they've created previously. This functionality is intended to prevent project and namespace owners from being locked out of their own projects and namespaces. \ No newline at end of file From 3c5c6314553fbf429b5c3f19b3ce3c49dc2be593 Mon Sep 17 00:00:00 2001 From: Mark Bishop Date: Thu, 6 Sep 2018 12:42:59 -0700 Subject: [PATCH 3/6] adding description of what happens when you revoke a users's cluster access but not their project access --- .../en/admin-settings/rbac/cluster-project-roles/_index.md | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/content/rancher/v2.x/en/admin-settings/rbac/cluster-project-roles/_index.md b/content/rancher/v2.x/en/admin-settings/rbac/cluster-project-roles/_index.md index be3976c4657..305f7cf3da7 100644 --- a/content/rancher/v2.x/en/admin-settings/rbac/cluster-project-roles/_index.md +++ b/content/rancher/v2.x/en/admin-settings/rbac/cluster-project-roles/_index.md @@ -137,4 +137,9 @@ You can change the cluster or project role(s) that are automatically assigned to ### Cluster Membership Revocation Behavior -When you revoke the cluster membership for a user assigned the **Member** permission, that user [loses their cluster roles](#clus-roles) for the cluster but [retains their project roles](#proj-roles), which the user inherited through their now-revoked cluster membership. In other words, although you have revoked the user's permissions to access the cluster and its nodes, the user can still access and manage the projects and namespaces they've created previously. This functionality is intended to prevent project and namespace owners from being locked out of their own projects and namespaces. \ No newline at end of file +When you revoke the cluster membership for a user that's explicitly assigned membership to both the cluster _and_ a project within the cluster, that user [loses their cluster roles](#clus-roles) but [retains their project roles](#proj-roles). In other words, although you have revoked the user's permissions to access the cluster and its nodes, the user can still access and manage: + +- The projects they hold membership in. +- The namespaces that they've created. + +This functionality is intended to prevent project and namespace owners from being locked out of their own projects and namespaces. If you want to completely revoke a user's access within a cluster, revoke both their cluster and project memberships. \ No newline at end of file From b379e47cbaa5d27cf381cf3e14cb51d6c7e4df3b Mon Sep 17 00:00:00 2001 From: Mark Bishop Date: Fri, 7 Sep 2018 11:02:59 -0700 Subject: [PATCH 4/6] updating description of what users can do within projects after their cluster membership is revoked --- .../en/admin-settings/rbac/cluster-project-roles/_index.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/content/rancher/v2.x/en/admin-settings/rbac/cluster-project-roles/_index.md b/content/rancher/v2.x/en/admin-settings/rbac/cluster-project-roles/_index.md index 305f7cf3da7..3c2d2a6dbae 100644 --- a/content/rancher/v2.x/en/admin-settings/rbac/cluster-project-roles/_index.md +++ b/content/rancher/v2.x/en/admin-settings/rbac/cluster-project-roles/_index.md @@ -137,9 +137,9 @@ You can change the cluster or project role(s) that are automatically assigned to ### Cluster Membership Revocation Behavior -When you revoke the cluster membership for a user that's explicitly assigned membership to both the cluster _and_ a project within the cluster, that user [loses their cluster roles](#clus-roles) but [retains their project roles](#proj-roles). In other words, although you have revoked the user's permissions to access the cluster and its nodes, the user can still access and manage: +When you revoke the cluster membership for a user that's explicitly assigned membership to both the cluster _and_ a project within the cluster, that user [loses their cluster roles](#clus-roles) but [retains their project roles](#proj-roles). In other words, although you have revoked the user's permissions to access the cluster and its nodes, the user can still: -- The projects they hold membership in. -- The namespaces that they've created. +- Access the projects they hold membership in. +- Exercise any [individual project roles](#project-role-reference) they are assigned. This functionality is intended to prevent project and namespace owners from being locked out of their own projects and namespaces. If you want to completely revoke a user's access within a cluster, revoke both their cluster and project memberships. \ No newline at end of file From 446d39d39afb42ac6616b12cf1e0e12eabca0568 Mon Sep 17 00:00:00 2001 From: Mark Bishop Date: Fri, 7 Sep 2018 12:13:23 -0700 Subject: [PATCH 5/6] removed references to namespaces --- .../v2.x/en/admin-settings/rbac/cluster-project-roles/_index.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/rancher/v2.x/en/admin-settings/rbac/cluster-project-roles/_index.md b/content/rancher/v2.x/en/admin-settings/rbac/cluster-project-roles/_index.md index 3c2d2a6dbae..4a1458b9a16 100644 --- a/content/rancher/v2.x/en/admin-settings/rbac/cluster-project-roles/_index.md +++ b/content/rancher/v2.x/en/admin-settings/rbac/cluster-project-roles/_index.md @@ -142,4 +142,4 @@ When you revoke the cluster membership for a user that's explicitly assigned mem - Access the projects they hold membership in. - Exercise any [individual project roles](#project-role-reference) they are assigned. -This functionality is intended to prevent project and namespace owners from being locked out of their own projects and namespaces. If you want to completely revoke a user's access within a cluster, revoke both their cluster and project memberships. \ No newline at end of file +This functionality is intended to prevent project owners from being locked out of their own projects. If you want to completely revoke a user's access within a cluster, revoke both their cluster and project memberships. \ No newline at end of file From 9d75d7f59bc05b75a03bab1f22cde78774a58d6f Mon Sep 17 00:00:00 2001 From: Mark Bishop Date: Fri, 7 Sep 2018 12:18:14 -0700 Subject: [PATCH 6/6] removing sentence about intent --- .../v2.x/en/admin-settings/rbac/cluster-project-roles/_index.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/rancher/v2.x/en/admin-settings/rbac/cluster-project-roles/_index.md b/content/rancher/v2.x/en/admin-settings/rbac/cluster-project-roles/_index.md index 4a1458b9a16..e78abc06b00 100644 --- a/content/rancher/v2.x/en/admin-settings/rbac/cluster-project-roles/_index.md +++ b/content/rancher/v2.x/en/admin-settings/rbac/cluster-project-roles/_index.md @@ -142,4 +142,4 @@ When you revoke the cluster membership for a user that's explicitly assigned mem - Access the projects they hold membership in. - Exercise any [individual project roles](#project-role-reference) they are assigned. -This functionality is intended to prevent project owners from being locked out of their own projects. If you want to completely revoke a user's access within a cluster, revoke both their cluster and project memberships. \ No newline at end of file +If you want to completely revoke a user's access within a cluster, revoke both their cluster and project memberships. \ No newline at end of file