public/rancher-docs
1
0
Fork 0
mirror of https://github.com/rancher/rancher-docs.git synced 2026-09-25 04:28:15 +00:00
Code Issues Packages Projects Releases Wiki Activity

Update restricted admin

Browse Source
This commit is contained in:
Billy Tat
2021-06-30 09:01:40 -07:00
parent 7fc2afd970
commit b2629dd8af
2 changed files with 54 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files
content/rancher/v2.5/en/admin-settings/rbac/global-permissions/_index.md
+2 -2
View File
@@ -46,7 +46,7 @@ CATTLE_RESTRICTED_DEFAULT_ADMIN=true
The permissions for the `restricted-admin` role differ based on the Rancher version.
{{% tabs %}}
{{% tab "v2.5.6" %}}
{{% tab "v2.5.7+" %}}
The `restricted-admin` permissions are as follows:
@@ -55,7 +55,7 @@ The `restricted-admin` permissions are as follows:
- Can create other restricted admins.
{{% /tab %}}
{{% tab "v2.5.0-v2.5.5" %}}
{{% tab "v2.5.0-v2.5.6" %}}
The `restricted-admin` permissions are as follows:
content/rancher/v2.6/en/admin-settings/rbac/global-permissions/_index.md
+52 -5
View File
@@ -5,10 +5,12 @@ weight: 1126
_Permissions_ are individual access rights that you can assign when selecting a custom permission for a user.
Global Permissions define user authorization outside the scope of any particular cluster. Out-of-the-box, there are three default global permissions: `Administrator`, `Standard User` and `User-base`.
Global Permissions define user authorization outside the scope of any particular cluster. Out-of-the-box, there are four default global permissions: `Administrator`, `Restricted Admin`,`Standard User` and `User-base`.
- **Administrator:** These users have full control over the entire Rancher system and all clusters within it.
- **Restricted Admin:** These users have full control over downstream clusters, but cannot alter the local Kubernetes cluster.
- <a id="user"></a>**Standard User:** These users can create new clusters and use them. Standard users can also assign other users permissions to their clusters.
- **User-Base:** User-Base users have login-access only.
@@ -43,11 +45,56 @@ CATTLE_RESTRICTED_DEFAULT_ADMIN=true
```
### List of `restricted-admin` Permissions
The `restricted-admin` permissions are as follows:
The following table lists the permissions and actions that a `restricted-admin` should have in comparison with the `Administrator` and `Standard User` roles:
| Category | Action | Global Admin | Standard User | Restricted Admin | Notes for Restricted Admin role |
| -------- | ------ | ------------ | ------------- | ---------------- | ------------------------------- |
| Local Cluster functions | Manage Local Cluster (List, Edit, Import Host) | Yes | No | No | |
| | Create Projects/namespaces | Yes | No | No | |
| | Add cluster/project members | Yes | No | No | |
| | Deploy MulticlusterApp in local cluster | Yes | No | No | |
| | Global DNS | Yes | No | No | |
| | Access to management cluster for CRDs and CRs | Yes | No | Yes | |
| | Save as RKE Template | Yes | No | No | |
| Security | | | | | |
| Enable auth | Configure Authentication | Yes | No | Yes | |
| Roles | Create/Assign GlobalRoles | Yes | No (Can list) | Yes | Auth webhook allows creating globalrole for perms already present |
| | Create/Assign ClusterRoles | Yes | No (Can list) | Yes | Not in local cluster |
| | Create/Assign ProjectRoles | Yes | No (Can list) | Yes | Not in local cluster |
| Users | Add User/Edit/Delete/Deactivate User | Yes | No | Yes | |
| Groups | Assign Global role to groups | Yes | No | Yes | As allowed by the webhook |
| | Refresh Groups | Yes | No | Yes | |
| PSP's | Manage PSP templates | Yes | No (Can list) | No | |
| Tools | | | | | |
| | Manage RKE Templates | Yes | No | Yes | |
| | Manage Global Catalogs | Yes | No | Yes | Cannot edit/delete built-in system catalog. Cn manage Helm library |
| | Cluster Drivers | Yes | No | Yes | |
| | Node Drivers | Yes | No | Yes | |
| | GlobalDNS Providers | Yes | Yes (Self) | Yes | |
| | GlobalDNS Entries | Yes | Yes (Self) | Yes | |
| Settings | | | | | |
| | Manage Settings | Yes | No (Can list) | No (Can list) | |
| Apps | | | | | |
| | Launch Multicluster Apps | Yes | Yes | Yes | Not in local cluster |
| User | | | | | |
| | Manage API Keys | Yes (Manage all) | Yes (Manage self) | Yes (Manage self) | |
| | Manage Node Templates | Yes | Yes (Manage self) | Yes | |
| | Manage Cloud Credentials | Yes | Yes (Manage self) | Yes | |
| Downstream Cluster | Create Cluster | Yes | Yes | Yes | |
| | Edit Cluster | Yes | Yes | Yes | |
| | Rotate Certificates | Yes | | Yes | |
| | Snapshot Now | Yes | | Yes | |
| | Restore Snapshot | Yes | | Yes | |
| | Save as RKE Template | Yes | No | Yes | |
| | Run CIS Scan | Yes | Yes | Yes | |
| | Add Members | Yes | Yes | Yes | |
| | Create Projects | Yes | Yes | Yes | |
| Feature Charts since v2.5 | | | | | |
| | Install Fleet | Yes | | Yes | Should not be able to run Fleet in local cluster |
| | Deploy EKS cluster | Yes | Yes | Yes | |
| | Deploy GKE cluster | Yes | Yes | Yes | |
| | Deploy AKS cluster | Yes | Yes | Yes | |
- Has full admin access to all downstream clusters managed by Rancher.
- Can add other users and assign them to clusters outside of the local cluster.
- Can create other restricted admins.
### Changing Global Administrators to Restricted Admins