cleaning up project creation task

This commit is contained in:
Mark Bishop
2018-06-18 14:11:17 -07:00
committed by Mark Bishop
parent 84e16ee1d7
commit e3ca198463
3 changed files with 42 additions and 5 deletions
@@ -2,9 +2,8 @@
title: Projects
weight: 2150
---
## What's a Project?
Project is a new concept introduced by Rancher. It is not a native Kubernetes construct. A project captures a set of policies for a set of namespaces. A user can be assigned a specific role in a project. A role can be owner, member, read-only, or custom. Policies include Kubernetes Role-Based Access Control (RBAC) policies and pod security policies. Rancher 2.0 also implements a canned network policy that isolates containers in different projects. Future versions of Rancher will implement more flexible network policies.
_Projects_ are a new concept introduced by Rancher. They are not a native Kubernetes construct. A project captures a set of policies for a set of namespaces. A user can be assigned a specific role in a project. A role can be owner, member, read-only, or [custom]({{< baseurl >}}/rancher/v2.x/en/tasks/global-configuration/roles/#adding-a-custom-role). Policies include Kubernetes Role-Based Access Control (RBAC) policies and pod security policies. Rancher 2.0 also implements a canned network policy that isolates containers in different projects. Future versions of Rancher will implement more flexible network policies.
### Authorization
@@ -15,8 +14,10 @@ Non-administrative users are only authorized for project access after an adminis
### Pod Security Policies
Rancher extends Kubernetes to allow the application of [Pod Security Policies](https://kubernetes.io/docs/concepts/policy/pod-security-policy/) at the project level in additiona to the cluster level. However, as a best practice, we recommend applying Pod Security Policies at the cluster level.
Rancher extends Kubernetes to allow the application of [Pod Security Policies](https://kubernetes.io/docs/concepts/policy/pod-security-policy/) at the project level in addition to the cluster level. However, as a best practice, we recommend applying Pod Security Policies at the cluster level.
## Namespaces
Kubernetes resources belong to specific namespaces. Rancher 2.0 relies on namespaces to isolate resources among users and apps. When the user deploys an app from the catalog, for example, he can choose to deploy that app into its own namespace, so that resource names in one app will not conflict with resource names in another. Namespaces must be globally unique. It is often difficult for users to pick unique namespace names. Rancher therefore encourages the pattern where users work with projects, and the system generates unique namespace names automatically.
For more information, see the [Kubernetes Namespaces Documentation](https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces/).
@@ -3,4 +3,4 @@ title: Projects
weight: 3650
draft: true
---
Coming Soon
_Projects_ are a new feature in Rancher that allows you to group namespaces. Users can be added as members to the project, and the project owner can assign roles to each member to control their project access.
@@ -3,4 +3,40 @@ title: Creating Projects
weight:
draft: true
---
Coming Soon
1. From the **Global** view, open the cluster from which you want to create a project.
1. From the main menu, choose **Projects/Namespaces**. Then click **Add Project**.
1. Enter a **Project Name**.
1. **Optional:** Select a **Pod Security Policy**.
[What are Pod Security Policies?]({{< baseurl >}}/rancher/v2.x/en/concepts/global-configuration/pod-security-policies)
>**Note:** This option is only available if you've already created a Pod Security Policy. For instruction, see [Creating Pod Security Policies]({{< baseurl >}}/rancher/v2.x/en/tasks/global-configuration/pod-security-policies/#creating-pod-security-policies).
1. **Recommended:** Add project members.
Use the **Members** accordion to provide other users with project access and roles.
By default, your user is added as the project `Owner`.
1. Click **Add Member**.
1. From the **Name** combo box, search for a user or group that you want to assign project access.
>**Note:** You can only search for groups if external authentication is enabled.
1. From the **Role** drop-down, choose a role.
[What are Roles?]({{< baseurl >}}/rancher/v2.x/en/concepts/global-configuration/users-permissions-roles/#cluster-and-project-roles)
>**Tip:** Choose Custom to create a custom role on the fly: [Custom Project Roles]({{< baseurl >}}/rancher/v2.x/en/concepts/global-configuration/users-permissions-roles/#custom-project-roles).
1. To add more members, repeat substeps a—c.
1. Click **Create**.
**Result:** Your project is created. You can view it from the cluster's **Projects/Namespaces** view.