public/rancher-docs
1
0
Fork 0
mirror of https://github.com/rancher/rancher-docs.git synced 2026-09-25 04:28:15 +00:00
Code Issues Packages Projects Releases Wiki Activity

[2.9.0] Feature Flag - external-rules (#1361)

Browse Source 
* Adding external-rules v2.9 section

Signed-off-by: Sunil Singh <sunil.singh@suse.com>

* Revising the Feature Flag page after review and adding a behavior change section regarding external  objects to the Cluster and Project Roles user guide page.

Signed-off-by: Sunil Singh <sunil.singh@suse.com>

* Applying suggestion after review.

Signed-off-by: Sunil Singh <sunil.singh@suse.com>

* Moving the external-rules into below table to denote removed status and note information about default behavior.

Signed-off-by: Sunil Singh <sunil.singh@suse.com>

* Correct merge conflict

Co-authored-by: Billy Tat <btat@suse.com>

---------

Signed-off-by: Sunil Singh <sunil.singh@suse.com>
Co-authored-by: Lucas Saintarbor <lucas.saintarbor@suse.com>
Co-authored-by: Billy Tat <btat@suse.com>
This commit is contained in:
Sunil Singh
2024-07-31 17:34:54 -07:00
committed by GitHub
co-authored by Billy Tat Lucas Saintarbor
parent 949fb6059a
commit ebad7b44d1
4 changed files with 37 additions and 23 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/getting-started/installation-and-upgrade/installation-references/feature-flags.md
+13 -12
View File
@@ -19,7 +19,6 @@ Some feature flags require a restart of the Rancher container. Features that req
The following is a list of feature flags available in Rancher. If you've upgraded from a previous Rancher version, you may see additional flags in the Rancher UI, such as `proxy` or `dashboard` (both [discontinued](/versioned_docs/version-2.5/reference-guides/installation-references/feature-flags.md)):
- `continuous-delivery`: Allows Fleet GitOps to be disabled separately from Fleet. See [Continuous Delivery.](../../../how-to-guides/advanced-user-guides/enable-experimental-features/continuous-delivery.md) for more information.
- `external-rules`: This flag is enabled by default. Only admin users can enable/disable the flag, and note that `escalate` permissions on `RoleTemplates` are required to create external `RoleTemplates` with `ExternalRules`. Restricted admin users can only enable the flag. If enabled, external `RoleTemplates` can be created only if the backing `ClusterRole` exists in the local cluster or the `ExternalRules` is set. For context, the backing `ClusterRole` holds cluster rules and privileges, and shares the same `metadata.name` used in the `RoleTemplate` in your respective cluster referenced by the `ClusterRoleTemplateBinding/ProjectRoleTemplateBinding`. Previous external `RoleTemplates` that don’t have a backing `ClusterRole` won’t be granted or modifiable unless a backing `ClusterRole` is created or the `ExternalRules` field is set. If disabled, external `RoleTemplates` with `.context=project` or `.context=””` can be created even if the backing `ClusterRole` does not exist.
- `fleet`: The Rancher provisioning framework in v2.6 and later requires Fleet. The flag will be automatically enabled when you upgrade, even if you disabled this flag in an earlier version of Rancher. See [Continuous Delivery with Fleet](../../../integrations-in-rancher/fleet/fleet.md) for more information.
- `harvester`: Manages access to the Virtualization Management page, where users can navigate directly to Harvester clusters and access the Harvester UI. See [Harvester Integration Overview](../../../integrations-in-rancher/harvester/overview.md) for more information.
- `istio-virtual-service-ui`: Enables a [visual interface](../../../how-to-guides/advanced-user-guides/enable-experimental-features/istio-traffic-management-features.md) to create, read, update, and delete Istio virtual services and destination rules, which are Istio traffic management features.
@@ -34,14 +33,16 @@ The following is a list of feature flags available in Rancher. If you've upgrade
The following table shows the availability and default values for some feature flags in Rancher. Features marked "GA" are generally available:
| Feature Flag Name | Default Value | Status | Available As Of |
| ----------------------------- | ------------- | ------------ | --------------- |
| `continuous-delivery` | `true` | GA | v2.6.0 |
| `fleet` | `true` | Can no longer be disabled | v2.6.0 |
| `fleet` | `true` | GA | v2.5.0 |
| `harvester` | `true` | Experimental | v2.6.1 |
| `legacy` | `false` for new installs, `true` for upgrades | GA | v2.6.0 |
| `rke1-custom-node-cleanup`| `true` | GA | v2.6.0 |
| `rke2` | `true` | Experimental | v2.6.0 |
| `token-hashing` | `false` for new installs, `true` for upgrades | GA | v2.6.0 |
| `ui-sql-cache` | `false` | Highly experimental | v2.9.0 |
| Feature Flag Name | Default Value | Status | Available As Of | Additional Information |
| ----------------------------- | ------------- | ------------ | --------------- | ---------------------- |
| `continuous-delivery` | `true` | GA | v2.6.0 | |
| `external-rules` | v2.7.14: `false`, v2.8.5: `true` | Removed | v2.7.14, v2.8.5 | This flag affected [external `RoleTemplate` behavior](../../../how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/manage-role-based-access-control-rbac/cluster-and-project-roles.md#external-roletemplate-behavior). It is removed in Rancher v2.9.0 and later as the behavior is enabled by default. |
| `fleet` | `true` | Can no longer be disabled | v2.6.0 | |
| `fleet` | `true` | GA | v2.5.0 | |
| `harvester` | `true` | Experimental | v2.6.1 | |
| `legacy` | `false` for new installs, `true` for upgrades | GA | v2.6.0 | |
| `rke1-custom-node-cleanup`| `true` | GA | v2.6.0 | |
| `rke2` | `true` | Experimental | v2.6.0 | |
| `token-hashing` | `false` for new installs, `true` for upgrades | GA | v2.6.0 | |
| `ui-sql-cache` | `false` | Highly experimental | v2.9.0 |
docs/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/manage-role-based-access-control-rbac/cluster-and-project-roles.md
+6
View File
@@ -238,3 +238,9 @@ When you revoke the cluster membership for a standard user that's explicitly ass
- Exercise any [individual project roles](#project-role-reference) they are assigned.
If you want to completely revoke a user's access within a cluster, revoke both their cluster and project memberships.
### External `RoleTemplate` Behavior
In Rancher v2.9.0 and later, external `RoleTemplate` objects can only be created if the backing `ClusterRole` exists in the local cluster or the `ExternalRules` is set in your configuration.
For context, the backing `ClusterRole` holds cluster rules and privileges, and shares the same `metadata.name` used in the `RoleTemplate` in your respective cluster referenced by the `ClusterRoleTemplateBinding/ProjectRoleTemplateBinding`. Additionally, note that `escalate` permissions on `RoleTemplates` are required to create external `RoleTemplates` with `ExternalRules`.
versioned_docs/version-2.9/getting-started/installation-and-upgrade/installation-references/feature-flags.md
+12 -11
View File
@@ -33,14 +33,15 @@ The following is a list of feature flags available in Rancher. If you've upgrade
The following table shows the availability and default values for some feature flags in Rancher. Features marked "GA" are generally available:
| Feature Flag Name | Default Value | Status | Available As Of |
| ----------------------------- | ------------- | ------------ | --------------- |
| `continuous-delivery` | `true` | GA | v2.6.0 |
| `fleet` | `true` | Can no longer be disabled | v2.6.0 |
| `fleet` | `true` | GA | v2.5.0 |
| `harvester` | `true` | Experimental | v2.6.1 |
| `legacy` | `false` for new installs, `true` for upgrades | GA | v2.6.0 |
| `rke1-custom-node-cleanup`| `true` | GA | v2.6.0 |
| `rke2` | `true` | Experimental | v2.6.0 |
| `token-hashing` | `false` for new installs, `true` for upgrades | GA | v2.6.0 |
| `ui-sql-cache` | `false` | Highly experimental | v2.9.0 |
| Feature Flag Name | Default Value | Status | Available As Of | Additional Information |
| ----------------------------- | ------------- | ------------ | --------------- | ---------------------- |
| `continuous-delivery` | `true` | GA | v2.6.0 | |
| `external-rules` | v2.7.14: `false`, v2.8.5: `true` | Removed | v2.7.14, v2.8.5 | This flag affected [external `RoleTemplate` behavior](../../../how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/manage-role-based-access-control-rbac/cluster-and-project-roles.md#external-roletemplate-behavior). It is removed in Rancher v2.9.0 and later as the behavior is enabled by default. |
| `fleet` | `true` | Can no longer be disabled | v2.6.0 | |
| `fleet` | `true` | GA | v2.5.0 | |
| `harvester` | `true` | Experimental | v2.6.1 | |
| `legacy` | `false` for new installs, `true` for upgrades | GA | v2.6.0 | |
| `rke1-custom-node-cleanup`| `true` | GA | v2.6.0 | |
| `rke2` | `true` | Experimental | v2.6.0 | |
| `token-hashing` | `false` for new installs, `true` for upgrades | GA | v2.6.0 | |
| `ui-sql-cache` | `false` | Highly experimental | v2.9.0 |
versioned_docs/version-2.9/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/manage-role-based-access-control-rbac/cluster-and-project-roles.md
+6
View File
@@ -238,3 +238,9 @@ When you revoke the cluster membership for a standard user that's explicitly ass
- Exercise any [individual project roles](#project-role-reference) they are assigned.
If you want to completely revoke a user's access within a cluster, revoke both their cluster and project memberships.
### External `RoleTemplate` Behavior
In Rancher v2.9.0 and later, external `RoleTemplate` objects can only be created if the backing `ClusterRole` exists in the local cluster or the `ExternalRules` is set in your configuration.
For context, the backing `ClusterRole` holds cluster rules and privileges, and shares the same `metadata.name` used in the `RoleTemplate` in your respective cluster referenced by the `ClusterRoleTemplateBinding/ProjectRoleTemplateBinding`. Additionally, note that `escalate` permissions on `RoleTemplates` are required to create external `RoleTemplates` with `ExternalRules`.