public/rancher-docs
1
0
Fork 0
mirror of https://github.com/rancher/rancher-docs.git synced 2026-09-26 04:58:07 +00:00
Code Issues Packages Projects Releases Wiki Activity

[2.9.0] Feature Flag - external-rules (#1361)

Browse Source 
* Adding external-rules v2.9 section

Signed-off-by: Sunil Singh <sunil.singh@suse.com>

* Revising the Feature Flag page after review and adding a behavior change section regarding external  objects to the Cluster and Project Roles user guide page.

Signed-off-by: Sunil Singh <sunil.singh@suse.com>

* Applying suggestion after review.

Signed-off-by: Sunil Singh <sunil.singh@suse.com>

* Moving the external-rules into below table to denote removed status and note information about default behavior.

Signed-off-by: Sunil Singh <sunil.singh@suse.com>

* Correct merge conflict

Co-authored-by: Billy Tat <btat@suse.com>

---------

Signed-off-by: Sunil Singh <sunil.singh@suse.com>
Co-authored-by: Lucas Saintarbor <lucas.saintarbor@suse.com>
Co-authored-by: Billy Tat <btat@suse.com>
This commit is contained in:
Sunil Singh
2024-07-31 17:34:54 -07:00
committed by GitHub
co-authored by Billy Tat Lucas Saintarbor
parent 949fb6059a
commit ebad7b44d1
4 changed files with 37 additions and 23 deletions
Download Patch File Download Diff File Expand all files Collapse all files
versioned_docs/version-2.9/getting-started/installation-and-upgrade/installation-references/feature-flags.md
+12 -11
View File
@@ -33,14 +33,15 @@ The following is a list of feature flags available in Rancher. If you've upgrade
The following table shows the availability and default values for some feature flags in Rancher. Features marked "GA" are generally available:
| Feature Flag Name | Default Value | Status | Available As Of |
| ----------------------------- | ------------- | ------------ | --------------- |
| `continuous-delivery` | `true` | GA | v2.6.0 |
| `fleet` | `true` | Can no longer be disabled | v2.6.0 |
| `fleet` | `true` | GA | v2.5.0 |
| `harvester` | `true` | Experimental | v2.6.1 |
| `legacy` | `false` for new installs, `true` for upgrades | GA | v2.6.0 |
| `rke1-custom-node-cleanup`| `true` | GA | v2.6.0 |
| `rke2` | `true` | Experimental | v2.6.0 |
| `token-hashing` | `false` for new installs, `true` for upgrades | GA | v2.6.0 |
| `ui-sql-cache` | `false` | Highly experimental | v2.9.0 |
| Feature Flag Name | Default Value | Status | Available As Of | Additional Information |
| ----------------------------- | ------------- | ------------ | --------------- | ---------------------- |
| `continuous-delivery` | `true` | GA | v2.6.0 | |
| `external-rules` | v2.7.14: `false`, v2.8.5: `true` | Removed | v2.7.14, v2.8.5 | This flag affected [external `RoleTemplate` behavior](../../../how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/manage-role-based-access-control-rbac/cluster-and-project-roles.md#external-roletemplate-behavior). It is removed in Rancher v2.9.0 and later as the behavior is enabled by default. |
| `fleet` | `true` | Can no longer be disabled | v2.6.0 | |
| `fleet` | `true` | GA | v2.5.0 | |
| `harvester` | `true` | Experimental | v2.6.1 | |
| `legacy` | `false` for new installs, `true` for upgrades | GA | v2.6.0 | |
| `rke1-custom-node-cleanup`| `true` | GA | v2.6.0 | |
| `rke2` | `true` | Experimental | v2.6.0 | |
| `token-hashing` | `false` for new installs, `true` for upgrades | GA | v2.6.0 | |
| `ui-sql-cache` | `false` | Highly experimental | v2.9.0 |
versioned_docs/version-2.9/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/manage-role-based-access-control-rbac/cluster-and-project-roles.md
+6
View File
@@ -238,3 +238,9 @@ When you revoke the cluster membership for a standard user that's explicitly ass
- Exercise any [individual project roles](#project-role-reference) they are assigned.
If you want to completely revoke a user's access within a cluster, revoke both their cluster and project memberships.
### External `RoleTemplate` Behavior
In Rancher v2.9.0 and later, external `RoleTemplate` objects can only be created if the backing `ClusterRole` exists in the local cluster or the `ExternalRules` is set in your configuration.
For context, the backing `ClusterRole` holds cluster rules and privileges, and shares the same `metadata.name` used in the `RoleTemplate` in your respective cluster referenced by the `ClusterRoleTemplateBinding/ProjectRoleTemplateBinding`. Additionally, note that `escalate` permissions on `RoleTemplates` are required to create external `RoleTemplates` with `ExternalRules`.