From fa9bc4b4972861fbbadf59e54838cadae9625bc7 Mon Sep 17 00:00:00 2001 From: Mark Bishop <37810556+MBishop17@users.noreply.github.com> Date: Mon, 4 Jun 2018 12:34:18 -0700 Subject: [PATCH] Update _index.md --- .vscode/settings.json | 2 + .../concepts/global-configuration/_index.md | 52 ++++++++++++++----- .../single-node-install/_index.md | 15 ++---- 3 files changed, 45 insertions(+), 24 deletions(-) create mode 100644 .vscode/settings.json diff --git a/.vscode/settings.json b/.vscode/settings.json new file mode 100644 index 00000000000..7a73a41bfdf --- /dev/null +++ b/.vscode/settings.json @@ -0,0 +1,2 @@ +{ +} \ No newline at end of file diff --git a/content/rancher/v2.x/en/concepts/global-configuration/_index.md b/content/rancher/v2.x/en/concepts/global-configuration/_index.md index 1c599aee4d2..eedd47f8fdb 100644 --- a/content/rancher/v2.x/en/concepts/global-configuration/_index.md +++ b/content/rancher/v2.x/en/concepts/global-configuration/_index.md @@ -24,9 +24,9 @@ In most cases, you should use an external authentication service over local, as Within Rancher, each user authenticates as a _user_, which is an object that grants you access within the Rancher system. As mentioned in the previous sections, users can either be local or external. -Once the user logs in to Rancher, their _authorization_, or their access rights within the system, are determined by _roles_. Roles are sets of permissions that the user can perform in Rancher +Once the user logs in to Rancher, their _authorization_, or their access rights within the system, are determined by _permissions_. Permissions are sets of access rights that you can perform in Rancher. -There are two types of roles in Rancher: default roles and custom roles. +There are two types of roles in Rancher: default permissions and custom permissions. -### Default Roles +### Global Permissions -Out-of-the-box, Rancher comes with two default roles: +_Global Permissions_ define what actions a user can complete outside the scope of any particular cluster. There are two primary global permissions: `Administrator` and `Standard User`. - **Administrator:** @@ -44,17 +44,19 @@ Out-of-the-box, Rancher comes with two default roles: - **Standard User:** - These users can create new clusters or manage clusters and projects that an administrator has given them access to. + These users can create new clusters and use them. Standard users can also assign other users permissions to their clusters. - +- **External Authentication** -### Custom Roles + When a user logs in using an external authentication provider for the first time, they are automatically assigned the `Standard User` global permission. -Rancher lets you create _custom roles_ that let you assign individual permissions to a user. These roles are convenient for defining narrow or specialized permissions to a user within Rancher. +- **Local Authentication** + + When you create a new local user, you assign them one or more global permission(s) as you create complete the **Add User** form. - +### Custom Permissions + +Rancher lets you create _custom permissions_, which are sets of permissions where you can assign individual roles to users. _Roles_ are individual access rights that you can assign to a set of custom permissions. These permissions are convenient for defining narrow or specialized access to a user within Rancher. See the table below for a list of custom roles permission available. + +#### Permissions Reference + +The following table lists each role available in Rancher and whether it's assigned to Rancher's two global permissions, `Administrator` and `Standard User`. + +| Role | Administrator | Standard User | +| ---------------------------------- | ------------- | ------------- | +| Manage Authentication | ✓ | | +| Manage Catalogs | ✓ | | +| Manage Node Drivers | ✓ | | +| Manage PodSecurityPolicy Templates | ✓ | | +| Manage Roles | ✓ | | +| Manage Users | ✓ | | +| Create Clusters | ✓ | ✓ | +| User Catalog Templates | ✓ | ✓ | +| Login Access | ✓ | ✓ | + +### Role Aggregation + +Each Rancher permission listed above is comprised of multiple, smaller roles not available in the Rancher UI. For a full list of roles, access through the API at `/v3/globalroles`. + ### Membership The projects and clusters accessible to a standard or custom users is determined by _membership_. Membership is a list of users who have access to a specific project or cluster. Each project and cluster includes a tab that Rancher administrators can use to assign membership. @@ -94,7 +120,7 @@ Read more about Pod Security Policies in the [Kubernetes Documentation](https:// ## Node Drivers -- Out-of-the-box, Rancher provides support for creating clusters using many popular cloud providers: Amazon EC2, Azure, DigitalOcean, and so on. However, you may want to create a cluster using another cloud provider. In these scenarios, you can create a custom node driver for the cloud provider and point Rancher toward it. +Out-of-the-box, Rancher provides support for creating clusters using many popular cloud providers: Amazon EC2, Azure, DigitalOcean, and so on. However, you may want to create a cluster using another cloud provider. In these scenarios, you can create a custom node driver for the cloud provider and point Rancher toward it. For more information on creating node drivers, see [https://github.com/rancher/ui-driver-skel](https://github.com/rancher/ui-driver-skel). diff --git a/content/rancher/v2.x/en/installation/single-node-install/_index.md b/content/rancher/v2.x/en/installation/single-node-install/_index.md index c7975444fed..1e7f2d9e7a6 100644 --- a/content/rancher/v2.x/en/installation/single-node-install/_index.md +++ b/content/rancher/v2.x/en/installation/single-node-install/_index.md @@ -54,17 +54,10 @@ For security purposes, SSL (Secure Sockets Layer) is required when using Rancher Choose from the following options: -- [Installation Outline](#installation-outline) -- [1. Provision Linux Host](#1-provision-linux-host) - - [Requirements](#requirements) -- [2. Choose an SSL Option and Install Rancher](#2-choose-an-ssl-option-and-install-rancher) - - [Option A—Default Self-Signed Certificate](#option-adefault-self-signed-certificate) - - [Option B—Bring Your Own Certificate: Self-Signed](#option-bbring-your-own-certificate--self-signed) - - [Option C—Bring Your Own Certificate: Signed by Recognized CA](#option-cbring-your-own-certificate--signed-by-recognized-ca) - - [Option D-Let's Encrypt Certificate](#option-d-lets-encrypt-certificate) -- [What's Next?](#whats-next) -- [FAQ and Troubleshooting](#faq-and-troubleshooting) -- [Persistent Data](#persistent-data) +- [Option A—Default Self-Signed Certificate](#option-adefault-self-signed-certificate) +- [Option B—Bring Your Own Certificate: Self-Signed](#option-bbring-your-own-certificate--self-signed) +- [Option C—Bring Your Own Certificate: Signed by Recognized CA](#option-cbring-your-own-certificate--signed-by-recognized-ca) +- [Option D-Let's Encrypt Certificate](#option-d-lets-encrypt-certificate) ### Option A—Default Self-Signed Certificate