rancher-docs/assets/js/c2bb6795.b7ecab87.js

"use strict";(self.webpackChunkrancher_docs=self.webpackChunkrancher_docs||[]).push([[16860],{3905:(e,t,n)=>{n.d(t,{Zo:()=>c,kt:()=>m});var r=n(67294);function a(e,t,n){return t in e?Object.defineProperty(e,t,{value:n,enumerable:!0,configurable:!0,writable:!0}):e[t]=n,e}function o(e,t){var n=Object.keys(e);if(Object.getOwnPropertySymbols){var r=Object.getOwnPropertySymbols(e);t&&(r=r.filter((function(t){return Object.getOwnPropertyDescriptor(e,t).enumerable}))),n.push.apply(n,r)}return n}function i(e){for(var t=1;t<arguments.length;t++){var n=null!=arguments[t]?arguments[t]:{};t%2?o(Object(n),!0).forEach((function(t){a(e,t,n[t])})):Object.getOwnPropertyDescriptors?Object.defineProperties(e,Object.getOwnPropertyDescriptors(n)):o(Object(n)).forEach((function(t){Object.defineProperty(e,t,Object.getOwnPropertyDescriptor(n,t))}))}return e}function l(e,t){if(null==e)return{};var n,r,a=function(e,t){if(null==e)return{};var n,r,a={},o=Object.keys(e);for(r=0;r<o.length;r++)n=o[r],t.indexOf(n)>=0||(a[n]=e[n]);return a}(e,t);if(Object.getOwnPropertySymbols){var o=Object.getOwnPropertySymbols(e);for(r=0;r<o.length;r++)n=o[r],t.indexOf(n)>=0||Object.prototype.propertyIsEnumerable.call(e,n)&&(a[n]=e[n])}return a}var s=r.createContext({}),g=function(e){var t=r.useContext(s),n=t;return e&&(n="function"==typeof e?e(t):i(i({},t),e)),n},c=function(e){var t=g(e.components);return r.createElement(s.Provider,{value:t},e.children)},p={inlineCode:"code",wrapper:function(e){var t=e.children;return r.createElement(r.Fragment,{},t)}},d=r.forwardRef((function(e,t){var n=e.components,a=e.mdxType,o=e.originalType,s=e.parentName,c=l(e,["components","mdxType","originalType","parentName"]),d=g(n),m=a,u=d["".concat(s,".").concat(m)]||d[m]||p[m]||o;return n?r.createElement(u,i(i({ref:t},c),{},{components:n})):r.createElement(u,i({ref:t},c))}));function m(e,t){var n=arguments,a=t&&t.mdxType;if("string"==typeof e||a){var o=n.length,i=new Array(o);i[0]=d;var l={};for(var s in t)hasOwnProperty.call(t,s)&&(l[s]=t[s]);l.originalType=e,l.mdxType="string"==typeof e?e:a,i[1]=l;for(var g=2;g<o;g++)i[g]=n[g];return r.createElement.apply(null,i)}return r.createElement.apply(null,n)}d.displayName="MDXCreateElement"},368:(e,t,n)=>{n.r(t),n.d(t,{assets:()=>s,contentTitle:()=>i,default:()=>p,frontMatter:()=>o,metadata:()=>l,toc:()=>g});var r=n(87462),a=(n(67294),n(3905));const o={title:"Role-based Access Control for Logging"},i=void 0,l={unversionedId:"integrations-in-rancher/logging/rbac-for-logging",id:"version-2.6/integrations-in-rancher/logging/rbac-for-logging",title:"Role-based Access Control for Logging",description:"Rancher logging has two roles, logging-admin and logging-view.",source:"@site/versioned_docs/version-2.6/integrations-in-rancher/logging/rbac-for-logging.md",sourceDirName:"integrations-in-rancher/logging",slug:"/integrations-in-rancher/logging/rbac-for-logging",permalink:"/v2.6/integrations-in-rancher/logging/rbac-for-logging",draft:!1,editUrl:"https://github.com/rancher/rancher-docs/edit/main/versioned_docs/version-2.6/integrations-in-rancher/logging/rbac-for-logging.md",tags:[],version:"2.6",lastUpdatedAt:1668452187,formattedLastUpdatedAt:"Nov 14, 2022",frontMatter:{title:"Role-based Access Control for Logging"},sidebar:"tutorialSidebar",previous:{title:"Migrating to Rancher v2.5 Logging",permalink:"/v2.6/integrations-in-rancher/logging/migrate-to-rancher-v2.5+-logging"},next:{title:"rancher-logging Helm Chart Options",permalink:"/v2.6/integrations-in-rancher/logging/logging-helm-chart-options"}},s={},g=[],c={toc:g};function p(e){let{components:t,...n}=e;return(0,a.kt)("wrapper",(0,r.Z)({},c,n,{components:t,mdxType:"MDXLayout"}),(0,a.kt)("p",null,"Rancher logging has two roles, ",(0,a.kt)("inlineCode",{parentName:"p"},"logging-admin")," and ",(0,a.kt)("inlineCode",{parentName:"p"},"logging-view"),"."),(0,a.kt)("ul",null,(0,a.kt)("li",{parentName:"ul"},(0,a.kt)("inlineCode",{parentName:"li"},"logging-admin")," gives users full access to namespaced ",(0,a.kt)("inlineCode",{parentName:"li"},"Flows")," and ",(0,a.kt)("inlineCode",{parentName:"li"},"Outputs")),(0,a.kt)("li",{parentName:"ul"},(0,a.kt)("inlineCode",{parentName:"li"},"logging-view")," allows users to ",(0,a.kt)("em",{parentName:"li"},"view")," namespaced ",(0,a.kt)("inlineCode",{parentName:"li"},"Flows")," and ",(0,a.kt)("inlineCode",{parentName:"li"},"Outputs"),", and ",(0,a.kt)("inlineCode",{parentName:"li"},"ClusterFlows")," and ",(0,a.kt)("inlineCode",{parentName:"li"},"ClusterOutputs"))),(0,a.kt)("admonition",{title:"Why choose one role over the other?",type:"note"},(0,a.kt)("p",{parentName:"admonition"},"Edit access to ",(0,a.kt)("inlineCode",{parentName:"p"},"ClusterFlow")," and ",(0,a.kt)("inlineCode",{parentName:"p"},"ClusterOutput")," resources is powerful. Any user with it has edit access for all logs in the cluster.")),(0,a.kt)("p",null,"In Rancher, the cluster administrator role is the only role with full access to all ",(0,a.kt)("inlineCode",{parentName:"p"},"rancher-logging")," resources. Cluster members are not able to edit or read any logging resources. Project owners and members have the following privileges:"),(0,a.kt)("table",null,(0,a.kt)("thead",{parentName:"table"},(0,a.kt)("tr",{parentName:"thead"},(0,a.kt)("th",{parentName:"tr",align:null},"Project Owners"),(0,a.kt)("th",{parentName:"tr",align:null},"Project Members"))),(0,a.kt)("tbody",{parentName:"table"},(0,a.kt)("tr",{parentName:"tbody"},(0,a.kt)("td",{parentName:"tr",align:null},"able to create namespaced ",(0,a.kt)("inlineCode",{parentName:"td"},"Flows")," and ",(0,a.kt)("inlineCode",{parentName:"td"},"Outputs")," in their projects' namespaces"),(0,a.kt)("td",{parentName:"tr",align:null},"only able to view the ",(0,a.kt)("inlineCode",{parentName:"td"},"Flows")," and ",(0,a.kt)("inlineCode",{parentName:"td"},"Outputs")," in projects' namespaces")),(0,a.kt)("tr",{parentName:"tbody"},(0,a.kt)("td",{parentName:"tr",align:null},"can collect logs from anything in their projects' namespaces"),(0,a.kt)("td",{parentName:"tr",align:null},"cannot collect any logs in their projects' namespaces")))),(0,a.kt)("p",null,"Both project owners and project members require at least ",(0,a.kt)("em",{parentName:"p"},"one")," namespace in their project to use logging. If they do not, then they may not see the logging button in the top nav dropdown."))}p.isMDXComponent=!0}}]);