Hi Can i limit rancher users permissions limited to specific rancher-users #general

Title

little-art-55288

04/04/2023, 11:18 PM

Hi, Can i limit rancher users permissions limited to specific clusters using global roles?

quaint-oyster-88347

04/04/2023, 11:31 PM

Yes you place users with specific roles from global, cluster, project level permissions. Just go under "users & authentication" There you create and assign roles and permissions.

little-art-55288

04/04/2023, 11:34 PM

i am running cluster autoscaler with rancher provider. This autoscaler needs token to access rancher apis such as updating specific cluster to scale up/down. I want to limit this token to specific cluster alone. Note: scoped token does not work as per the following: https://github.com/rancher/rancher/issues/29943

cluster role will not help here as i must provide global privileges to the user to send api calls to rancher for scaling up and scaling down a cluster. But if i set global verbs e.g. list, update, etc, it will be applicable to all clusters ..

quaint-oyster-88347

04/04/2023, 11:40 PM

Hmm.... Perhaps you can create a local user and specify the role specific parameters. then create a new API token based on the local user.

little-art-55288

04/04/2023, 11:41 PM

I did that; since it is global role, it will be applicable to all clusters.

is there a way to limit global role permissions to specific clusters only?

quaint-oyster-88347

04/04/2023, 11:44 PM

But I believe you are to scope the api token during the creation process.

little-art-55288

04/04/2023, 11:44 PM

scoped api token does not work with rancher apis or rancher cli ...

so scoped api token does not work with autoscaler at all ..

quaint-oyster-88347

04/04/2023, 11:49 PM

what version of rancher are you running...

little-art-55288

04/04/2023, 11:49 PM

2.6.11

quaint-oyster-88347

04/04/2023, 11:49 PM

Interesting.... I'll look into it.

little-art-55288

04/04/2023, 11:50 PM

thanks

are you from rancher team or community member ?

quaint-oyster-88347

04/04/2023, 11:52 PM

Community member but I've be Admin / Engineer using Rancher since it infancy .. I'm an early adopter. I have terraform running on my work cluster I don't have it running in my home cluster..

little-art-55288

04/04/2023, 11:52 PM

great ... looking forward to hear from you if you find any solution 🙂

quaint-oyster-88347

04/05/2023, 12:00 AM

no problem

little-art-55288

04/07/2023, 5:05 PM

@quaint-oyster-88347 did you get a chance to look at it.

6 Views

#general Join Slack