Define aclpolicy that confines node execution
Reported by Alex-SF | 2010-12-17 08:54:29 UTC | in Rundeck 1.4 (closed)
Define a policy configuration that controls which Nodes a user can execute commands. This should include the same node filtering model used for controlling command dispatch.
Below is a hypothetical example using the nodefilters element used in job definitions:
<policies>
<policy description="Node filtering policy">
<context project="anvils">
<command group="*" job="*" actions="resource_exec"/>
</context>
<nodefilters excludeprecedence="true">
<include>
<tags>web</tags>
</include>
</nodefilters>
<by>
<group name="webop"/>
</by>
</policy>
</policies>
Comments and changes to this ticket
-
Alex-SF 2010-12-17 08:54:52 UTC
- Tag set to “security feedback”
-
Alex-SF 2010-12-17 08:55:10 UTC
- Tag changed from “security feedback” to “feedback, security”
-
Alex-SF 2011-01-14 07:28:20 UTC
- Milestone set to “Rundeck 1.2”
- Milestone order changed from “15” to “0”
-
Alex-SF 2011-02-14 13:10:39 UTC
- Milestone cleared.
- Milestone order changed from “1” to “0”
-
Alex-SF 2011-09-29 08:09:11 UTC
- Milestone set to “Rundeck 1.4”
- Milestone order changed from “33” to “0”
-
Greg Schueler 2011-10-05 13:30:10 UTC
- State changed from “new” to “needs_verification”
This has been added as part of #429
Example restriction on nodes:
for: node: - contains: tags: [dev,qa] allow: [read,run] - contains: tags: [prod] allow: [read] deny: [run] - match: nodename: 'test.*' allow: [read,run] - equals: rundeck_server: 'true' deny: [run] -
Greg Schueler 2011-10-05 13:30:54 UTC
- Assigned user set to “Greg Schueler”
-
Greg Schueler 2011-10-25 12:37:19 UTC
- State changed from “needs_verification” to “resolved”
Please Sign in or create a free account to add a new ticket.
With your very own profile, you can contribute to projects, track your activity, watch tickets, receive and update tickets through your email and much more.
Create new ticket
Create your profile
Help contribute to this project by taking a few moments to create your personal profile. Create your profile ยป
(DEPRECATED) Please use github issues for issue tracking at http://github.com/dtolabs/rundeck/issues
Alex-SF
Greg Baker
Greg Schueler