Define aclpolicy that confines node execution

#142

Define a policy configuration that controls which Nodes a user can execute commands. This should include the same node filtering model used for controlling command dispatch.

Below is a hypothetical example using the nodefilters element used in job definitions:

<policies>
  <policy description="Node filtering policy">
    <context project="anvils">
      <command group="*" job="*" actions="resource_exec"/>
    </context>
    <nodefilters excludeprecedence="true">
      <include>
        <tags>web</tags>
      </include>
    </nodefilters>
    <by>
      <group name="webop"/>
    </by>
  </policy>
</policies>

Reported by Alex-SF · December 17th, 2010 @ 08:54 AM

Activity

Alex-SF
- Tag set to security feedback
December 17th, 2010 @ 08:54 AM
Alex-SF
- Tag changed from security feedback to feedback, security
December 17th, 2010 @ 08:55 AM
Alex-SF
- Milestone set to Rundeck 1.2
- Milestone order changed from 15 to 0
January 14th, 2011 @ 07:28 AM
Alex-SF
- Milestone cleared.
- Milestone order changed from 1 to 0
February 14th, 2011 @ 01:10 PM
Alex-SF
- Milestone set to Rundeck 1.4
- Milestone order changed from 33 to 0
September 29th, 2011 @ 08:09 AM

Greg Schueler

State changed from new to needs_verification

This has been added as part of #429 update aclpolicy and replace role mappings

Example restriction on nodes:

for:
  node:
    - contains:
        tags: [dev,qa]
      allow: [read,run]
    - contains:
        tags: [prod]
      allow: [read]
      deny: [run]
    - match:
        nodename: 'test.*'
      allow: [read,run]
    - equals:
        rundeck_server: 'true'
      deny: [run]

October 5th, 2011 @ 01:30 PM

Greg Schueler
- Assigned user set to Greg Schueler
October 5th, 2011 @ 01:30 PM
Greg Schueler
- State changed from needs_verification to resolved
October 25th, 2011 @ 12:37 PM

Please Sign in or create a free account to add a new ticket.

With your very own profile, you can contribute to projects, track your activity, watch tickets, receive and update tickets through your email and much more.