Introduction

Rundeck provides a flexible Access Control List (ACL) system that allows administrators to control user permissions at the application, project, job, and node levels. ACL policies help ensure that users and groups have access only to the resources they require.

Prerequisites

Before you begin, ensure you have:

  • Rundeck installed and running
  • Administrative access to the Rundeck server
  • A configured Rundeck project
  • User groups already defined in your authentication source
  • Access to the ACL policy directory (default: /etc/rundeck/)

Note: Any file with the .aclpolicy extension placed in the ACL policy directory is automatically loaded by Rundeck. No service restart is required after creating or modifying a policy.

Implementation

Create a Project-Level ACL Policy

Use the following command to generate a policy that allows a group to read and run a specific job.

rd-acl test --context project \
--groups groupname \
--project projectname \
--job testjob \
--allow read,run -v

Example output:

---
for:
  job:
  - allow:
    - read
    - run
    equals:
      name: testjob

description: generated
context:
  project: projectname
by:
  group: groupname

Save the generated output as:

groupname.aclpolicy

and place it under the Rundeck ACL policy directory.

Create an Application-Level ACL Policy

To grant a group read access to the Rundeck application:

rd-acl test --context application \
--groups groupname \
--project projectname \
--allow read -v

Example output:

for:
  project:
  - allow: read
    equals:
      name: groupname

description: generated

context:
  application: rundeck

by:
  group: groupname

Grant Node Permissions

To allow users to read and execute commands on project nodes:

rd-acl test \
--context project \
--groups groupname \
--project projectname \
--resource node \
--allow read,run -v

Understanding Common rd-acl Options

OptionDescription
--contextDefines whether the policy applies to a project or the Rundeck application.
--groupsSpecifies the user group the policy applies to.
--projectSpecifies the Rundeck project name.
--jobLimits the policy to a specific job.
--resourceDefines the resource type (job, node, project, system, etc.).
--allowLists the permissions to grant, such as read, run, or kill.

Example: Read and Run Access for a Project

Create a file named groupname.aclpolicy with the following content:

---
description: "Allow users to read and run jobs"

context:
  project: YOUR PROJECT

by:
  group: groupname

for:
  resource:
    - equals:
        kind: job
      allow: [read, run, kill]

    - equals:
        kind: node
      allow: [read]

    - equals:
        kind: event
      allow: [read]

    - equals:
        kind: adhoc
      allow: [read, run, kill]

  adhoc:
    - allow: [read, run, kill]

  job:
    - allow: [read, run, kill]

  node:
    - allow: [read, run]
---
context:
  application: rundeck

description: "Allow project access"

for:
  project:
    - match:
        name: "YOUR PROJECT"
      allow: [read]

  system:
    - match:
        name: ".*"
      allow: [read]

by:
  group: groupname

Replace:

  • YOUR PROJECT with your Rundeck project name.
  • groupname with the appropriate user group.

Save the file in the ACL policy directory. Rundeck automatically detects the new policy without requiring a restart.

Conclusion

Rundeck ACL policies provide a simple and effective way to manage user permissions at different levels, including applications, projects, jobs, and nodes. Using the rd-acl utility, you can quickly generate policy templates, while custom .aclpolicy files offer greater flexibility for defining access controls. Proper ACL configuration helps secure your Rundeck environment by ensuring users have only the permissions they need.

Post Views: 332

Leave a Reply