How to Create ACL Policies in Rundeck for User and Project Access

Introduction

Rundeck provides capabilities for running commands, creating jobs, scheduling jobs, and managing operational tasks.

Access control is important when multiple users or teams work with the same Rundeck environment. ACL policies can be used to control what users or groups are allowed to access at the project, job, node, and application levels.

In this post, we will look at examples of how to restrict user access at the project level using Rundeck ACL policies.

Files with the .aclpolicy extension in the /etc/rundeck directory (the default installation location) are considered valid ACL policy files for access restrictions in Rundeck.

Prerequisites

Before creating an ACL policy, ensure that you have:

1. Rundeck installed and configured.
2. Access to the Rundeck server.
3. Appropriate permissions to create or modify ACL policy files.
4. Basic knowledge of Rundeck projects, jobs, groups, and resources.

Implementation

1. Create a Project-Level Job Policy

rd-acl is a built-in command that helps create user, group, and Rundeck policies.

The following command can be used to create a policy that restricts access to a specific job within a project:

rd-acl test --context project --groups groupname --project projectname --job testjob --allow read,run -v

The command generates policy content similar to the following:

---
for:
  job:
  - allow:
    - read
    - run
    equals:
      name: 'testjob'

description: generated
context:
  project: Alerts
by:
  group: groupname

Where:

• test – Displays the output in the command prompt. Create a file with the .aclpolicy extension using the output content.
• –context – Specifies the access request context. Options are rundeck and project.
• –project – Specifies the project name.
• –job – Specifies the job name.
• –allow – Specifies the privileges for the selected category.

As mentioned earlier, you can simply create groupname.aclpolicy with the above-mentioned content.

One advantage is that you do not need to restart the Rundeck service after creating or modifying the ACL policy.

2. Create an Application-Level Policy

The following command can be used to create a read privilege for a group:

rd-acl test --context application --groups groupname --project projectname --allow read -v

The output will be similar to:

for:
  project:
  - allow: read
    equals:
      name: groupname
description: generated
context:
  application: rundeck
by:
  group: alerts

Where:

• application – Here, application refers to Rundeck.

3. Add Read and Run Privileges to a Resource

The following command can be used to add read and run privileges:

rd-acl test --context project --groups alerts --project <projectname> --resource=node --allow read,run -v

Where:

• resource – Specifies a specific resource within the project or resources as required.
• Options include jobs, system, project, and node.

4. Create a Project-Level ACL Policy

In a simplified manner, the following ACL provides privileges for a specific group within a project.

Create a file named groupname.aclpolicy and add the following content:

---
description: "Allow users in runjobs group to run, kill jobs, etc. in the project called YOUR PROJECT"
context:
  project: YOUR PROJECT
by:
  group: groupname
for:
  resource:
    - equals:
        kind: job
      allow: [read, run, kill]
    - equals:
        kind: node
      allow: [read]
    - equals:
        kind: event
      allow: [read] # allow reading activity logs
    - equals:
        kind: 'adhoc'
      allow: [read,run,kill]
  adhoc:
    - allow: [read,run,kill] # allow running/killing adhoc jobs
  job:
    - allow: [read,run,kill]
  node:
    - allow: [read,run] # allow read/run for nodes
---
context:
  application: rundeck
description: "Users in the 'runjobs' group can launch jobs in the project called YOUR PROJECT but not edit them"
for:
  project:
    - match:
        name: 'YOUR PROJECT'
      allow: [read]
  system:
    - match:
        name: '.*'
      allow: [read]
by:
  group: groupname

This policy provides the specified group with permissions to work with jobs and nodes in the selected project while controlling the level of access available to them.

Conclusion

Rundeck ACL policies provide a practical way to control access to projects, jobs, nodes, and other resources based on users and groups.

By creating .aclpolicy files with the required permissions, administrators can define what users or groups are allowed to read, run, or manage specific resources. This makes it easier to provide the required level of access without granting unnecessary permissions.

Frequently Asked Questions (FAQ)

1. What is an ACL policy in Rundeck?

An ACL policy defines the permissions that users or groups have within Rundeck. It can be used to control access to projects, jobs, nodes, and other resources.

2. Where are Rundeck ACL policy files stored?

In the original setup described in this article, ACL policy files are stored under:

/etc/rundeck

Files with the .aclpolicy extension are used for access-control policies.

3. Does Rundeck need to be restarted after creating an ACL policy?

The original procedure notes that a Rundeck service restart is not required after creating the ACL policy file.

Related Articles

How to set up rundeck in a centos-7 server

Setting a job on Rundeck

Talk to Our Technology Experts

Planning your AWS infrastructure or looking to improve an existing cloud environment? Our team can help with cloud architecture, infrastructure, DevOps, security, deployment, and ongoing optimization.

Connect with our technology experts.