Rundeck provides capabilities for running commands, creating jobs, scheduling jobs, and managing operational tasks.<\/p>\n\n\n\n
Access control is important when multiple users or teams work with the same Rundeck environment. ACL policies can be used to control what users or groups are allowed to access at the project, job, node, and application levels.<\/p>\n\n\n\n
In this post, we will look at examples of how to restrict user access at the project level using Rundeck ACL policies.<\/p>\n\n\n\n
Files with the Before creating an ACL policy, ensure that you have:<\/p>\n\n\n\n The following command can be used to create a policy that restricts access to a specific job within a project:<\/p>\n\n\n\n The command generates policy content similar to the following:<\/p>\n\n\n\n Where:<\/p>\n\n\n\n As mentioned earlier, you can simply create One advantage is that you do not need to restart the Rundeck service after creating or modifying the ACL policy.<\/p>\n\n\n\n The following command can be used to create a read privilege for a group:<\/p>\n\n\n\n The output will be similar to:<\/p>\n\n\n\n Where:<\/p>\n\n\n\n The following command can be used to add Where:<\/p>\n\n\n\n In a simplified manner, the following ACL provides privileges for a specific group within a project.<\/p>\n\n\n\n Create a file named This policy provides the specified group with permissions to work with jobs and nodes in the selected project while controlling the level of access available to them.<\/p>\n\n\n\n Rundeck ACL policies provide a practical way to control access to projects, jobs, nodes, and other resources based on users and groups.<\/p>\n\n\n\n By creating An ACL policy defines the permissions that users or groups have within Rundeck. It can be used to control access to projects, jobs, nodes, and other resources.<\/p>\n\n\n\n In the original setup described in this article, ACL policy files are stored under:<\/p>\n\n\n\n Files with the The original procedure notes that a Rundeck service restart is not required after creating the ACL policy file.<\/p>\n\n\n\n How to set up rundeck in a centos-7 server<\/a><\/p>\n\n\n\n.aclpolicy<\/code><\/strong> extension in the \/etc\/rundeck<\/code> directory (the default installation location) are considered valid ACL policy files for access restrictions in Rundeck.<\/p>\n\n\n\nPrerequisites<\/h2>\n\n\n\n
\n
Implementation<\/h2>\n\n\n\n
1. Create a Project-Level Job Policy<\/h3>\n\n\n\n
rd-acl<\/code><\/strong> is a built-in command that helps create user, group, and Rundeck policies.<\/p>\n\n\n\nrd-acl test --context project --groups groupname --project projectname --job testjob --allow read,run -v<\/pre>\n\n\n\n
---\nfor:\n job:\n - allow:\n - read\n - run\n equals:\n name: 'testjob'\n\ndescription: generated\ncontext:\n project: Alerts\nby:\n group: groupname<\/pre>\n\n\n\n
\n
.aclpolicy<\/code> extension using the output content.<\/li>\n\n\n\nrundeck<\/code> and project<\/code>.<\/li>\n\n\n\ngroupname.aclpolicy<\/code><\/strong> with the above-mentioned content.<\/p>\n\n\n\n2. Create an Application-Level Policy<\/h3>\n\n\n\n
rd-acl test --context application --groups groupname --project projectname --allow read -v<\/pre>\n\n\n\n
for:\n project:\n - allow: read\n equals:\n name: groupname\ndescription: generated\ncontext:\n application: rundeck\nby:\n group: alerts<\/pre>\n\n\n\n
\n
3. Add Read and Run Privileges to a Resource<\/h3>\n\n\n\n
read<\/code> and run<\/code> privileges:<\/p>\n\n\n\nrd-acl test --context project --groups alerts --project <projectname> --resource=node --allow read,run -v<\/pre>\n\n\n\n
\n
4. Create a Project-Level ACL Policy<\/h3>\n\n\n\n
groupname.aclpolicy<\/code><\/strong> and add the following content:<\/p>\n\n\n\n---\ndescription: \"Allow users in runjobs group to run, kill jobs, etc. in the project called YOUR PROJECT\"\ncontext:\n project: YOUR PROJECT\nby:\n group: groupname\nfor:\n resource:\n - equals:\n kind: job\n allow: [read, run, kill]\n - equals:\n kind: node\n allow: [read]\n - equals:\n kind: event\n allow: [read] # allow reading activity logs\n - equals:\n kind: 'adhoc'\n allow: [read,run,kill]\n adhoc:\n - allow: [read,run,kill] # allow running\/killing adhoc jobs\n job:\n - allow: [read,run,kill]\n node:\n - allow: [read,run] # allow read\/run for nodes\n---\ncontext:\n application: rundeck\ndescription: \"Users in the 'runjobs' group can launch jobs in the project called YOUR PROJECT but not edit them\"\nfor:\n project:\n - match:\n name: 'YOUR PROJECT'\n allow: [read]\n system:\n - match:\n name: '.*'\n allow: [read]\nby:\n group: groupname<\/pre>\n\n\n\n
Conclusion<\/h2>\n\n\n\n
.aclpolicy<\/code> files with the required permissions, administrators can define what users or groups are allowed to read, run, or manage specific resources. This makes it easier to provide the required level of access without granting unnecessary permissions.<\/p>\n\n\n\nFrequently Asked Questions (FAQ)<\/h2>\n\n\n\n
1. What is an ACL policy in Rundeck?<\/h3>\n\n\n\n
2. Where are Rundeck ACL policy files stored?<\/h3>\n\n\n\n
\/etc\/rundeck<\/pre>\n\n\n\n
.aclpolicy<\/code> extension are used for access-control policies.<\/p>\n\n\n\n3. Does Rundeck need to be restarted after creating an ACL policy?<\/h3>\n\n\n\n
Related Articles<\/h2>\n\n\n\n