rundeck用户权限管理

前情：

$RDECK_BASE 为rundeck的自定义环境变量，可以按如下配置：

$ vim .bashrc

export RDECK_BASE=/home/sc/rundeck  #末尾追加

$ source .bashrc

$ echo $RDECK_BASE

/home/sc/rundeck #可以看到当前用户的环境变量已经添加成功了

*****************************************************************************

1、 用户管理

$ vim $RDECK_BASE/server/config/realm.properties

# The format is

# <username>: <password>[,<rolename> ...]

admin:admin,user,admin  #用户名为admin，密码为admin，权限为普通用户user和管理员用户admin的配置
xiaoming:123456,user  #用户名为xiaoming,密码为123456，权限为普通用户user的配置

2、 admin权限管理

$ vim $RDECK_BASE/etc/admin.aclpolicy

description: Admin, all access.
context:
  project: '.*' # all projects
for:
  resource:
    - allow: '*' # allow read/create all kinds
  adhoc:
    - allow: '*' # allow read/running/killing adhoc jobs
  job:
    - allow: '*' # allow read/write/delete/run/kill of all jobs
  node:
    - allow: '*' # allow read/run for all nodes
by:
  group: admin

---

description: Admin, all access.
context:
  application: 'rundeck'
for:
  resource:
    - allow: '*' # allow create of projects
  project:
    - allow: '*' # allow view/admin of all projects
  project_acl:
    - allow: '*' # allow admin of all project-level ACL policies
  storage:
    - allow: '*' # allow read/create/update/delete for all /keys/* storage content
by:
  group: admin

3、普通用户读权限管理

$ cd $RDECK_BASE/etc

$ touch database_select.aclpolicy # 创建Project database_select 普通用户权限

description: user.

context:

  project: 'database_select'

for:

  resource:

    - equals:

        kind: job

      allow: [run,kill] # allow read/create all kinds

    - equals:

        kind: node

      allow: [run]

    - equals:

        kind: event

      allow: [read]

  adhoc:

    - deny: '*'

  job:

    - match:

        group: '.*'   ##若是project 给授权所有的job组权限，就这样，若是  project/moni/xxjob    就改成 moni

        name: 'select order_id|新零售-查询订单状态和轨迹'

      allow: [read,run,runAs,kill,killAs] # allow read/write/delete/run/kill of all jobs

  node:

    - allow: [read,run] # allow read/run for all nodes

by:

  username: 'xiaoming'

---
description: user.

context:

  application: 'rundeck'

for:

  resource:

    - equals:

        kind: project

      allow: [read] # allow create of projects

    - equals:

        kind: system

      allow: [read]

    - equals:

        kind: user

      allow: [read]

  project:

    - match:

        name: 'database_select'

      allow: [read]  # allow view/admin of all projects

  storage:

    - allow: [read,create] # allow read/create/update/delete for all /keys/* storage content

by:
  username: 'admin|xiaoming|userxxx'

  group: 'user'

如果要自定义普通用户在job，node，project上细粒度的读写权限，自主修改上面的配置文件即可，但我觉得粗略的读写权限基本已经够用了。