CODEWITHSUNDEEP
aclrundeck
sigfried
sigfried

Reputation: 69

Rundeck wildcard in ACL for project name

good morning, I have two questions:

  1. is it possible to use wildcards in Rundeck ACL for the project names? I'd like to make available only projects whose names start with SNL. I've tried but so far only ".*" works. Nothing like 'SNL*' or '/^SNL*/' work..

  2. If the exact project name is used it works, but still the user can see the other projects in the dashboard, although unable to view their content. Any chance to completely remove the other projects from any view? Here's the acl below:

    description: Jobbers, Projects access.

    context:
      project: 'SNL*' # all projects starting with SNL

    for:

      resource:
- allow: read

  adhoc:
    - allow: [read,run,kill]
  job: 
    - allow: [read,run,kill]
  node:
    - allow: [read,refresh,run]
by:

      group: yy-xxxxx

  
---

    description: Jobbers access to rundeck.

    context:

      application: 'rundeck'

    for:

      resource:
- allow: read

  project:
    - allow: read
  project_acl:
    - allow: read
  storage:
    - allow: read
by:

      group: yy-xxxxx

Upvotes: 0

Views: 226

Answers (1)

MegaDrive68k
MegaDrive68k

Reputation: 4325

Use SNL.* instead of SNL* or /^SNL*/ I made an example (tested on Rundeck 4.8):

description: project context.
context:
  project: SNL.*

for:
  resource:
    - allow: [run,read]
  job:
    - match:
        name: run.*
      allow: [run,read]
  node:
    - allow: [read,run]
by:
  group: your_group
  
---

description: app context.
context:
  application: 'rundeck'
for:
  project:
    - match:
        name: SNL.*
      allow: [read]
  storage:
     - allow: [read]
by:
  group: your_group

This ACL only get the "SNL*" projects, inside them, the "run*" jobs.

Upvotes: 0

Related Questions