登录rundeck系统http://rundeck.com:4440/user/login (登录自己的系统)
2.权限设置, 点击Access Contral
3.创建策略
4. 策略内容模板
注: 以下各字段说明参考官方文档:http://rundeck.org/docs/administration/access-control-policy.html
用户hyh01是用命令行工具创建,参考文档: http://blog.51cto.com/haoyonghui/2085869
权限控制配置
description: hyh01 project access contral context: #描述策略范围project和application, application级别策略控制所有project的规则及system级别权限,project策略控制project下的资源规则 project: '.*' # 项目app01对应的策略 for: #for下面对应的资源类型job node adhoc project resource resource: - match: # 匹配模式match(list or string) equals(string) contains(list or string) subset(list string) kind: job allow: [create] # allow create jobs 可填的选项create/delete - equals: kind: node allow: [read,create,update,refresh] # allow refresh node sources - equals: kind: event #read显示执行命令历史记录 allow: [read,create] # allow read/create events adhoc: #command命令策略 - allow: [read,run] # allow running/killing adhoc jobs job: - match: name: 'check' allow: [read,create,delete,run] #只有满足这里的策略,resource的策略才生效 #- allow: [create,run,read,update,delete,runAs,kill,killAs] # allow create/read/write/delete/run/kill of all jobs node: - match: nodename: 'rundeck' #匹配节点机,匹配不到则job执行失败 allow: [read,run] #- allow: [read,run] # allow read/run for nodes by: username: 'hyh01' --- description: hyh01 application access contral context: application: 'rundeck' for: resource: - equals: kind: project allow: [create] # allow create of projects - equals: kind: system allow: [read,enable_executions,disable_executions,admin] # allow read of system info, enable/disable all executions - equals: kind: system_acl allow: [read,create,update,delete,admin] # allow modifying system ACL files - equals: kind: user allow: [admin] # allow modify user profiles project: - match: name: 'test|app01' allow: [read,import] # allow full access of all projects or use 'admin' project_acl: - match: name: 'test|app01' allow: [read,create] # allow modifying project-specific ACL files storage: - allow: [create,update,delete] # allow access for /ssh-key/* storage content by: group: hyh01