VCF Salt: Is it possible to create a role which can not run any job directly on any Target Group (Windows, Linux, All Minions....) ?

Products

• VCF Automation

Issue/Introduction

Is it possible to create a user role in RaaS which is able to run jobs on individually-selected minions only, but cannot run jobs on entire target groups?

Environment

VCFA Salt 8.x

Also known as: RaaS / Aria Config / SaltStack Enterprise

Resolution

• There is no way to limit the number of minions a user can target at a time.
  • You can create jobs that have specific targets already assigned to them with a fixed function and fixed target
  • You can create a job with a fixed function and allow user to select a target
  • You can limit access to select target groups
  • You can create a compound target with a mix of grains based targeting and lists to include specific minions
  • ...but there is no way to limit how many minions the user targets at a time.
  • Access to the 'All Minions' target group is a default required group and will only reflect the minions that the user has access to view and execute commands against.
• It may be possible to add configuration to the Salt master and block certain functions. Check here for details:
  • docs.saltproject.io - Access Control System 
  • docs.saltproject.io - External Authentication System