20.2. Setting local permissions using ACLs

1. Execute the pcs acl role create…​ command to create a role which defines the permissions for that role.
2. Assign the role you created to a user with the pcs acl user create command. If you assign multiple roles to the same user, any deny permission takes precedence, then write, then read.

Procedure

1. This procedure requires that the user rouser exists on the local system and that the user rouser is a member of the group haclient.

   # adduser rouser
   # usermod -a -G haclient rouser

2. Enable Pacemaker ACLs with the pcs acl enable command.

   # pcs acl enable

3. Create a role named read-only with read-only permissions for the cib.

   # pcs acl role create read-only description="Read access to cluster" read xpath /cib

4. Create the user rouser in the pcs ACL system and assign that user the read-only role.

   # pcs acl user create rouser read-only

5. View the current ACLs.

   # pcs acl
   User: rouser
     Roles: read-only
   Role: read-only
     Description: Read access to cluster
     Permission: read xpath /cib (read-only-read)

6. On each node where rouser will run pcs commands, log in as rouser and authenticate to the local pcsd service. This is required in order to run certain pcs commands, such as pcs status, as the ACL user.

   [rouser ~]$ pcs client local-auth