Replace the deprecated "Restricted Admin" role with a custom role "All Clusters Admin"
Summary
The "Restricted Admin" global role is deprecated since v2.8.0, and will be removed in a future Rancher version, probably v2.10.0.
We can replace it with a custom role that grants the "cluster-admin" cluster role on all the workload clusters.
related references
- https://ranchermanager.docs.rancher.com/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/manage-role-based-access-control-rbac/global-permissions#globalrole-permissions-on-downstream-clusters
- https://ranchermanager.docs.rancher.com/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/manage-role-based-access-control-rbac/global-permissions#restricted-admin
Details
In order to achieve feature parity, we can:
- Create a custom role all-clusters-admin that inherits the cluster-admin cluster role
- Replace the default infra-restricted-admins group by all-clusters-admins
- Assign the roles of Standard User and all-clusters-admin to this default group