rundeck_users.aclpolicy yaml

---
description: "Ops Engineers can launch jobs but not edit them"
context:
  project: *
for:
  resource:
  - equals:
  kind: 'node'
  allow: [read,update,refresh]
  - equals:
  kind: 'job'
  allow: [read,run,kill]
  - equals:
  kind: 'adhoc'
  allow: [read,run,kill]
  - equals:
  kind: 'event'
  allow: [read,create]
  job:
  - match:
  name: '.*'
  allow: [read,run,kill]
  adhoc:
  - match:
  name: '.*'
  allow: [read,run,kill]
  node:
  - match:
  nodename: '.*'
  allow: [read,run,refresh]
by:
  group:
  - rundeck_users

---
context:
  application: rundeck
description: "Ops Engineers can launch jobs but not edit them"
for:
  project:
    - match:
        name: '*'
      allow: [read]
    system:
    - match:
 name: '.*'
 allow: [read]
by:
 group:
 - rundeck_users