Rundeck

Overview

The Rundeck integration connects a self-hosted Rundeck instance to Oneleet, syncing its user profiles as user account assets. This lets Oneleet monitor who has access to your Rundeck instance.

What does Oneleet monitor?

• Rundeck user profiles (user accounts), including each user’s login, name, and email

Setup

To set up the Rundeck integration, navigate to Integrations > Add integration > Rundeck.

Oneleet connects with a Rundeck user API token and your instance’s domain. Sign in as a user with the admin role. The instance must be reachable from the internet over HTTPS at a public hostname (not an IP address), without redirecting to another address.

1. Copy your instance’s domain without https://, e.g. rundeck.example.com. Include the port or path if your instance uses one.

2. Open the System menu (gear icon), select Access Control, then Create ACL Policy. Name it user-auditor and save a policy that allows app_admin on the system resource for the user-auditor group:

   description: Read-only listing of Rundeck user profiles
   context:
     application: rundeck
   for:
     resource:
       - equals:
           kind: system
         allow: [app_admin]
   by:
     group: user-auditor

3. Open the user menu, select Profile, and next to User API Tokens select +. Enter user-auditor in Roles, select Generate New Token, and copy the token.

4. Paste the domain and token into the form in Oneleet and click Connect.

Known limitations

• Rundeck lists a user only after they’ve signed in at least once, so users who never signed in don’t appear in Oneleet.
• Rundeck keeps a user’s profile after the user is removed from your login module (realm file, LDAP or SSO), so removed users keep appearing as active accounts in Oneleet.