Configure access control using OVHcloud IAM on an OVHcloud Managed Rancher Service

Objective

OVHcloud Managed Rancher Service (MRS) supports authentication through OVHcloud IAM, allowing you to manage access using centralized user identities and roles.

This guide explains how to enable IAM authentication and control user access to your Rancher service using OVHcloud IAM users and roles.

Requirements

• An OVHcloud Managed Rancher Service (see the Creating, updating and accessing a Managed Rancher Service guide for more information).

Instructions

Introduction to OVHcloud IAM

OVHcloud IAM (Identity and Access Management) is a centralized system that lets you control who can access your OVHcloud services and what actions they can perform. It provides fine-grained access management through users, groups, and roles.

When integrated with the Managed Rancher Service (MRS), OVHcloud IAM replaces Rancher’s local authentication system. This allows you to:

• Use Single Sign-On (SSO) with your OVHcloud credentials to access Rancher.
• Assign predefined IAM roles (such as base, ovhRestrictedAdmin, standard) to define access levels.
• Manage permissions efficiently at scale using IAM groups and projects.

Integrating IAM with your Rancher service ensures consistent access control across all your OVHcloud resources, reducing manual management and improving overall security.

Activate/disable authentication via OVHcloud IAM

{
  "targetSpec": {
    "iamAuthEnabled": true, // true to enable IAM, false to disable
    "name": "my_rancher", // Name of the Managed Rancher Service
    "plan": "STANDARD", // Plan of the Managed Rancher Service
    "version": "1.0.0" // Version of the Managed Rancher Service
  }
}

Authentication using SSO with OVHcloud IAM users

Once IAM authentication is enabled on your Managed Rancher Service, access to the Rancher UI is managed via OVHcloud Single Sign-On (SSO). Users no longer log in with local Rancher credentials but authenticate directly using their OVHcloud IAM identity.

To log in via SSO:

• Open the Rancher user interface from the Control Panel.

• You will be redirected to the Managed Rancher Service authentication page.

Click on Log in with OIDC, which will take you to the OVHcloud authentication page. There, log in using your OVHcloud IAM credentials.

• Access to Rancher is granted based on the IAM role associated with your user account.

Managing access rights with OVHcloud IAM

OVHcloud IAM provides three predefined roles for managing access to your Managed Rancher Service (MRS):

• base
• standard
• ovhRestrictedAdmin

These roles are assigned through IAM policies. To create and configure a policy, log in to the OVHcloud Control Panel and navigate to the Identity, Security & Operations section. Then, in the left-hand menu under Identity and Access management, click on Policies and click the Create a policy button.

Define users and groups, name your policy, add the users you want to include and optionally, add user groups if they have already been created.

Set permissions for MRS:

• In the Product types section, select Public Cloud / Managed Rancher Service (MRS) project.
• In the Resources section, choose the specific MRS service to which the policy will apply.

Expand Public Cloud / Managed Rancher Service (MRS) project and select the desired role for the users defined in the policy.

Go further

To go further you can look at our guides on:

• Managing users and projects.
• Creating and using a private image.

If you need training or technical assistance to implement our solutions, contact your sales representative or click on this link to get a quote and ask our Professional Services experts for assisting you on your specific use case of your project.

Our team remains available on our dedicated Discord Channel, do not hesitate to join and reach us : https://discord.gg/ovhcloud. Ask questions, provide feedback and interact directly with the team that builds our Container and Orchestration services.

Join our community of users.