How to work with workspaces using RBAC/members?

I’m experimenting with Rancher at a client. I would like to use the Continuous Delivery functionality aka Fleet.

There will be many projects that would like to deploy to the k8s clusters. Atm there are three clusters: dev, test and prod but there will be more clusters later on, situated in different sites that the client owns.

Since there will be many projects there will also be many gitrepos added and I am not always part of the project that want to deploy so I can’t always add gitrepos. And even if I would be I don’t want to do all the work with renewing git tokens. That is why I would like all the projects to do most of the work themselves.

As I see it, I would create a workspace and somehow add members to that workspace.
I would also have to create a role for seeing workspaces and adding gitrepos.
I would have to add that role to the member.
I would also add the clusters that should be available to that workspace.
Then the members of that workspace will add their git repo and start working.

But there are a few things I don’t understand:

  • How do I add membership to a workspace?
    When I create a workspace a namespace in the local Rancher cluster is created, I have tried to add
    that namespace to a project and then add members to that project. And yes, that makes me see my
    workspaces but I also get access to the local cluster which is not what I want.

  • How do I add which clusters should be available to each workspace?
    So since there will be a couple of clusters spread out over the country I would like for the workspace
    to only see the clusters they are supposed to deploy to. So if the project is at SiteA I would like that
    workspace to only see clusters from SiteA. I have seen that I can move clusters between different
    workspaces but I would rather copy a cluster so that both workspaces can deploy to that cluster.

I’m new to all this so if there is any important information I have left out, tell me and I will try to add more details.

Thanks