Rancher

Connect Rancher to collect cloud infrastructure evidence with automated compliance tests, switched on per workspace.

Connect with an API token

1. In Rancher:

   1. Sign in to Rancher as the user Safeguard will act as (one that holds only a read-only global role).
   2. From the upper right corner, select User Avatar › Account & API Keys.
   3. Click Create API Key.
   4. Optionally enter a description and select an expiration period (Rancher recommends one). Leave the scope empty so the key works against the Rancher API rather than a single cluster.
   5. Click Create and copy the Bearer Token (or the Access Key and Secret Key). This information is only displayed once.
   6. As an administrator, go to ☰ › Users & Authentication, click Users, select the user and click ⋮ › Edit Config.
   7. In the Global Permissions section, check only the read-only role your Rancher defines, and click Save.

   Where to find the other values:

   • Base URL: The Endpoint shown with the new API key, or the https address of your Rancher server.

   Rancher shows the secret only once, so copy it before you leave the page.

   Rancher's public documentation does not cover every step.

   A key with no scope grants access to everything the user can access, so the user's own role is what keeps it read-only. Rancher's global-permissions page names Administrator, Standard User and User-Base plus granular permissions; it does not name a built-in global role called Read-only, so the customer may need to create a custom global role with read-only verbs.

   Source: ranchermanager.docs.rancher.com, ranchermanager.docs.rancher.com, checked 2026-10-07.

   The permissions Safeguard needs: Read-only global role.

2. On Compliance › Connectors, open Rancher, click Connect, choose API token and fill in:

   Field	What to enter
   Base URL	Required. Your own server: an https address reachable from the internet.
   API token	Required. Stored encrypted and never shown again.

3. Click Connect with token.

Frameworks

Safeguard's automated tests read Rancher and map to the controls below. When a test passes, the result is evidence toward each control it maps to, in every framework listed. It is evidence toward a control, not proof that the control is met on its own.

These tests are switched on per workspace by the Safeguard team.

Related

• Cloud Infrastructure connectors
• Compliance connectors: how connecting works, card statuses and multiple accounts
• Connector setup reference: every connector in one table
• Frameworks and connectors: how connectors provide evidence for frameworks