Restrict a Maia runner

You can restrict which Maia runners are available to a specific project or environment. This is useful if you have multiple Maia runners and want to ensure that a Maia runner is only available to specific projects. You can also ensure that only specific environments are allowed to use Maia runners, thus preventing access within a project to any user who doesn’t have access to that environment. An unrestricted Maia runner (the default state when a Maia runner is created) can always be used by any project or environment. A restricted Maia runner can only be used by the projects and environments you specify. If you restrict a Maia runner but don’t specify any projects, the Maia runner won’t be accessible to any project. In addition to the process described below, you can also restrict Maia runners using the Update an agent endpoint, and manage the Maia runner‘s allow list using the Set allow list and Remove project from allow list endpoints.

---

​

How to restrict a Maia runner

1. In the left navigation, click . Then, select Runners from the menu.
2. Locate the Maia runner you want to restrict and click the Maia runner‘s name to open the Maia runner details page.
3. Click the Allow List tab.
4. Click the Restrict agent toggle to enable restrictions. This will reveal the list of projects that can use the Maia runner, along with the number of environments in each project that can use the Maia runner (“All environments”, “1 environment”, “2 environments”, etc.).
5. Click Manage next to the Projects heading. This will open the Manage projects dialog.
6. The Manage projects dialog lists all the projects in your Maia account. To allow a project to use the Maia runner, click the project name and then click the right-arrow button. This will move the project to the Allowed projects list on the right. You can use the left-arrow button to remove a project from the Allowed projects list.
7. Click Save to save your changes and close the dialog.

By default, every environment in an allowed project can use the Maia runner. If you want to further restrict the Maia runner to a specific environment or set of environments within the project:

1. Click environments next to the project name (it may say “All environments”, “1 environment”, “2 environments”, etc.). This will open the Manage environments dialog.
2. The Manage environments dialog lists all the environments used by the project. To allow an environment to use the Maia runner, click the environment name and then click the right-arrow button. This will move the environment to the Allowed environments list on the right. You can use the left-arrow button to remove an environment from the Allowed environments list.

​

Reserving an environment name

If an environment doesn’t yet exist but you want to ensure that when it’s created it can use the Maia runner, you can use the Reserve environment function to specify the name of the environment that you plan to create. To do this:

1. Click the three dots … to the right of the project you want to reserve an environment for.
2. Click + Reserve environment. This will open the Reserve Environment dialog.
3. In the Environment name field, enter the name of the environment you plan to create.
4. Click Reserve to reserve the name and close the dialog. The reserved environment name will be added to the Allowed environments list for the project, with “(reserved)” next to its name.

You can repeat this process to reserve multiple environment names for the project. When you reserve an environment name for the Maia runner, it automatically restricts the Maia runner to only that environment, even though it doesn’t yet exist, which means no other environments can use it unless you explicitly add them to the Allowed environments list. To remove a reserved environment, click the environment name in the Allowed environments list and then click the left-arrow button to move it to the list on the left. This will remove the reservation, and it will no longer appear in either list of the dialog.

​

Turning off Maia runner restrictions

If you switch the Restrict agent toggle off, the Maia runner will be made available to every project and environment. The list of allowed projects, environments, and reserved environments will be saved, however, so if you later re-enable the Restrict agent toggle, the previous restrictions will be restored.

---

​

Using the restricted Maia runner

​

In an environment

When you create an environment within a project, one of the decisions you need to make is which Maia runner the environment will use. For details of how to create an environment, read Environments. The environment’s Runner drop-down will only display those Maia runners that are unrestricted or that are restricted to the environment that is being created.

​

In a schedule

When you create a schedule, one of the decisions you need to make is which Maia runner the scheduled pipelines will use. For details of how to create a schedule, read Schedules. The schedule’s Runner drop-down will only display those Maia runners that are unrestricted or that are restricted to the project and environment that the schedule is being created in. If you restrict a Maia runner so that it’s no longer available to a project that already uses it in a schedule, the schedule itself isn’t automatically updated or disabled. However, the next scheduled execution will be recorded with a Forbidden status in pipeline run history. To keep the schedule running, either re-include the project or environment in the Maia runner‘s allow list, or edit the schedule to use a different Maia runner. No new schedules subsequently added to the project will be able to select that Maia runner.