Merge branch 'master' of https://github.com/kubernetes/kubernetes.github.io into release-1.8
* 'master' of https://github.com/kubernetes/kubernetes.github.io: (87 commits) fix envFrom in configmap Add link to example for CRDs (#5641) Fixed links to architecture.md and principles.md Polish AppArmor tutorial Remove dangling files related to apparmor fix the typo of serviceaccount (#5533) Correct setup link (#5634) relink the persistent volume of petset (#5582) Updates to case study landing page (#5629) translate doc resource-quotas into chinese minor encoding fix for CN page fix typo concepts-overview-components+abac-fix concepts-overview-components-fix Update links to avoid redirects. (#5627) Update links to avoid redirects. (#5625) Fix 404s. (#5624) Fix 404s. (#5623) Edits cpu-constraint-namespace.md Fix index redirects (#5502) ... # Conflicts: # _redirects # docs/concepts/storage/volumes.md # docs/concepts/workloads/controllers/daemonset.md # docs/concepts/workloads/controllers/petset.md # docs/concepts/workloads/controllers/statefulset.md # docs/tasks/run-application/run-single-instance-stateful-application.md # docs/tutorials/stateful-application/zookeeper.md
This commit is contained in:
Andrew Chen
@@ -97,7 +97,7 @@ Kubernetes authorization requires that you use common REST attributes to interac
|
||||
|
||||
Kubernetes supports multiple authorization modules, such as ABAC mode, RBAC Mode, and Webhook mode. When an administrator creates a cluster, they configured the authorization modules that should be used in the API server. If more than one authorization modules are configured, Kubernetes checks each module, and if any module authorizes the request, then the request can proceed. If all of the modules deny the request, then the request is denied (HTTP status code 403).
|
||||
|
||||
To learn more about Kubernetes authorization, including details about creating policies using the supported authorization modules, see [Authorization Overview](/docs/admin/authorization).
|
||||
To learn more about Kubernetes authorization, including details about creating policies using the supported authorization modules, see [Authorization Overview](/docs/admin/authorization/).
|
||||
|
||||
|
||||
## Admission Control
|
||||
|
||||
@@ -71,7 +71,7 @@ class is marked as default, it rejects any creation of `PersistentVolumeClaim` w
|
||||
must revisit `StorageClass` objects and mark only one as default.
|
||||
This plugin ignores any `PersistentVolumeClaim` updates; it acts only on creation.
|
||||
|
||||
See [persistent volume](/docs/user-guide/persistent-volumes) documentation about persistent volume claims and
|
||||
See [persistent volume](/docs/concepts/storage/persistent-volumes/) documentation about persistent volume claims and
|
||||
storage classes and how to mark a storage class as default.
|
||||
|
||||
### DefaultTolerationSeconds
|
||||
|
||||
@@ -1,10 +0,0 @@
|
||||
#include <tunables/global>
|
||||
|
||||
profile k8s-apparmor-example-deny-write flags=(attach_disconnected) {
|
||||
#include <abstractions/base>
|
||||
|
||||
file,
|
||||
|
||||
# Deny all file writes.
|
||||
deny /** w,
|
||||
}
|
||||
@@ -1,13 +0,0 @@
|
||||
apiVersion: v1
|
||||
kind: Pod
|
||||
metadata:
|
||||
name: hello-apparmor
|
||||
annotations:
|
||||
# Tell Kubernetes to apply the AppArmor profile "k8s-apparmor-example-deny-write".
|
||||
# Note that this is ignored if the Kubernetes node is not running version 1.4 or greater.
|
||||
container.apparmor.security.beta.kubernetes.io/hello: localhost/k8s-apparmor-example-deny-write
|
||||
spec:
|
||||
containers:
|
||||
- name: hello
|
||||
image: busybox
|
||||
command: [ "sh", "-c", "echo 'Hello AppArmor!' && sleep 1h" ]
|
||||
@@ -435,7 +435,7 @@ the authentication webhook
|
||||
queries the remote service with a review object containing the token. Kubernetes
|
||||
will not challenge a request that lacks such a header.
|
||||
|
||||
Note that webhook API objects are subject to the same [versioning compatibility rules](/docs/api/)
|
||||
Note that webhook API objects are subject to the same [versioning compatibility rules](/docs/concepts/overview/kubernetes-api/)
|
||||
as other Kubernetes API objects. Implementers should be aware of looser
|
||||
compatibility promises for beta objects and check the "apiVersion" field of the
|
||||
request to ensure correct deserialization. Additionally, the API server must
|
||||
|
||||
@@ -37,7 +37,7 @@ Kubernetes reviews only the following API request attributes:
|
||||
--* For resource requests using `get`, `update`, `patch`, and `delete` verbs, you must provide the resource name.
|
||||
* **Subresource** - The subresource that is being accessed (for resource requests only).
|
||||
* **Namespace** - The namespace of the object that is being accessed (for namespaced resource requests only).
|
||||
* **API group** - The API group being accessed (for resource requests only). An empty string designates the [core API group](/docs/api/).
|
||||
* **API group** - The API group being accessed (for resource requests only). An empty string designates the [core API group](/docs/concepts/overview/kubernetes-api/).
|
||||
|
||||
## Determine the Request Verb
|
||||
To determine the request verb for a resource API endpoint, review the HTTP verb used and whether or not the request acts on an individual resource or a collection of resources:
|
||||
|
||||
@@ -521,7 +521,7 @@ This is commonly used by add-on API servers for unified authentication and autho
|
||||
<tr>
|
||||
<td><b>system:persistent-volume-provisioner</b></td>
|
||||
<td>None</td>
|
||||
<td>Allows access to the resources required by most <a href="/docs/user-guide/persistent-volumes/#provisioner">dynamic volume provisioners</a>.</td>
|
||||
<td>Allows access to the resources required by most <a href="/docs/concepts/storage/persistent-volumes/#provisioner">dynamic volume provisioners</a>.</td>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
|
||||
@@ -58,7 +58,7 @@ action. This object contains fields describing the user attempting to make the
|
||||
request, and either details about the resource being accessed or requests
|
||||
attributes.
|
||||
|
||||
Note that webhook API objects are subject to the same [versioning compatibility rules](/docs/api/)
|
||||
Note that webhook API objects are subject to the same [versioning compatibility rules](/docs/concepts/overview/kubernetes-api/)
|
||||
as other Kubernetes API objects. Implementers should be aware of looser
|
||||
compatibility promises for beta objects and check the "apiVersion" field of the
|
||||
request to ensure correct deserialization. Additionally, the API Server must
|
||||
|
||||
@@ -134,7 +134,7 @@ existing Kubernetes cluster. It also starts a
|
||||
[`type: LoadBalancer`](/docs/concepts/services-networking/service/#type-loadbalancer)
|
||||
[`Service`](/docs/concepts/services-networking/service/) for the
|
||||
`federation-apiserver` and a
|
||||
[`PVC`](/docs/concepts/storage/persistent-volumes/) backed
|
||||
[`PVC`](/docs/concepts/storage/persistent-volumes/#persistentvolumeclaims/) backed
|
||||
by a dynamically provisioned
|
||||
[`PV`](/docs/concepts/storage/persistent-volumes/) for
|
||||
`etcd`. All these components are created in the `federation` namespace.
|
||||
|
||||
Reference in New Issue
Block a user