whentimeslows/website
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Document node authorization mode

Browse Source
This commit is contained in:
Jordan Liggitt
2017-06-14 00:11:20 -04:00
parent 57a769f506
commit 91e90da99f
5 changed files with 107 additions and 11 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/admin/admission-controllers.md
+3 -3
View File
@@ -301,9 +301,9 @@ for more information.
### NodeRestriction
This plug-in limits the `Node` and `Pod` objects a kubelet can modify. In order to be limited by this admission plugin,
kubelets must use credentials in the `system:nodes` group, with a username in the form `system:node:<nodeName>`. Such
kubelets will only be allowed to modify their own `Node` API object, only modify `Pod` API objects that are bound to
their node and only create mirror pods for their own [static pods](/docs/tasks/administer-cluster/static-pod/).
kubelets must use credentials in the `system:nodes` group, with a username in the form `system:node:<nodeName>`.
Such kubelets will only be allowed to modify their own `Node` API object, and only modify `Pod` API objects that are bound to their node.
Future versions may add additional restrictions to ensure kubelets have the minimal set of permissions required to operate correctly.
## Is there a recommended set of plug-ins to use?