From 537893253f98d719185439899af05e032f82dda3 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Nicolai=20von=C2=A0Neudeck?= Date: Tue, 29 Nov 2016 00:11:40 +0100 Subject: [PATCH 1/5] Added info about where to add/drop capabilities The user-guide did not mention where to drop/add capabilities in Kubernetes. Added a link to the not yet complete API documentation and an example. --- docs/user-guide/containers.md | 21 +++++++++++++++++++++ 1 file changed, 21 insertions(+) diff --git a/docs/user-guide/containers.md b/docs/user-guide/containers.md index cf05278801..26eceebbce 100644 --- a/docs/user-guide/containers.md +++ b/docs/user-guide/containers.md @@ -94,3 +94,24 @@ The relationship between Docker's capabilities and [Linux capabilities](http://m | SETFCAP | CAP_SETFCAP | | WAKE_ALARM | CAP_WAKE_ALARM | | BLOCK_SUSPEND | CAP_BLOCK_SUSPEND | + +Capabilities are added/dropped in the [`SecurityContext`](http://kubernetes.io/docs/api-reference/v1/definitions/#_v1_securitycontext), e.g.: + +``` +apiVersion: v1 +kind: Pod +metadata: + name: hello-world +spec: + containers: + - name: friendly-container + image: "alpine:3.4" + command: + - echo "hello" + securityContext: + capabilities: + add: + - SYS_NICE + drop: + - KILL +``` From c61aee3c5407da65c1902f9060c9654c1a5f5c17 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Nicolai=20von=C2=A0Neudeck?= Date: Tue, 29 Nov 2016 00:34:29 +0100 Subject: [PATCH 2/5] forgot yaml format --- docs/user-guide/containers.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/user-guide/containers.md b/docs/user-guide/containers.md index 26eceebbce..c985c94f02 100644 --- a/docs/user-guide/containers.md +++ b/docs/user-guide/containers.md @@ -97,7 +97,7 @@ The relationship between Docker's capabilities and [Linux capabilities](http://m Capabilities are added/dropped in the [`SecurityContext`](http://kubernetes.io/docs/api-reference/v1/definitions/#_v1_securitycontext), e.g.: -``` +```yaml apiVersion: v1 kind: Pod metadata: From fd0d4112b05302af5ee8e8e30d9cfd4e6f986c5c Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Nicolai=20von=C2=A0Neudeck?= Date: Tue, 29 Nov 2016 00:43:01 +0100 Subject: [PATCH 3/5] fixed indentation, cleaner command --- docs/user-guide/containers.md | 23 +++++++++++------------ 1 file changed, 11 insertions(+), 12 deletions(-) diff --git a/docs/user-guide/containers.md b/docs/user-guide/containers.md index c985c94f02..7c39f30f09 100644 --- a/docs/user-guide/containers.md +++ b/docs/user-guide/containers.md @@ -101,17 +101,16 @@ Capabilities are added/dropped in the [`SecurityContext`](http://kubernetes.io/d apiVersion: v1 kind: Pod metadata: - name: hello-world + name: hello-world spec: - containers: - - name: friendly-container - image: "alpine:3.4" - command: - - echo "hello" - securityContext: - capabilities: - add: - - SYS_NICE - drop: - - KILL + containers: + - name: friendly-container + image: "alpine:3.4" + command: ["/bin/echo", "hello", "world"] + securityContext: + capabilities: + add: + - SYS_NICE + drop: + - KILL ``` From d0b94ae1b759b6a60ef3aec4156ee4c8cd672818 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Nicolai=20von=C2=A0Neudeck?= Date: Mon, 26 Dec 2016 21:04:03 +0100 Subject: [PATCH 4/5] Removed passive voice --- docs/user-guide/containers.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/user-guide/containers.md b/docs/user-guide/containers.md index 7c39f30f09..d760c3b84f 100644 --- a/docs/user-guide/containers.md +++ b/docs/user-guide/containers.md @@ -95,7 +95,7 @@ The relationship between Docker's capabilities and [Linux capabilities](http://m | WAKE_ALARM | CAP_WAKE_ALARM | | BLOCK_SUSPEND | CAP_BLOCK_SUSPEND | -Capabilities are added/dropped in the [`SecurityContext`](http://kubernetes.io/docs/api-reference/v1/definitions/#_v1_securitycontext), e.g.: +You can add/drop capabilities in the [`SecurityContext`](http://kubernetes.io/docs/api-reference/v1/definitions/#_v1_securitycontext), e.g.: ```yaml apiVersion: v1 From 9fe1e02e728db13a244765d5b977ffdda4839f73 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Nicolai=20von=C2=A0Neudeck?= Date: Mon, 26 Dec 2016 21:16:47 +0100 Subject: [PATCH 5/5] replaced "/" with "or" --- docs/user-guide/containers.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/user-guide/containers.md b/docs/user-guide/containers.md index d760c3b84f..e597279a4e 100644 --- a/docs/user-guide/containers.md +++ b/docs/user-guide/containers.md @@ -95,7 +95,7 @@ The relationship between Docker's capabilities and [Linux capabilities](http://m | WAKE_ALARM | CAP_WAKE_ALARM | | BLOCK_SUSPEND | CAP_BLOCK_SUSPEND | -You can add/drop capabilities in the [`SecurityContext`](http://kubernetes.io/docs/api-reference/v1/definitions/#_v1_securitycontext), e.g.: +You can add or drop capabilities in the [`SecurityContext`](http://kubernetes.io/docs/api-reference/v1/definitions/#_v1_securitycontext), e.g.: ```yaml apiVersion: v1