Link replacements for a,b,c
This commit is contained in:
@@ -27,8 +27,8 @@ By default the Kubernetes APIserver serves HTTP on 2 ports:
|
||||
- default is port 6443, change with `--secure-port` flag.
|
||||
- default IP is first non-localhost network interface, change with `--bind-address` flag.
|
||||
- serves HTTPS. Set cert with `--tls-cert-file` and key with `--tls-private-key-file` flag.
|
||||
- uses token-file or client-certificate based [authentication(/{{page.version}}/docs/admin/authentication).
|
||||
- uses policy-based [authorization(/{{page.version}}/docs/admin/authorization).
|
||||
- uses token-file or client-certificate based [authentication](/{{page.version}}/docs/admin/authentication).
|
||||
- uses policy-based [authorization](/{{page.version}}/docs/admin/authorization).
|
||||
3. Removed: ReadOnly Port
|
||||
- For security reasons, this had to be removed. Use the [service account](/{{page.version}}/docs/user-guide/service-accounts) feature instead.
|
||||
|
||||
|
||||
@@ -2,7 +2,7 @@
|
||||
title: "Authorization Plugins"
|
||||
---
|
||||
In Kubernetes, authorization happens as a separate step from authentication.
|
||||
See the [authentication documentation(/{{page.version}}/docs/admin/authentication) for an
|
||||
See the [authentication documentation](/{{page.version}}/docs/admin/authentication) for an
|
||||
overview of authentication.
|
||||
|
||||
Authorization applies to all HTTP accesses on the main (secure) apiserver port.
|
||||
|
||||
+13
-13
@@ -27,41 +27,41 @@ Before choosing a particular guide, here are some things to consider:
|
||||
- Not all distros are maintained as actively. Prefer ones which are listed as tested on a more recent version of
|
||||
Kubernetes.
|
||||
- If you are configuring kubernetes on-premises, you will need to consider what [networking
|
||||
model](networking) fits best.
|
||||
- If you are designing for very high-availability, you may want [clusters in multiple zones](multi-cluster).
|
||||
model](/{{page.version}}/docs/admin/networking) fits best.
|
||||
- If you are designing for very high-availability, you may want [clusters in multiple zones](/{{page.version}}/docs/admin/multi-cluster).
|
||||
- You may want to familiarize yourself with the various
|
||||
[components](cluster-components) needed to run a cluster.
|
||||
[components](/{{page.version}}/docs/admin/cluster-components) needed to run a cluster.
|
||||
|
||||
## Setting up a cluster
|
||||
|
||||
Pick one of the Getting Started Guides from the [matrix](/{{page.version}}/docs/getting-started-guides/) and follow it.
|
||||
If none of the Getting Started Guides fits, you may want to pull ideas from several of the guides.
|
||||
|
||||
One option for custom networking is *OpenVSwitch GRE/VxLAN networking* ([ovs-networking.md](ovs-networking)), which
|
||||
One option for custom networking is *OpenVSwitch GRE/VxLAN networking* ([ovs-networking.md](/{{page.version}}/docs/admin/ovs-networking)), which
|
||||
uses OpenVSwitch to set up networking between pods across
|
||||
Kubernetes nodes.
|
||||
|
||||
If you are modifying an existing guide which uses Salt, this document explains [how Salt is used in the Kubernetes
|
||||
project](salt).
|
||||
project](/{{page.version}}/docs/admin/salt).
|
||||
|
||||
## Managing a cluster, including upgrades
|
||||
|
||||
[Managing a cluster](cluster-management).
|
||||
[Managing a cluster](/{{page.version}}/docs/admin/cluster-management).
|
||||
|
||||
## Managing nodes
|
||||
|
||||
[Managing nodes](node).
|
||||
[Managing nodes](/{{page.version}}/docs/admin/node).
|
||||
|
||||
## Optional Cluster Services
|
||||
|
||||
* **DNS Integration with SkyDNS** ([dns.md](dns)):
|
||||
* **DNS Integration with SkyDNS** ([dns.md](/{{page.version}}/docs/admin/dns)):
|
||||
Resolving a DNS name directly to a Kubernetes service.
|
||||
|
||||
* **Logging** with [Kibana](/{{page.version}}/docs/user-guide/logging)
|
||||
|
||||
## Multi-tenant support
|
||||
|
||||
* **Resource Quota** ([resource-quota.md](resource-quota))
|
||||
* **Resource Quota** ([resource-quota.md](/{{page.version}}/docs/admin/resource-quota))
|
||||
|
||||
## Security
|
||||
|
||||
@@ -69,10 +69,10 @@ project](salt).
|
||||
Describes the environment for Kubelet managed containers on a Kubernetes
|
||||
node.
|
||||
|
||||
* **Securing access to the API Server** [accessing the api](accessing-the-api)
|
||||
* **Securing access to the API Server** [accessing the api](/{{page.version}}/docs/admin/accessing-the-api)
|
||||
|
||||
* **Authentication** [authentication(/{{page.version}}/docs/admin/authentication)
|
||||
* **Authentication** [authentication](/{{page.version}}/docs/admin/authentication)
|
||||
|
||||
* **Authorization** [authorization(/{{page.version}}/docs/admin/authorization)
|
||||
* **Authorization** [authorization](/{{page.version}}/docs/admin/authorization)
|
||||
|
||||
* **Admission Controllers** [admission_controllers](admission-controllers)
|
||||
* **Admission Controllers** [admission_controllers](/{{page.version}}/docs/admin/admission-controllers)
|
||||
@@ -26,7 +26,7 @@ work like this:
|
||||
of the resources for which quota is enabled, then the POST of the pod will fail with HTTP
|
||||
status code `403 FORBIDDEN`. Hint: Use the LimitRange admission controller to force default
|
||||
values of *limits* (then resource *requests* would be equal to *limits* by default, see
|
||||
[admission controller](admission-controllers)) before the quota is checked to avoid this problem.
|
||||
[admission controller](/{{page.version}}/docs/admin/admission-controllers)) before the quota is checked to avoid this problem.
|
||||
|
||||
Examples of policies that could be created using namespaces and quotas are:
|
||||
|
||||
@@ -73,7 +73,7 @@ are supported:
|
||||
| pods | Total number of pods |
|
||||
| services | Total number of services |
|
||||
| replicationcontrollers | Total number of replication controllers |
|
||||
| resourcequotas | Total number of [resource quotas](admission-controllers/#resourcequota) |
|
||||
| resourcequotas | Total number of [resource quotas](/{{page.version}}/docs/admin/admission-controllers/#resourcequota) |
|
||||
| secrets | Total number of secrets |
|
||||
| persistentvolumeclaims | Total number of [persistent volume claims](/{{page.version}}/docs/user-guide/persistent-volumes/#persistentvolumeclaims) |
|
||||
|
||||
|
||||
@@ -38,7 +38,7 @@ Three separate components cooperate to implement the automation around service a
|
||||
### Service Account Admission Controller
|
||||
|
||||
The modification of pods is implemented via a plugin
|
||||
called an [Admission Controller](admission-controllers). It is part of the apiserver.
|
||||
called an [Admission Controller](/{{page.version}}/docs/admin/admission-controllers). It is part of the apiserver.
|
||||
It acts synchronously to modify pods as they are created or updated. When this plugin is active
|
||||
(and it is by default on most distributions), then it does the following when a pod is created or modified:
|
||||
|
||||
|
||||
Reference in New Issue
Block a user