whentimeslows/website
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

add en pages

Browse Source
This commit is contained in:
Karen Bradshaw
2020-05-30 15:10:23 -04:00
parent 1502e0281d
commit ecc27bbbe7
347 changed files with 2900 additions and 2537 deletions
Download Patch File Download Diff File Expand all files Collapse all files
content/en/docs/reference/access-authn-authz/abac.md
+5 -5
View File
@@ -5,15 +5,15 @@ reviewers:
- deads2k
- liggitt
title: Using ABAC Authorization
content_template: templates/concept
content_type: concept
weight: 80
---
{{% capture overview %}}
<!-- overview -->
Attribute-based access control (ABAC) defines an access control paradigm whereby access rights are granted to users through the use of policies which combine attributes together.
{{% /capture %}}
{{% capture body %}}
<!-- body -->
## Policy File Format
To enable `ABAC` mode, specify `--authorization-policy-file=SOME_FILENAME` and `--authorization-mode=ABAC` on startup.
@@ -152,5 +152,5 @@ privilege to the API using ABAC, you would add this line to your policy file:
The apiserver will need to be restarted to pickup the new policy lines.
{{% /capture %}}
content/en/docs/reference/access-authn-authz/admission-controllers.md
+5 -5
View File
@@ -7,15 +7,15 @@ reviewers:
- janetkuo
- thockin
title: Using Admission Controllers
content_template: templates/concept
content_type: concept
weight: 30
---
{{% capture overview %}}
<!-- overview -->
This page provides an overview of Admission Controllers.
{{% /capture %}}
{{% capture body %}}
<!-- body -->
## What are they?
An admission controller is a piece of code that intercepts requests to the
@@ -773,4 +773,4 @@ in the mutating phase.
For earlier versions, there was no concept of validating versus mutating and the
admission controllers ran in the exact order specified.
{{% /capture %}}
content/en/docs/reference/access-authn-authz/authentication.md
+5 -5
View File
@@ -6,15 +6,15 @@ reviewers:
- deads2k
- liggitt
title: Authenticating
content_template: templates/concept
content_type: concept
weight: 10
---
{{% capture overview %}}
<!-- overview -->
This page provides an overview of authenticating.
{{% /capture %}}
{{% capture body %}}
<!-- body -->
## Users in Kubernetes
All Kubernetes clusters have two categories of users: service accounts managed
@@ -860,4 +860,4 @@ RFC3339 timestamp. Presence or absence of an expiry has the following impact:
}
}
```
{{% /capture %}}
content/en/docs/reference/access-authn-authz/authorization.md
+8 -7
View File
@@ -5,16 +5,16 @@ reviewers:
- deads2k
- liggitt
title: Authorization Overview
content_template: templates/concept
content_type: concept
weight: 60
---
{{% capture overview %}}
<!-- overview -->
Learn more about Kubernetes authorization, including details about creating
policies using the supported authorization modules.
{{% /capture %}}
{{% capture body %}}
<!-- body -->
In Kubernetes, you must be authenticated (logged in) before your request can be
authorized (granted permission to access). For information about authentication,
see [Controlling Access to the Kubernetes API](/docs/reference/access-authn-authz/controlling-access/).
@@ -197,9 +197,10 @@ namespace can: read all secrets in the namespace; read all config maps in the
namespace; and impersonate any service account in the namespace and take any
action the account could take. This applies regardless of authorization mode.
{{< /caution >}}
{{% /capture %}}
{{% capture whatsnext %}}
## {{% heading "whatsnext" %}}
* To learn more about Authentication, see **Authentication** in [Controlling Access to the Kubernetes API](/docs/reference/access-authn-authz/controlling-access/).
* To learn more about Admission Control, see [Using Admission Controllers](/docs/reference/access-authn-authz/admission-controllers/).
{{% /capture %}}
content/en/docs/reference/access-authn-authz/bootstrap-tokens.md
+5 -5
View File
@@ -2,11 +2,11 @@
reviewers:
- jbeda
title: Authenticating with Bootstrap Tokens
content_template: templates/concept
content_type: concept
weight: 20
---
{{% capture overview %}}
<!-- overview -->
{{< feature-state for_k8s_version="v1.18" state="stable" >}}
@@ -16,9 +16,9 @@ to support [kubeadm](/docs/reference/setup-tools/kubeadm/kubeadm/), but can be u
for users that wish to start clusters without `kubeadm`. It is also built to
work, via RBAC policy, with the [Kubelet TLS
Bootstrapping](/docs/reference/command-line-tools-reference/kubelet-tls-bootstrapping/) system.
{{% /capture %}}
{{% capture body %}}
<!-- body -->
## Bootstrap Tokens Overview
Bootstrap Tokens are defined with a specific type
@@ -188,4 +188,4 @@ client relying on the signature to bootstrap TLS trust.
Consult the [kubeadm implementation details](/docs/reference/setup-tools/kubeadm/implementation-details/)
section for more information.
{{% /capture %}}
content/en/docs/reference/access-authn-authz/certificate-signing-requests.md
+8 -7
View File
@@ -4,11 +4,11 @@ reviewers:
- mikedanese
- munnerz
title: Certificate Signing Requests
content_template: templates/concept
content_type: concept
weight: 20
---
{{% capture overview %}}
<!-- overview -->
{{< feature-state for_k8s_version="v1.18" state="beta" >}}
@@ -21,9 +21,9 @@ A CertificateSigningRequest (CSR) resource is used to request that a certificate
by a denoted signer, after which the request may be approved or denied before
finally being signed.
{{% /capture %}}
{{% capture body %}}
<!-- body -->
## Request signing process
The _CertificateSigningRequest_ resource type allows a client to ask for an X.509 certificate
@@ -317,9 +317,10 @@ subresource of the CSR to be signed.
As part of this request, the `status.certificate` field should be set to contain the
signed certificate.
{{% /capture %}}
{{% capture whatsnext %}}
## {{% heading "whatsnext" %}}
* Read [Manage TLS Certificates in a Cluster](https://kubernetes.io/docs/tasks/tls/managing-tls-in-a-cluster/)
* View the source code for the kube-controller-manager built in [signer](https://github.com/kubernetes/kubernetes/blob/32ec6c212ec9415f604ffc1f4c1f29b782968ff1/pkg/controller/certificates/signer/cfssl_signer.go)
@@ -327,4 +328,4 @@ signed certificate.
* For details of X.509 itself, refer to [RFC 5280](https://tools.ietf.org/html/rfc5280#section-3.1) section 3.1
* For information on the syntax of PKCS#10 certificate signing requests, refer to [RFC 2986](https://tools.ietf.org/html/rfc2986)
{{% /capture %}}
content/en/docs/reference/access-authn-authz/controlling-access.md
+5 -5
View File
@@ -3,15 +3,15 @@ reviewers:
- erictune
- lavalamp
title: Controlling Access to the Kubernetes API
content_template: templates/concept
content_type: concept
weight: 5
---
{{% capture overview %}}
<!-- overview -->
This page provides an overview of controlling access to the Kubernetes API.
{{% /capture %}}
{{% capture body %}}
<!-- body -->
Users [access the API](/docs/tasks/access-application-cluster/access-cluster/) using `kubectl`,
client libraries, or by making REST requests. Both human users and
[Kubernetes service accounts](/docs/tasks/configure-pod-container/configure-service-account/) can be
@@ -161,4 +161,4 @@ When the cluster is created by `kube-up.sh`, on Google Compute Engine (GCE),
and on several other cloud providers, the API server serves on port 443. On
GCE, a firewall rule is configured on the project to allow external HTTPS
access to the API. Other cluster setup methods vary.
{{% /capture %}}
content/en/docs/reference/access-authn-authz/extensible-admission-controllers.md
+4 -5
View File
@@ -7,18 +7,17 @@ reviewers:
- liggitt
- jpbetz
title: Dynamic Admission Control
content_template: templates/concept
content_type: concept
weight: 40
---
{{% capture overview %}}
<!-- overview -->
In addition to [compiled-in admission plugins](/docs/reference/access-authn-authz/admission-controllers/),
admission plugins can be developed as extensions and run as webhooks configured at runtime.
This page describes how to build, configure, use, and monitor admission webhooks.
{{% /capture %}}
{{% capture body %}}
<!-- body -->
## What are admission webhooks?
Admission webhooks are HTTP callbacks that receive admission requests and do
@@ -1589,4 +1588,4 @@ If your admission webhooks don't intend to modify the behavior of the Kubernetes
plane, exclude the `kube-system` namespace from being intercepted using a
[`namespaceSelector`](#matching-requests-namespaceselector).
{{% /capture %}}
content/en/docs/reference/access-authn-authz/node.md
+5 -5
View File
@@ -5,15 +5,15 @@ reviewers:
- liggitt
- ericchiang
title: Using Node Authorization
content_template: templates/concept
content_type: concept
weight: 90
---
{{% capture overview %}}
<!-- overview -->
Node authorization is a special-purpose authorization mode that specifically authorizes API requests made by kubelets.
{{% /capture %}}
{{% capture body %}}
<!-- body -->
## Overview
The Node authorizer allows a kubelet to perform API operations. This includes:
@@ -96,4 +96,4 @@ In 1.8, the binding will not be created at all.
When using RBAC, the `system:node` cluster role will continue to be created,
for compatibility with deployment methods that bind other users or groups to that role.
{{% /capture %}}
content/en/docs/reference/access-authn-authz/rbac.md
+4 -6
View File
@@ -4,17 +4,17 @@ reviewers:
- deads2k
- liggitt
title: Using RBAC Authorization
content_template: templates/concept
content_type: concept
aliases: [/rbac/]
weight: 70
---
{{% capture overview %}}
<!-- overview -->
Role-based access control (RBAC) is a method of regulating access to computer or
network resources based on the roles of individual users within your organization.
{{% /capture %}}
{{% capture body %}}
<!-- body -->
RBAC authorization uses the `rbac.authorization.k8s.io`
{{< glossary_tooltip text="API group" term_id="api-group" >}} to drive authorization
decisions, allowing you to dynamically configure policies through the Kubernetes API.
@@ -1209,5 +1209,3 @@ kubectl create clusterrolebinding permissive-binding \
After you have transitioned to use RBAC, you should adjust the access controls
for your cluster to ensure that these meet your information security needs.
{{% /capture %}}
content/en/docs/reference/access-authn-authz/service-accounts-admin.md
+5 -5
View File
@@ -5,19 +5,19 @@ reviewers:
- lavalamp
- liggitt
title: Managing Service Accounts
content_template: templates/concept
content_type: concept
weight: 50
---
{{% capture overview %}}
<!-- overview -->
This is a Cluster Administrator guide to service accounts. It assumes knowledge of
the [User Guide to Service Accounts](/docs/user-guide/service-accounts).
Support for authorization and user accounts is planned but incomplete. Sometimes
incomplete features are referred to in order to better describe service accounts.
{{% /capture %}}
{{% capture body %}}
<!-- body -->
## User accounts versus service accounts
Kubernetes distinguishes between the concept of a user account and a service account
@@ -115,4 +115,4 @@ kubectl delete secret mysecretname
Service Account Controller manages ServiceAccount inside namespaces, and ensures
a ServiceAccount named "default" exists in every active namespace.
{{% /capture %}}
content/en/docs/reference/access-authn-authz/webhook.md
+5 -5
View File
@@ -5,15 +5,15 @@ reviewers:
- deads2k
- liggitt
title: Webhook Mode
content_template: templates/concept
content_type: concept
weight: 95
---
{{% capture overview %}}
<!-- overview -->
A WebHook is an HTTP callback: an HTTP POST that occurs when something happens; a simple event-notification via HTTP POST. A web application implementing WebHooks will POST a message to a URL when certain things happen.
{{% /capture %}}
{{% capture body %}}
<!-- body -->
When specified, mode `Webhook` causes Kubernetes to query an outside REST
service when determining user privileges.
@@ -174,6 +174,6 @@ to the REST api.
For further documentation refer to the authorization.v1beta1 API objects and
[webhook.go](https://github.com/kubernetes/kubernetes/blob/{{< param "githubbranch" >}}/staging/src/k8s.io/apiserver/plugin/pkg/authorizer/webhook/webhook.go).
{{% /capture %}}