SpringCloud/spring-cloud-kubernetes
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Sync docs from master to gh-pages

Browse Source
This commit is contained in:
buildmaster
2019-08-14 14:57:04 +00:00
parent 67304bcee3
commit 7b1432f88a
4 changed files with 280 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

71
reference/html/spring-cloud-kubernetes.html
View File

@@ -1415,7 +1415,76 @@ For earlier versions, it needs to be specified as an environment variable to the
<h3 id="_service_account"><a class="link" href="#_service_account">Service Account</a></h3>
<div class="paragraph">
<p>For distributions of Kubernetes that support more fine-grained role-based access within the cluster, you need to make sure a pod that runs with <code>spring-cloud-kubernetes</code> has access to the Kubernetes API.
For any service accounts you assign to a deployment or pod, you need to make sure they have the correct roles. For example, you can add <code>cluster-reader</code> permissions to your <code>default</code> service account, depending on the project you&#8217;re in.</p>
For any service accounts you assign to a deployment or pod, you need to make sure they have the correct roles.</p>
</div>
<div class="paragraph">
<p>Depending on the requirements, you&#8217;ll need <code>get</code>, <code>list</code> and <code>watch</code> permission on the following resources:</p>
</div>
<table class="tableblock frame-all grid-all stretch">
<caption class="title">Table 5. Kubernetes Resource Permissions</caption>
<colgroup>
<col style="width: 50%;">
<col style="width: 50%;">
</colgroup>
<thead>
<tr>
<th class="tableblock halign-left valign-top">Dependency</th>
<th class="tableblock halign-left valign-top">Resources</th>
</tr>
</thead>
<tbody>
<tr>
<td class="tableblock halign-left valign-top"><p class="tableblock">spring-cloud-starter-kubernetes</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">pods, services, endpoints</p></td>
</tr>
<tr>
<td class="tableblock halign-left valign-top"><p class="tableblock">spring-cloud-starter-kubernetes-config</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">configmaps, secrets</p></td>
</tr>
<tr>
<td class="tableblock halign-left valign-top"><p class="tableblock">spring-cloud-starter-kubernetes-ribbon</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">pods, services, endpoints</p></td>
</tr>
</tbody>
</table>
<div class="paragraph">
<p>For development purposes, you can add <code>cluster-reader</code> permissions to your <code>default</code> service account. On a production system you&#8217;ll likely want to provide more granular permissions.</p>
</div>
<div class="paragraph">
<p>The following Role and RoleBinding are an example for namespaced permissions for the <code>default</code> account:</p>
</div>
<div class="exampleblock">
<div class="content">
<div class="listingblock">
<div class="content">
<pre class="highlightjs highlight"><code class="language-yaml hljs" data-lang="yaml">kind: Role
apiVersion: rbac.authorization.k8s.io/v1
metadata:
namespace: YOUR-NAME-SPACE
name: namespace-reader
rules:
- apiGroups: ["", "extensions", "apps"]
resources: ["configmaps", "pods", "services", "endpoints", "secrets"]
verbs: ["get", "list", "watch"]
---
kind: RoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
name: namespace-reader-binding
namespace: YOUR-NAME-SPACE
subjects:
- kind: ServiceAccount
name: default
apiGroup: ""
roleRef:
kind: Role
name: namespace-reader
apiGroup: ""</code></pre>
</div>
</div>
</div>
</div>
</div>
</div>