From cb1b07ed5b3f895a0305b717a07daf3d9c16e643 Mon Sep 17 00:00:00 2001 From: buildmaster Date: Wed, 4 Sep 2019 11:45:11 +0000 Subject: [PATCH] Bumping versions --- README.adoc | 12 +++++++++--- 1 file changed, 9 insertions(+), 3 deletions(-) diff --git a/README.adoc b/README.adoc index 6a33b61b..79549b7e 100644 --- a/README.adoc +++ b/README.adoc @@ -133,6 +133,8 @@ spring.cloud.kubernetes.discovery.enabled=false Some Spring Cloud components use the `DiscoveryClient` in order to obtain information about the local service instance. For this to work, you need to align the Kubernetes service name with the `spring.application.name` property. +NOTE: `spring.application.name` has no effect as far as the name registered for the application within Kubernetes + Spring Cloud Kubernetes can also watch the Kubernetes service catalog for changes and update the `DiscoveryClient` implementation accordingly. In order to enable this functionality you need to add `@EnableScheduling` on a configuration class in your application. @@ -453,10 +455,13 @@ When enabled, the `SecretsPropertySource` looks up Kubernetes for `Secrets` from . Named after the application (as defined by `spring.application.name`) . Matching some labels -Note that, by default, consuming Secrets through the API (points 2 and 3 above) *is not enabled* for security reasons. +*Note:* + +By default, consuming Secrets through the API (points 2 and 3 above) *is not enabled* for security reasons. The permission 'list' on secrets allows clients to inspect secrets values in the specified namespace. Further, we recommend that containers share secrets through mounted volumes. -If you enable consuming Secrets through the API, we recommend that you limit access to Secrets by using an -[authorization policy, such as RBAC](https://kubernetes.io/docs/concepts/configuration/secret/#best-practices). + +If you enable consuming Secrets through the API, we recommend that you limit access to Secrets by using an authorization policy, such as RBAC. +For more information about risks and best practices when consuming Secrets through the API refer to https://kubernetes.io/docs/concepts/configuration/secret/#best-practices[this doc]. If the secrets are found, their data is made available to the application. @@ -602,6 +607,7 @@ the `Secret` named `s1` would be looked up in the namespace that the application |=== Notes: + * The `spring.cloud.kubernetes.secrets.labels` property behaves as defined by https://github.com/spring-projects/spring-boot/wiki/Spring-Boot-Configuration-Binding#map-based-binding[Map-based binding]. * The `spring.cloud.kubernetes.secrets.paths` property behaves as defined by