9 lines
3.4 KiB
HTML
9 lines
3.4 KiB
HTML
<html><head>
|
|
<meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
|
|
<title>142. Security Configurations inside Kubernetes</title><link rel="stylesheet" type="text/css" href="css/manual-multipage.css"><meta name="generator" content="DocBook XSL Stylesheets V1.78.1"><link rel="home" href="multi_spring-cloud.html" title="Spring Cloud"><link rel="up" href="multi__spring_cloud_kubernetes.html" title="Part XVII. Spring Cloud Kubernetes"><link rel="prev" href="multi__leader_election.html" title="141. Leader Election"><link rel="next" href="multi__examples_2.html" title="143. Examples"></head><body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="navheader"><table width="100%" summary="Navigation header"><tr><th colspan="3" align="center">142. Security Configurations inside Kubernetes</th></tr><tr><td width="20%" align="left"><a accesskey="p" href="multi__leader_election.html">Prev</a> </td><th width="60%" align="center">Part XVII. Spring Cloud Kubernetes</th><td width="20%" align="right"> <a accesskey="n" href="multi__examples_2.html">Next</a></td></tr></table><hr></div><div class="chapter"><div class="titlepage"><div><div><h2 class="title"><a name="_security_configurations_inside_kubernetes" href="#_security_configurations_inside_kubernetes"></a>142. Security Configurations inside Kubernetes</h2></div></div></div><div class="section"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="_namespace" href="#_namespace"></a>142.1 Namespace</h2></div></div></div><p>Most of the components provided in this project need to know the namespace. For Kubernetes (1.3+) the namespace is made available to pod as part of the service account secret and automatically detected by the client.
|
|
For earlier version it needs to be specified as an env var to the pod. A quick way to do this is:</p><pre class="literallayout">env:
|
|
- name: "KUBERNETES_NAMESPACE"
|
|
valueFrom:
|
|
fieldRef:
|
|
fieldPath: "metadata.namespace"</pre></div><div class="section"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="_service_account" href="#_service_account"></a>142.2 Service Account</h2></div></div></div><p>For distros of Kubernetes that support more fine-grained role-based access within the cluster, you need to make sure a pod that runs with spring-cloud-kubernetes has access to the Kubernetes API.
|
|
For any service accounts you assign to a deployment/pod, you need to make sure it has the correct roles. For example, you can add <code class="literal">cluster-reader</code> permissions to your <code class="literal">default</code> service account depending on the project you’re in:</p></div></div><div class="navfooter"><hr><table width="100%" summary="Navigation footer"><tr><td width="40%" align="left"><a accesskey="p" href="multi__leader_election.html">Prev</a> </td><td width="20%" align="center"><a accesskey="u" href="multi__spring_cloud_kubernetes.html">Up</a></td><td width="40%" align="right"> <a accesskey="n" href="multi__examples_2.html">Next</a></td></tr><tr><td width="40%" align="left" valign="top">141. Leader Election </td><td width="20%" align="center"><a accesskey="h" href="multi_spring-cloud.html">Home</a></td><td width="40%" align="right" valign="top"> 143. Examples</td></tr></table></div></body></html> |