mirror of
https://github.com/projectcapsule/capsule.git
synced 2026-08-25 16:07:24 +00:00
docs: minor improvements
This commit is contained in:
@@ -23,11 +23,11 @@ spec:
|
||||
kind: User
|
||||
```
|
||||
|
||||
> If you need to address specific use-case, the said annotation supports multiple values comme separated
|
||||
>
|
||||
> ```yaml
|
||||
> capsule.clastix.io/allowed-image-pull-policy: Always,IfNotPresent
|
||||
> ```
|
||||
If you need to address specific use-case, the said annotation supports multiple values comma separated
|
||||
|
||||
```yaml
|
||||
capsule.clastix.io/allowed-image-pull-policy: Always,IfNotPresent
|
||||
```
|
||||
|
||||
# What’s next
|
||||
|
||||
|
||||
@@ -85,14 +85,14 @@ capsule-oil-0 <none> 42h
|
||||
production-network-policy <none> 3m
|
||||
```
|
||||
|
||||
an delete the namespace network-policies
|
||||
And delete the namespace network policies
|
||||
|
||||
```
|
||||
alice@caas# kubectl -n oil-production delete networkpolicy production-network-policy
|
||||
```
|
||||
|
||||
|
||||
However, the Capsule controller prevents Alice to delete the tenant network policy:
|
||||
However, the Capsule controller prevents Alice from deleting the tenant network policy:
|
||||
|
||||
```
|
||||
alice@caas# kubectl -n oil-production delete networkpolicy capsule-oil-0
|
||||
|
||||
@@ -1,7 +1,7 @@
|
||||
# Assign permissions
|
||||
Alice acts as the tenant admin. Other users can operate inside the tenant with different levels of permissions and authorizations. Alice is responsible for creating additional roles and assigning these roles to other users to work in the same tenant.
|
||||
|
||||
One of the key design principles of the Capsule is the self-provisioning management from the tenant owner's perspective. Alice, the tenant owner, does not need to interact with Bill, the cluster admin, to complete her day-by-day duties. On the other side, Bill has not to deal with multiple requests coming from multiple tenant owners that probably will overwhelm him.
|
||||
One of the key design principles of the Capsule is the self-provisioning management from the tenant owner's perspective. Alice, the tenant owner, does not need to interact with Bill, the cluster admin, to complete her day-by-day duties. On the other side, Bill does not have to deal with multiple requests coming from multiple tenant owners that probably will overwhelm him.
|
||||
|
||||
Capsule leaves Alice the freedom to create RBAC roles at the namespace level, or using the pre-defined cluster roles already available in Kubernetes, and assign them to other users in the tenant. Since roles and rolebindings are limited to a namespace scope, Alice can assign the roles to the other users accessing the same tenant only after the namespace is created. This gives Alice the power to administer the tenant without the intervention of the cluster admin.
|
||||
|
||||
|
||||
@@ -70,7 +70,7 @@ roleRef:
|
||||
name: 'psp:privileged'
|
||||
```
|
||||
|
||||
With the above example, Capsule is forbidding to any authenticated user in `oil-production` namespace to run privileged pods and let them to performs privilege escalation as declared by the Cluster Role `psp:privileged`.
|
||||
With the above example, Capsule is forbidding any authenticated user in `oil-production` namespace to run privileged pods and to perform privilege escalation as declared by the Cluster Role `psp:privileged`.
|
||||
|
||||
# What’s next
|
||||
See how Bill, the cluster admin, can assign to Alice the permissions to create custom resources in her tenant. [Create Custom Resources](./custom-resources.md).
|
||||
@@ -19,7 +19,7 @@ spec:
|
||||
scopes:
|
||||
- NotTerminating
|
||||
- hard:
|
||||
pods: "100"
|
||||
pods: "10"
|
||||
services: "50"
|
||||
- hard:
|
||||
requests.storage: 10Gi
|
||||
|
||||
Reference in New Issue
Block a user