docs: minor improvements

This commit is contained in:
Dave
2021-07-16 17:52:16 +02:00
committed by GitHub
parent 96f4f31c17
commit 76d7697703
5 changed files with 10 additions and 10 deletions
+5 -5
View File
@@ -23,11 +23,11 @@ spec:
kind: User
```
> If you need to address specific use-case, the said annotation supports multiple values comme separated
>
> ```yaml
> capsule.clastix.io/allowed-image-pull-policy: Always,IfNotPresent
> ```
If you need to address specific use-case, the said annotation supports multiple values comma separated
```yaml
capsule.clastix.io/allowed-image-pull-policy: Always,IfNotPresent
```
# Whats next
+2 -2
View File
@@ -85,14 +85,14 @@ capsule-oil-0 <none> 42h
production-network-policy <none> 3m
```
an delete the namespace network-policies
And delete the namespace network policies
```
alice@caas# kubectl -n oil-production delete networkpolicy production-network-policy
```
However, the Capsule controller prevents Alice to delete the tenant network policy:
However, the Capsule controller prevents Alice from deleting the tenant network policy:
```
alice@caas# kubectl -n oil-production delete networkpolicy capsule-oil-0
+1 -1
View File
@@ -1,7 +1,7 @@
# Assign permissions
Alice acts as the tenant admin. Other users can operate inside the tenant with different levels of permissions and authorizations. Alice is responsible for creating additional roles and assigning these roles to other users to work in the same tenant.
One of the key design principles of the Capsule is the self-provisioning management from the tenant owner's perspective. Alice, the tenant owner, does not need to interact with Bill, the cluster admin, to complete her day-by-day duties. On the other side, Bill has not to deal with multiple requests coming from multiple tenant owners that probably will overwhelm him.
One of the key design principles of the Capsule is the self-provisioning management from the tenant owner's perspective. Alice, the tenant owner, does not need to interact with Bill, the cluster admin, to complete her day-by-day duties. On the other side, Bill does not have to deal with multiple requests coming from multiple tenant owners that probably will overwhelm him.
Capsule leaves Alice the freedom to create RBAC roles at the namespace level, or using the pre-defined cluster roles already available in Kubernetes, and assign them to other users in the tenant. Since roles and rolebindings are limited to a namespace scope, Alice can assign the roles to the other users accessing the same tenant only after the namespace is created. This gives Alice the power to administer the tenant without the intervention of the cluster admin.
@@ -70,7 +70,7 @@ roleRef:
name: 'psp:privileged'
```
With the above example, Capsule is forbidding to any authenticated user in `oil-production` namespace to run privileged pods and let them to performs privilege escalation as declared by the Cluster Role `psp:privileged`.
With the above example, Capsule is forbidding any authenticated user in `oil-production` namespace to run privileged pods and to perform privilege escalation as declared by the Cluster Role `psp:privileged`.
# Whats next
See how Bill, the cluster admin, can assign to Alice the permissions to create custom resources in her tenant. [Create Custom Resources](./custom-resources.md).
@@ -19,7 +19,7 @@ spec:
scopes:
- NotTerminating
- hard:
pods: "100"
pods: "10"
services: "50"
- hard:
requests.storage: 10Gi