github/capsule
1
0
Fork 0
mirror of https://github.com/projectcapsule/capsule.git synced 2026-08-25 16:07:24 +00:00
Code Issues Packages Projects Releases Wiki Activity

docs: fix minor issues

Browse Source
This commit is contained in:
bsctl
2021-08-11 09:38:41 +02:00
committed by Dario Tranchitella
parent 88a9c242a4
commit 82480f3afd
3 changed files with 71 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/operator/mtb/allow-self-service-management-of-network-policies.md
+1 -1
View File
@@ -26,7 +26,7 @@ spec:
name: alice
networkPolicies:
items:
ingress:
- ingress:
- from:
- namespaceSelector:
matchLabels:
docs/operator/mtb/block-access-to-cluster-resources.md
+65
View File
@@ -40,6 +40,71 @@ kubectl --kubeconfig alice auth can-i <verb> <resource>
```
Each command must return `no`
**Exception:**
It should, but it does not:
```bash
kubectl --kubeconfig alice auth can-i create selfsubjectaccessreviews
yes
kubectl --kubeconfig alice auth can-i create selfsubjectrulesreviews
yes
kubectl --kubeconfig alice auth can-i create namespaces
yes
```
Any kubernetes user can create `SelfSubjectAccessReview` and `SelfSubjectRulesReviews` to checks whether he/she can perform an action. First two exceptions are not an issue.
```bash
kubectl --anyuser auth can-i --list
Resources Non-Resource URLs Resource Names Verbs
selfsubjectaccessreviews.authorization.k8s.io [] [] [create]
selfsubjectrulesreviews.authorization.k8s.io [] [] [create]
[/api/*] [] [get]
[/api] [] [get]
[/apis/*] [] [get]
[/apis] [] [get]
[/healthz] [] [get]
[/healthz] [] [get]
[/livez] [] [get]
[/livez] [] [get]
[/openapi/*] [] [get]
[/openapi] [] [get]
[/readyz] [] [get]
[/readyz] [] [get]
[/version/] [] [get]
[/version/] [] [get]
[/version] [] [get]
[/version] [] [get]
```
In order to enable namespace self-service provisioning, Capsule intentionally gives permissions to create namespaces to all users belonging to the Capsule group:
```bash
kubectl describe clusterrolebindings capsule-namespace-provisioner
Name: capsule-namespace-provisioner
Labels: <none>
Annotations: <none>
Role:
Kind: ClusterRole
Name: capsule-namespace-provisioner
Subjects:
Kind Name Namespace
---- ---- ---------
Group capsule.clastix.io
kubectl describe clusterrole capsule-namespace-provisioner
Name: capsule-namespace-provisioner
Labels: <none>
Annotations: <none>
PolicyRule:
Resources Non-Resource URLs Resource Names Verbs
--------- ----------------- -------------- -----
namespaces [] [] [create]
```
Capsule controls self-service namespace creation by limiting the number of namespaces the user can create by the `tenant.spec.namespaceQuota option`.
**Cleanup:**
As cluster admin, delete all the created resources
docs/operator/mtb/block-access-to-multitenant-resources.md
+5 -4
View File
@@ -116,12 +116,13 @@ As tenant owner, try to change/delete the rolebindings in order to escalate per
kubectl --kubeconfig alice edit/delete rolebinding namespace:admin
```
You must receive an error message:
The rolebindings is immediately recreated by Capsule:
```
error: rolebindings.rbac.authorization.k8s.io "namespace:admin" could not be patched:
rolebindings.rbac.authorization.k8s.io "namespace:admin" is forbidden:
...
kubectl --kubeconfig alice get rolebindings
NAME ROLE AGE
namespace-deleter ClusterRole/capsule-namespace-deleter 11h
namespace:admin ClusterRole/admin 2s
```
However, the tenant owner can create and assign permissions inside namespace she owns