github/capsule
1
0
Fork 0
mirror of https://github.com/projectcapsule/capsule.git synced 2026-08-25 16:07:24 +00:00
Code Issues Packages Projects Releases Wiki Activity

docs: enforcement of LoadBalancer service kind

Browse Source
This commit is contained in:
Dario Tranchitella
2021-08-17 17:21:59 +02:00
parent 60ab33337d
commit 9d65013a22
1 changed files with 25 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/operator/use-cases/service-type.md
+25 -3
View File
@@ -22,10 +22,10 @@ spec:
EOF
```
With the above configuration, any attempt of Alice to create a a Service of type `NodePort` is denied by the Validation Webhook enforcing it. Default value is `true`.
With the above configuration, any attempt of Alice to create a Service of type `NodePort` is denied by the Validation Webhook enforcing it. Default value is `true`.
## ExternalName
Service with type of `ExternalName` has been found subject to many securty issue. To prevent tenant owners to create services with type of `ExternalName`, the cluster admin can prevent a tenant to create them:
Service with type of `ExternalName` has been found subject to many security issue. To prevent tenant owners to create services with type of `ExternalName`, the cluster admin can prevent a tenant to create them:
```yaml
kubectl apply -f - << EOF
@@ -43,7 +43,29 @@ spec:
EOF
```
With the above configuration, any attempt of Alice to create a a Service of type `externalName` is denied by the Validation Webhook enforcing it. Default value is `true`.
With the above configuration, any attempt of Alice to create a Service of type `externalName` is denied by the Validation Webhook enforcing it. Default value is `true`.
## LoadBalancer
Same as previously, Service of type of `LoadBalancer` could be blocked for various reasons. To prevent tenant owners to create these kinds of services, the cluster admin can prevent a tenant to create them:
```yaml
kubectl apply -f - << EOF
apiVersion: capsule.clastix.io/v1beta1
kind: Tenant
metadata:
name: oil
spec:
owners:
- name: alice
kind: User
serviceOptions:
allowedServices:
loadBalancer: false
EOF
```
With the above configuration, any attempt of Alice to create a Service of type `LoadBalancer` is denied by the Validation Webhook enforcing it. Default value is `true`.
# What’s next
See how Bill, the cluster admin, can set taints on the Alice's services. [Taint services](./taint-services.md).