diff --git a/docs/operator/use-cases/service-type.md b/docs/operator/use-cases/service-type.md index c9adcaec..80fbcd7d 100644 --- a/docs/operator/use-cases/service-type.md +++ b/docs/operator/use-cases/service-type.md @@ -22,10 +22,10 @@ spec: EOF ``` -With the above configuration, any attempt of Alice to create a a Service of type `NodePort` is denied by the Validation Webhook enforcing it. Default value is `true`. +With the above configuration, any attempt of Alice to create a Service of type `NodePort` is denied by the Validation Webhook enforcing it. Default value is `true`. ## ExternalName -Service with type of `ExternalName` has been found subject to many securty issue. To prevent tenant owners to create services with type of `ExternalName`, the cluster admin can prevent a tenant to create them: +Service with type of `ExternalName` has been found subject to many security issue. To prevent tenant owners to create services with type of `ExternalName`, the cluster admin can prevent a tenant to create them: ```yaml kubectl apply -f - << EOF @@ -43,7 +43,29 @@ spec: EOF ``` -With the above configuration, any attempt of Alice to create a a Service of type `externalName` is denied by the Validation Webhook enforcing it. Default value is `true`. +With the above configuration, any attempt of Alice to create a Service of type `externalName` is denied by the Validation Webhook enforcing it. Default value is `true`. + +## LoadBalancer + +Same as previously, Service of type of `LoadBalancer` could be blocked for various reasons. To prevent tenant owners to create these kinds of services, the cluster admin can prevent a tenant to create them: + +```yaml +kubectl apply -f - << EOF +apiVersion: capsule.clastix.io/v1beta1 +kind: Tenant +metadata: + name: oil +spec: + owners: + - name: alice + kind: User + serviceOptions: + allowedServices: + loadBalancer: false +EOF +``` + +With the above configuration, any attempt of Alice to create a Service of type `LoadBalancer` is denied by the Validation Webhook enforcing it. Default value is `true`. # What’s next See how Bill, the cluster admin, can set taints on the Alice's services. [Taint services](./taint-services.md). \ No newline at end of file