mirror of
https://github.com/projectcapsule/capsule.git
synced 2026-08-25 16:07:24 +00:00
fix(docs): spellchecking in docs and typo fixes
This commit is contained in:
Tisham Dhar
committed by
Dario Tranchitella
Dario Tranchitella
parent
ffa4a47e6b
commit
d096a25d66
@@ -0,0 +1,27 @@
|
||||
name: docs-lint
|
||||
|
||||
on:
|
||||
push:
|
||||
branches: [ "*" ]
|
||||
paths:
|
||||
- '.github/workflows/docs-lint.yml'
|
||||
- 'docs/content/**'
|
||||
pull_request:
|
||||
branches: [ "*" ]
|
||||
paths:
|
||||
- '.github/workflows/docs-lint.yml'
|
||||
- 'docs/content/**'
|
||||
|
||||
jobs:
|
||||
spelling:
|
||||
name: Spell Check
|
||||
runs-on: ubuntu-20.04
|
||||
steps:
|
||||
- uses: actions/checkout@v2
|
||||
with:
|
||||
fetch-depth: 0
|
||||
- uses: actions/setup-node@v3
|
||||
with:
|
||||
node-version: 18
|
||||
- run: npm install --global spellchecker-cli
|
||||
- run: make docs-lint
|
||||
@@ -275,3 +275,7 @@ e2e-exec: ginkgo
|
||||
|
||||
e2e-destroy:
|
||||
kind delete cluster --name capsule
|
||||
|
||||
docs-lint:
|
||||
cd docs/content && spellchecker *.md */*.md -d dictionary.txt
|
||||
|
||||
|
||||
@@ -257,7 +257,7 @@ $ rm -f _tls.cnf
|
||||
|
||||
By default, the webhooks will be registered with the services, which will route to the Pods, inside the cluster.
|
||||
|
||||
We need to _delegate_ the controllers' and webbooks' services to the code running in our IDE by patching the `MutatingWebhookConfiguration` and `ValidatingWebhookConfiguration`.
|
||||
We need to _delegate_ the controllers' and webhooks' services to the code running in our IDE by patching the `MutatingWebhookConfiguration` and `ValidatingWebhookConfiguration`.
|
||||
|
||||
```shell
|
||||
# Export your laptop's IP with the 9443 port exposed by controllers/webhooks' services
|
||||
|
||||
@@ -0,0 +1,217 @@
|
||||
ACL-filtered
|
||||
APIs
|
||||
Apache2
|
||||
Authenticator
|
||||
BYOD
|
||||
CLI
|
||||
CRD
|
||||
CRDs
|
||||
CRs
|
||||
CTO
|
||||
CVE-2021-25735
|
||||
CaaS
|
||||
CapsuleConfiguration
|
||||
CapsuleConfigurationSpec
|
||||
ClusterIP
|
||||
ClusterRole
|
||||
ClusterRoles
|
||||
ConfigMap
|
||||
Dependant
|
||||
Env
|
||||
ExternalName
|
||||
GitOps
|
||||
GitOps-ready
|
||||
GitOps-way
|
||||
GlobalTenantResource
|
||||
GlobalTenantResourceSpec
|
||||
GlobalTenantResourceStatus
|
||||
Golang
|
||||
Grafana
|
||||
HTTPS
|
||||
HostNetwork
|
||||
HostPort
|
||||
Hostname
|
||||
Hostnames
|
||||
IPBlock
|
||||
IPC
|
||||
IPs
|
||||
IngressClass
|
||||
IngressClasses
|
||||
JSON
|
||||
JWT
|
||||
Keycloak
|
||||
Kubebuilder
|
||||
Kubeconfig
|
||||
Kubernetes
|
||||
Kubernetes-native
|
||||
Kustomization
|
||||
Kustomization.
|
||||
Kustomizations
|
||||
Kustomize
|
||||
LimitRangeItem
|
||||
LimitRangeSpec
|
||||
LimitRanger
|
||||
LoadBalance
|
||||
LoadBalancer
|
||||
MTB
|
||||
MTB.
|
||||
Miscellanea
|
||||
MutatingAdmissionWebhook
|
||||
MutatingWebhookConfiguration
|
||||
Namespace
|
||||
Namespace-as-a-Service
|
||||
Namespace-level
|
||||
NamespaceSelector
|
||||
Namespaced-scope
|
||||
Namespaces
|
||||
NetworkPolicies
|
||||
NetworkPolicy
|
||||
NetworkPolicyEgressRule
|
||||
NetworkPolicyIngressRule
|
||||
NetworkPolicyPeer
|
||||
NetworkPolicyPort
|
||||
NetworkPolicySpec
|
||||
NetworkPolicySpec's
|
||||
NodePort
|
||||
NodeSelector
|
||||
OAuth
|
||||
OIDC
|
||||
OSS
|
||||
OpenSSL
|
||||
OwnerSpec
|
||||
PID
|
||||
PRs
|
||||
PV
|
||||
PVCs
|
||||
PVs
|
||||
PersistentVolume
|
||||
PersistentVolumeClaim
|
||||
PodNodeSelector
|
||||
PodSecurityPolicies
|
||||
PodSecurityPolicy
|
||||
PriorityClass
|
||||
PriorityClasses
|
||||
PromQL
|
||||
ProxySetting
|
||||
PullPolicy
|
||||
QoS
|
||||
RBAC
|
||||
README
|
||||
Reconciler
|
||||
Reconciler's
|
||||
ResourceQuota
|
||||
ResourceQuotaSpec
|
||||
Roadmap
|
||||
RoleBinding
|
||||
RuntimeClass
|
||||
RuntimeClasses
|
||||
SDK
|
||||
SRE
|
||||
SSD
|
||||
ScopeSelectorOperator
|
||||
ServiceAccount
|
||||
ServiceAccounts
|
||||
ServiceMonitor
|
||||
StorageClass
|
||||
StorageClasses
|
||||
TLS
|
||||
TLS-terminated
|
||||
TenantResource
|
||||
TenantResourceSpec
|
||||
TenantResourceStatus
|
||||
TenantSpec
|
||||
TenantStatus
|
||||
UI
|
||||
Uncordoning
|
||||
ValidatingAdmissionWebhook
|
||||
ValidatingWebhookConfiguration
|
||||
Velero
|
||||
Viceversa
|
||||
WG
|
||||
Webhook
|
||||
Webhooks
|
||||
Workqueue
|
||||
YAML
|
||||
additively
|
||||
backend
|
||||
balancers
|
||||
behaviour
|
||||
capsuleconfiguration
|
||||
clusterrole
|
||||
clusterrolebinding
|
||||
config
|
||||
cross-Namespace
|
||||
cross-namespace
|
||||
customizations
|
||||
datasource
|
||||
deletecollection
|
||||
e2e
|
||||
eg
|
||||
eg.
|
||||
endpointslice
|
||||
enum
|
||||
enums
|
||||
env
|
||||
etcd
|
||||
fastly
|
||||
favourite
|
||||
flux2-capsule-multi-tenancy
|
||||
flux2-multi-tenancy
|
||||
gitops-reconciler-kubeconfig
|
||||
goimports
|
||||
golangci-lint
|
||||
golint
|
||||
hostname
|
||||
hostnames
|
||||
imagePullPolicy
|
||||
init-time
|
||||
ipBlock
|
||||
k3d
|
||||
keycloak
|
||||
kubeconfig
|
||||
kubectl
|
||||
kubernetes
|
||||
kustomize
|
||||
labelled
|
||||
latencies
|
||||
lifecycle
|
||||
linters
|
||||
linux
|
||||
lockdown
|
||||
microservice
|
||||
multitenant
|
||||
naas
|
||||
namespace
|
||||
namespace-owner-reference
|
||||
namespaceSelector
|
||||
namespaced
|
||||
namespaces
|
||||
neighbour
|
||||
networkpolicies
|
||||
networkpolicy
|
||||
ngrok
|
||||
no-naas
|
||||
non-namespaced
|
||||
oauth2-proxy
|
||||
onboarded
|
||||
persistentvolumeclaims
|
||||
podSelector
|
||||
prepended
|
||||
priorityClasses
|
||||
radiuses
|
||||
reconcilers
|
||||
repo
|
||||
resync
|
||||
roadmap
|
||||
rolebinding
|
||||
rolebindings
|
||||
scopeSelector
|
||||
serviceaccount
|
||||
stateful
|
||||
uid
|
||||
unsetting
|
||||
v1alpha1
|
||||
v2
|
||||
webhook
|
||||
webhooks
|
||||
wontfix
|
||||
@@ -2131,7 +2131,7 @@ kubectl --kubeconfig alice create ns oil-production
|
||||
kubectl --kubeconfig alice config set-context --current --namespace oil-production
|
||||
```
|
||||
|
||||
As tenant owner, creates a Persistent Volum Claim in the tenant namespace missing the Storage Class or using any other Storage Class:
|
||||
As tenant owner, creates a Persistent Volume Claim in the tenant namespace missing the Storage Class or using any other Storage Class:
|
||||
|
||||
```yaml
|
||||
kubectl --kubeconfig alice apply -f - << EOF
|
||||
|
||||
@@ -1,6 +1,6 @@
|
||||
# Capsule Proxy
|
||||
|
||||
Capsule Proxy is an add-on for Capsule Operator addressing some RBAC issues when enabling multi-tenacy in Kubernetes since users cannot list the owned cluster-scoped resources.
|
||||
Capsule Proxy is an add-on for Capsule Operator addressing some RBAC issues when enabling multi-tenancy in Kubernetes since users cannot list the owned cluster-scoped resources.
|
||||
|
||||
Kubernetes RBAC cannot list only the owned cluster-scoped resources since there are no ACL-filtered APIs. For example:
|
||||
|
||||
|
||||
@@ -1603,7 +1603,7 @@ spec:
|
||||
> This feature is still in an alpha stage and requires a high amount of computing resources due to the dynamic client requests.
|
||||
|
||||
## Assign Additional Metadata
|
||||
The cluster admin can _"taint"_ the namespaces created by tenant onwers with additional metadata as labels and annotations. There is no specific semantic assigned to these labels and annotations: they will be assigned to the namespaces in the tenant as they are created. This can help the cluster admin to implement specific use cases as, for example, leave only a given tenant to be backuped by a backup service.
|
||||
The cluster admin can _"taint"_ the namespaces created by tenant owners with additional metadata as labels and annotations. There is no specific semantic assigned to these labels and annotations: they will be assigned to the namespaces in the tenant as they are created. This can help the cluster admin to implement specific use cases as, for example, leave only a given tenant to be backed up by a backup service.
|
||||
|
||||
Assigns additional labels and annotations to all namespaces created in the `oil` tenant:
|
||||
|
||||
|
||||
@@ -4,17 +4,17 @@ This guide is intended to cover how to use Flux v2 with [multi-tenancy lockdown
|
||||
|
||||
### Flux and multi-tenancy
|
||||
|
||||
Flux v2 released a [set of features](https://fluxcd.io/blog/2022/05/may-2022-security-announcement/#whats-next-for-flux) that further increasesed security for multi-tenancy scenarios.
|
||||
Flux v2 released a [set of features](https://fluxcd.io/blog/2022/05/may-2022-security-announcement/#whats-next-for-flux) that further increased security for multi-tenancy scenarios.
|
||||
|
||||
These features enable you to:
|
||||
- disable cross-Namespace reference of Source CRs from Reconciliation CRs and Notification CRs. This way, especially for tenants, they can't access resources outside their space. This can be achieved with `--no-cross-namespace-refs=true` option of kustomize, helm, notification, image-reflector, image-automation controllers.
|
||||
- set a default `ServiceAccount` impersonation for Reconciliation CRs. This is supposed to be an unprivileged SA that reconciles just the tenant's desired state. This will be enforced when is not otherwise specified explicitely in Reconciliation CR spec. This can be enforced with the `--default-service-account=<name>` option of helm and kustomize controllers.
|
||||
- set a default `ServiceAccount` impersonation for Reconciliation CRs. This is supposed to be an unprivileged SA that reconciles just the tenant's desired state. This will be enforced when is not otherwise specified explicitly in Reconciliation CR spec. This can be enforced with the `--default-service-account=<name>` option of helm and kustomize controllers.
|
||||
|
||||
> For this responsibility we identify a Tenant GitOps Reconciler identity, which is a ServiceAccount and it's also the tenant owner (more on tenants and owners later on, with Capsule).
|
||||
|
||||
- disallow remote bases for Kustomizations. Actually, this is not stryctly required, but it decreases the risk of referencing Kustomizations which aren't part of the controlled GitOps pipelines. In a multi-tenant scenario this is important too. They can be disabled with `--no-remote-bases=true` option of the kustomize controller.
|
||||
- disallow remote bases for Kustomizations. Actually, this is not strictly required, but it decreases the risk of referencing Kustomizations which aren't part of the controlled GitOps pipelines. In a multi-tenant scenario this is important too. They can be disabled with `--no-remote-bases=true` option of the kustomize controller.
|
||||
|
||||
Where required, to ensure privileged Reconciliation resources have the needed privileges to be reconciled, we can explicitely set a privileged `ServiceAccount`s.
|
||||
Where required, to ensure privileged Reconciliation resources have the needed privileges to be reconciled, we can explicitly set a privileged `ServiceAccount`s.
|
||||
|
||||
In any case, is required that the `ServiceAccount` is in the same `Namespace` of the `Kustomization`, so unprivileged spaces should not have privileged `ServiceAccount`s available.
|
||||
|
||||
@@ -385,7 +385,7 @@ The reconciliation requests will pass through Capsule Proxy as Tenant GitOps Rec
|
||||
|
||||
## Full setup
|
||||
|
||||
To have a glimp on a full setup you can follow the [flux2-capsule-multi-tenancy](https://github.com/clastix/flux2-capsule-multi-tenancy.git) repository.
|
||||
To have a glimpse on a full setup you can follow the [flux2-capsule-multi-tenancy](https://github.com/clastix/flux2-capsule-multi-tenancy.git) repository.
|
||||
For simplicity, the system and tenants declarations are on the same repository but on dedicated git branches.
|
||||
|
||||
It's a fork of [flux2-multi-tenancy](https://github.com/fluxcd/flux2-multi-tenancy.git) but with the integration we saw with Capsule.
|
||||
|
||||
@@ -41,7 +41,7 @@ EOF
|
||||
> Values used for the config:
|
||||
>
|
||||
> - **OIDC_CLIENT_ID**: the keycloak client ID (name) which user in Kubernetes API Server for authorization
|
||||
> - **OIDC_CLIENT_SECRET**: secret for the client (`OIDC_CLIENT_ID`). You can see it from the Keycloack UI -> Clients -> `OIDC_CLIENT_ID` -> Credentials
|
||||
> - **OIDC_CLIENT_SECRET**: secret for the client (`OIDC_CLIENT_ID`). You can see it from the Keycloak UI -> Clients -> `OIDC_CLIENT_ID` -> Credentials
|
||||
> - **DASHBOARD_URL**: the Kubernetes Dashboard URL
|
||||
> - **KEYCLOAK_URL**: the Keycloak URL
|
||||
|
||||
|
||||
@@ -1,5 +1,5 @@
|
||||
# OIDC Authentication
|
||||
Capsule does not care about the authentication strategy used in the cluster and all the Kubernetes methods of authentication are supported. The only requirement to use Capsule is to assign tenant users to the the group defined by `userGroups` option in the `CapsuleConfiguration`, which defaults to `capsule.clastix.io`.
|
||||
Capsule does not care about the authentication strategy used in the cluster and all the Kubernetes methods of authentication are supported. The only requirement to use Capsule is to assign tenant users to the group defined by `userGroups` option in the `CapsuleConfiguration`, which defaults to `capsule.clastix.io`.
|
||||
|
||||
In the following guide, we'll use [Keycloak](https://www.keycloak.org/) an Open Source Identity and Access Management server capable to authenticate users via OIDC and release JWT tokens as proof of authentication.
|
||||
|
||||
|
||||
@@ -1,5 +1,5 @@
|
||||
# Pod Security
|
||||
In Kubernetes, by default, workloads run with administrative access, which might be acceptable if there is only a single application running in the cluster or a single user accessing it. This is seldomly required and you’ll consequently suffer a noisy neighbour effect along with large security blast radiuses.
|
||||
In Kubernetes, by default, workloads run with administrative access, which might be acceptable if there is only a single application running in the cluster or a single user accessing it. This is seldom required and you’ll consequently suffer a noisy neighbour effect along with large security blast radiuses.
|
||||
|
||||
Many of these concerns were addressed initially by [PodSecurityPolicies](https://kubernetes.io/docs/concepts/security/pod-security-policy) which have been present in the Kubernetes APIs since the very early days.
|
||||
|
||||
@@ -115,9 +115,9 @@ EOF
|
||||
Since the assigned `PodSecurityPolicy` explicitly disallows privileged containers, the tenant owner will see her request to be rejected by the Pod Security Policy Admission Controller.
|
||||
|
||||
## Pod Security Standards
|
||||
One of the issues with Pod Secury Policies is that it is difficult to apply restrictive permissions on a granular level, increasing security risk. Also the Pod Security Policies get applied when the request is submitted and there is no way of applying them to pods that are already running. For these, and other reasons, the Kubernetes community decided to deprecate the Pod Secury Policies.
|
||||
One of the issues with Pod Security Policies is that it is difficult to apply restrictive permissions on a granular level, increasing security risk. Also the Pod Security Policies get applied when the request is submitted and there is no way of applying them to pods that are already running. For these, and other reasons, the Kubernetes community decided to deprecate the Pod Security Policies.
|
||||
|
||||
As the Pod Secury Policies get deprecated and removed, the [Pod Security Standards](https://kubernetes.io/docs/concepts/security/pod-security-standards/) is used in place. It defines three different policies to broadly cover the security spectrum. These policies are cumulative and range from highly-permissive to highly-restrictive:
|
||||
As the Pod Security Policies get deprecated and removed, the [Pod Security Standards](https://kubernetes.io/docs/concepts/security/pod-security-standards/) is used in place. It defines three different policies to broadly cover the security spectrum. These policies are cumulative and range from highly-permissive to highly-restrictive:
|
||||
|
||||
- **Privileged**: unrestricted policy, providing the widest possible level of permissions.
|
||||
- **Baseline**: minimally restrictive policy which prevents known privilege escalations.
|
||||
|
||||
Reference in New Issue
Block a user