From d096a25d6687af09e85b9b03587fd568d3542c5e Mon Sep 17 00:00:00 2001 From: Tisham Dhar Date: Thu, 24 Aug 2023 21:51:37 +0930 Subject: [PATCH] fix(docs): spellchecking in docs and typo fixes --- .github/workflows/docs-lint.yml | 27 +++ Makefile | 4 + docs/content/contributing/development.md | 2 +- docs/content/dictionary.txt | 217 ++++++++++++++++++++ docs/content/general/mtb.md | 2 +- docs/content/general/proxy.md | 2 +- docs/content/general/tutorial.md | 2 +- docs/content/guides/flux2-capsule.md | 10 +- docs/content/guides/kubernetes-dashboard.md | 2 +- docs/content/guides/oidc-auth.md | 2 +- docs/content/guides/pod-security.md | 6 +- 11 files changed, 262 insertions(+), 14 deletions(-) create mode 100644 .github/workflows/docs-lint.yml create mode 100644 docs/content/dictionary.txt diff --git a/.github/workflows/docs-lint.yml b/.github/workflows/docs-lint.yml new file mode 100644 index 00000000..4e02e110 --- /dev/null +++ b/.github/workflows/docs-lint.yml @@ -0,0 +1,27 @@ +name: docs-lint + +on: + push: + branches: [ "*" ] + paths: + - '.github/workflows/docs-lint.yml' + - 'docs/content/**' + pull_request: + branches: [ "*" ] + paths: + - '.github/workflows/docs-lint.yml' + - 'docs/content/**' + +jobs: + spelling: + name: Spell Check + runs-on: ubuntu-20.04 + steps: + - uses: actions/checkout@v2 + with: + fetch-depth: 0 + - uses: actions/setup-node@v3 + with: + node-version: 18 + - run: npm install --global spellchecker-cli + - run: make docs-lint \ No newline at end of file diff --git a/Makefile b/Makefile index 892b2b0f..859d5b34 100644 --- a/Makefile +++ b/Makefile @@ -275,3 +275,7 @@ e2e-exec: ginkgo e2e-destroy: kind delete cluster --name capsule + +docs-lint: + cd docs/content && spellchecker *.md */*.md -d dictionary.txt + diff --git a/docs/content/contributing/development.md b/docs/content/contributing/development.md index c0a9c926..e56ff8f5 100644 --- a/docs/content/contributing/development.md +++ b/docs/content/contributing/development.md @@ -257,7 +257,7 @@ $ rm -f _tls.cnf By default, the webhooks will be registered with the services, which will route to the Pods, inside the cluster. -We need to _delegate_ the controllers' and webbooks' services to the code running in our IDE by patching the `MutatingWebhookConfiguration` and `ValidatingWebhookConfiguration`. +We need to _delegate_ the controllers' and webhooks' services to the code running in our IDE by patching the `MutatingWebhookConfiguration` and `ValidatingWebhookConfiguration`. ```shell # Export your laptop's IP with the 9443 port exposed by controllers/webhooks' services diff --git a/docs/content/dictionary.txt b/docs/content/dictionary.txt new file mode 100644 index 00000000..75792e7e --- /dev/null +++ b/docs/content/dictionary.txt @@ -0,0 +1,217 @@ +ACL-filtered +APIs +Apache2 +Authenticator +BYOD +CLI +CRD +CRDs +CRs +CTO +CVE-2021-25735 +CaaS +CapsuleConfiguration +CapsuleConfigurationSpec +ClusterIP +ClusterRole +ClusterRoles +ConfigMap +Dependant +Env +ExternalName +GitOps +GitOps-ready +GitOps-way +GlobalTenantResource +GlobalTenantResourceSpec +GlobalTenantResourceStatus +Golang +Grafana +HTTPS +HostNetwork +HostPort +Hostname +Hostnames +IPBlock +IPC +IPs +IngressClass +IngressClasses +JSON +JWT +Keycloak +Kubebuilder +Kubeconfig +Kubernetes +Kubernetes-native +Kustomization +Kustomization. +Kustomizations +Kustomize +LimitRangeItem +LimitRangeSpec +LimitRanger +LoadBalance +LoadBalancer +MTB +MTB. +Miscellanea +MutatingAdmissionWebhook +MutatingWebhookConfiguration +Namespace +Namespace-as-a-Service +Namespace-level +NamespaceSelector +Namespaced-scope +Namespaces +NetworkPolicies +NetworkPolicy +NetworkPolicyEgressRule +NetworkPolicyIngressRule +NetworkPolicyPeer +NetworkPolicyPort +NetworkPolicySpec +NetworkPolicySpec's +NodePort +NodeSelector +OAuth +OIDC +OSS +OpenSSL +OwnerSpec +PID +PRs +PV +PVCs +PVs +PersistentVolume +PersistentVolumeClaim +PodNodeSelector +PodSecurityPolicies +PodSecurityPolicy +PriorityClass +PriorityClasses +PromQL +ProxySetting +PullPolicy +QoS +RBAC +README +Reconciler +Reconciler's +ResourceQuota +ResourceQuotaSpec +Roadmap +RoleBinding +RuntimeClass +RuntimeClasses +SDK +SRE +SSD +ScopeSelectorOperator +ServiceAccount +ServiceAccounts +ServiceMonitor +StorageClass +StorageClasses +TLS +TLS-terminated +TenantResource +TenantResourceSpec +TenantResourceStatus +TenantSpec +TenantStatus +UI +Uncordoning +ValidatingAdmissionWebhook +ValidatingWebhookConfiguration +Velero +Viceversa +WG +Webhook +Webhooks +Workqueue +YAML +additively +backend +balancers +behaviour +capsuleconfiguration +clusterrole +clusterrolebinding +config +cross-Namespace +cross-namespace +customizations +datasource +deletecollection +e2e +eg +eg. +endpointslice +enum +enums +env +etcd +fastly +favourite +flux2-capsule-multi-tenancy +flux2-multi-tenancy +gitops-reconciler-kubeconfig +goimports +golangci-lint +golint +hostname +hostnames +imagePullPolicy +init-time +ipBlock +k3d +keycloak +kubeconfig +kubectl +kubernetes +kustomize +labelled +latencies +lifecycle +linters +linux +lockdown +microservice +multitenant +naas +namespace +namespace-owner-reference +namespaceSelector +namespaced +namespaces +neighbour +networkpolicies +networkpolicy +ngrok +no-naas +non-namespaced +oauth2-proxy +onboarded +persistentvolumeclaims +podSelector +prepended +priorityClasses +radiuses +reconcilers +repo +resync +roadmap +rolebinding +rolebindings +scopeSelector +serviceaccount +stateful +uid +unsetting +v1alpha1 +v2 +webhook +webhooks +wontfix diff --git a/docs/content/general/mtb.md b/docs/content/general/mtb.md index 2d491b57..edf8368f 100644 --- a/docs/content/general/mtb.md +++ b/docs/content/general/mtb.md @@ -2131,7 +2131,7 @@ kubectl --kubeconfig alice create ns oil-production kubectl --kubeconfig alice config set-context --current --namespace oil-production ``` -As tenant owner, creates a Persistent Volum Claim in the tenant namespace missing the Storage Class or using any other Storage Class: +As tenant owner, creates a Persistent Volume Claim in the tenant namespace missing the Storage Class or using any other Storage Class: ```yaml kubectl --kubeconfig alice apply -f - << EOF diff --git a/docs/content/general/proxy.md b/docs/content/general/proxy.md index 0ff70939..246a2193 100644 --- a/docs/content/general/proxy.md +++ b/docs/content/general/proxy.md @@ -1,6 +1,6 @@ # Capsule Proxy -Capsule Proxy is an add-on for Capsule Operator addressing some RBAC issues when enabling multi-tenacy in Kubernetes since users cannot list the owned cluster-scoped resources. +Capsule Proxy is an add-on for Capsule Operator addressing some RBAC issues when enabling multi-tenancy in Kubernetes since users cannot list the owned cluster-scoped resources. Kubernetes RBAC cannot list only the owned cluster-scoped resources since there are no ACL-filtered APIs. For example: diff --git a/docs/content/general/tutorial.md b/docs/content/general/tutorial.md index 2f7ab06b..a182ecd0 100644 --- a/docs/content/general/tutorial.md +++ b/docs/content/general/tutorial.md @@ -1603,7 +1603,7 @@ spec: > This feature is still in an alpha stage and requires a high amount of computing resources due to the dynamic client requests. ## Assign Additional Metadata -The cluster admin can _"taint"_ the namespaces created by tenant onwers with additional metadata as labels and annotations. There is no specific semantic assigned to these labels and annotations: they will be assigned to the namespaces in the tenant as they are created. This can help the cluster admin to implement specific use cases as, for example, leave only a given tenant to be backuped by a backup service. +The cluster admin can _"taint"_ the namespaces created by tenant owners with additional metadata as labels and annotations. There is no specific semantic assigned to these labels and annotations: they will be assigned to the namespaces in the tenant as they are created. This can help the cluster admin to implement specific use cases as, for example, leave only a given tenant to be backed up by a backup service. Assigns additional labels and annotations to all namespaces created in the `oil` tenant: diff --git a/docs/content/guides/flux2-capsule.md b/docs/content/guides/flux2-capsule.md index c06567ca..6aa9ca02 100644 --- a/docs/content/guides/flux2-capsule.md +++ b/docs/content/guides/flux2-capsule.md @@ -4,17 +4,17 @@ This guide is intended to cover how to use Flux v2 with [multi-tenancy lockdown ### Flux and multi-tenancy -Flux v2 released a [set of features](https://fluxcd.io/blog/2022/05/may-2022-security-announcement/#whats-next-for-flux) that further increasesed security for multi-tenancy scenarios. +Flux v2 released a [set of features](https://fluxcd.io/blog/2022/05/may-2022-security-announcement/#whats-next-for-flux) that further increased security for multi-tenancy scenarios. These features enable you to: - disable cross-Namespace reference of Source CRs from Reconciliation CRs and Notification CRs. This way, especially for tenants, they can't access resources outside their space. This can be achieved with `--no-cross-namespace-refs=true` option of kustomize, helm, notification, image-reflector, image-automation controllers. -- set a default `ServiceAccount` impersonation for Reconciliation CRs. This is supposed to be an unprivileged SA that reconciles just the tenant's desired state. This will be enforced when is not otherwise specified explicitely in Reconciliation CR spec. This can be enforced with the `--default-service-account=` option of helm and kustomize controllers. +- set a default `ServiceAccount` impersonation for Reconciliation CRs. This is supposed to be an unprivileged SA that reconciles just the tenant's desired state. This will be enforced when is not otherwise specified explicitly in Reconciliation CR spec. This can be enforced with the `--default-service-account=` option of helm and kustomize controllers. > For this responsibility we identify a Tenant GitOps Reconciler identity, which is a ServiceAccount and it's also the tenant owner (more on tenants and owners later on, with Capsule). -- disallow remote bases for Kustomizations. Actually, this is not stryctly required, but it decreases the risk of referencing Kustomizations which aren't part of the controlled GitOps pipelines. In a multi-tenant scenario this is important too. They can be disabled with `--no-remote-bases=true` option of the kustomize controller. +- disallow remote bases for Kustomizations. Actually, this is not strictly required, but it decreases the risk of referencing Kustomizations which aren't part of the controlled GitOps pipelines. In a multi-tenant scenario this is important too. They can be disabled with `--no-remote-bases=true` option of the kustomize controller. -Where required, to ensure privileged Reconciliation resources have the needed privileges to be reconciled, we can explicitely set a privileged `ServiceAccount`s. +Where required, to ensure privileged Reconciliation resources have the needed privileges to be reconciled, we can explicitly set a privileged `ServiceAccount`s. In any case, is required that the `ServiceAccount` is in the same `Namespace` of the `Kustomization`, so unprivileged spaces should not have privileged `ServiceAccount`s available. @@ -385,7 +385,7 @@ The reconciliation requests will pass through Capsule Proxy as Tenant GitOps Rec ## Full setup -To have a glimp on a full setup you can follow the [flux2-capsule-multi-tenancy](https://github.com/clastix/flux2-capsule-multi-tenancy.git) repository. +To have a glimpse on a full setup you can follow the [flux2-capsule-multi-tenancy](https://github.com/clastix/flux2-capsule-multi-tenancy.git) repository. For simplicity, the system and tenants declarations are on the same repository but on dedicated git branches. It's a fork of [flux2-multi-tenancy](https://github.com/fluxcd/flux2-multi-tenancy.git) but with the integration we saw with Capsule. diff --git a/docs/content/guides/kubernetes-dashboard.md b/docs/content/guides/kubernetes-dashboard.md index 567b109a..0f26c6f7 100644 --- a/docs/content/guides/kubernetes-dashboard.md +++ b/docs/content/guides/kubernetes-dashboard.md @@ -41,7 +41,7 @@ EOF > Values used for the config: > > - **OIDC_CLIENT_ID**: the keycloak client ID (name) which user in Kubernetes API Server for authorization -> - **OIDC_CLIENT_SECRET**: secret for the client (`OIDC_CLIENT_ID`). You can see it from the Keycloack UI -> Clients -> `OIDC_CLIENT_ID` -> Credentials +> - **OIDC_CLIENT_SECRET**: secret for the client (`OIDC_CLIENT_ID`). You can see it from the Keycloak UI -> Clients -> `OIDC_CLIENT_ID` -> Credentials > - **DASHBOARD_URL**: the Kubernetes Dashboard URL > - **KEYCLOAK_URL**: the Keycloak URL diff --git a/docs/content/guides/oidc-auth.md b/docs/content/guides/oidc-auth.md index 747ee508..c59041e8 100644 --- a/docs/content/guides/oidc-auth.md +++ b/docs/content/guides/oidc-auth.md @@ -1,5 +1,5 @@ # OIDC Authentication -Capsule does not care about the authentication strategy used in the cluster and all the Kubernetes methods of authentication are supported. The only requirement to use Capsule is to assign tenant users to the the group defined by `userGroups` option in the `CapsuleConfiguration`, which defaults to `capsule.clastix.io`. +Capsule does not care about the authentication strategy used in the cluster and all the Kubernetes methods of authentication are supported. The only requirement to use Capsule is to assign tenant users to the group defined by `userGroups` option in the `CapsuleConfiguration`, which defaults to `capsule.clastix.io`. In the following guide, we'll use [Keycloak](https://www.keycloak.org/) an Open Source Identity and Access Management server capable to authenticate users via OIDC and release JWT tokens as proof of authentication. diff --git a/docs/content/guides/pod-security.md b/docs/content/guides/pod-security.md index 28559a87..f6a6ac0c 100644 --- a/docs/content/guides/pod-security.md +++ b/docs/content/guides/pod-security.md @@ -1,5 +1,5 @@ # Pod Security -In Kubernetes, by default, workloads run with administrative access, which might be acceptable if there is only a single application running in the cluster or a single user accessing it. This is seldomly required and you’ll consequently suffer a noisy neighbour effect along with large security blast radiuses. +In Kubernetes, by default, workloads run with administrative access, which might be acceptable if there is only a single application running in the cluster or a single user accessing it. This is seldom required and you’ll consequently suffer a noisy neighbour effect along with large security blast radiuses. Many of these concerns were addressed initially by [PodSecurityPolicies](https://kubernetes.io/docs/concepts/security/pod-security-policy) which have been present in the Kubernetes APIs since the very early days. @@ -115,9 +115,9 @@ EOF Since the assigned `PodSecurityPolicy` explicitly disallows privileged containers, the tenant owner will see her request to be rejected by the Pod Security Policy Admission Controller. ## Pod Security Standards -One of the issues with Pod Secury Policies is that it is difficult to apply restrictive permissions on a granular level, increasing security risk. Also the Pod Security Policies get applied when the request is submitted and there is no way of applying them to pods that are already running. For these, and other reasons, the Kubernetes community decided to deprecate the Pod Secury Policies. +One of the issues with Pod Security Policies is that it is difficult to apply restrictive permissions on a granular level, increasing security risk. Also the Pod Security Policies get applied when the request is submitted and there is no way of applying them to pods that are already running. For these, and other reasons, the Kubernetes community decided to deprecate the Pod Security Policies. -As the Pod Secury Policies get deprecated and removed, the [Pod Security Standards](https://kubernetes.io/docs/concepts/security/pod-security-standards/) is used in place. It defines three different policies to broadly cover the security spectrum. These policies are cumulative and range from highly-permissive to highly-restrictive: +As the Pod Security Policies get deprecated and removed, the [Pod Security Standards](https://kubernetes.io/docs/concepts/security/pod-security-standards/) is used in place. It defines three different policies to broadly cover the security spectrum. These policies are cumulative and range from highly-permissive to highly-restrictive: - **Privileged**: unrestricted policy, providing the widest possible level of permissions. - **Baseline**: minimally restrictive policy which prevents known privilege escalations.