mirror of https://github.com/projectcapsule/capsule.git synced 2026-08-25 16:07:24 +00:00

Files

T

Don HighandDario Tranchitella 4f34483dee Documentation Spelling Mistakes #197 (#203 )

* Update README.md

Proof Read the README.md

* Update index.md

Proof Read index.md

* Update overview.md

Proof Read overview.md

* Update onboarding.md

Proof Read onboarding.md

* Update create-namespaces.md

Proof Read create-namespaces.md

* Update permissions.md

Proof Read permissons.md

* Update resources-quota-limits.md

Proof Read resources-quota-limits.md

* Update nodes-pool.md

Proof Read nodes-pool.md

* Update ingress-classes.md

Proof Read ingress-classes.md

* Update ingress-hostnames.md

Proof Read ingress-hostnames.md

* Update storage-classes.md

Proof Read storage-classes.md

* Update images-registries.md

Proof Read images-registries.md

* Update custom-resources.md

Proof Read custom-resources.md

* Update multiple-tenants.md

Proof Read multiple-tenants.md

* Update README.md

Updated the Suggested text

* Update README.md

Made the correction

* Update docs/operator/use-cases/images-registries.md

Co-authored-by: Don High <donghigh@yahoo.com>

Co-authored-by: Dario Tranchitella <dario@tranchitella.eu>

2021-02-19 11:40:20 +01:00

2.0 KiB

Raw Blame History

Assign Trusted Images Registries

Bill, the cluster admin, can set a strict policy on the applications running into Alice's tenant: he'd like to allow running just images hosted on a list of specific container registries.

The spec containerRegistries addresses this task and can provide combination with hard enforcement using a list of allowed values.

apiVersion: capsule.clastix.io/v1alpha1
kind: Tenant
metadata:
  name: oil
spec:
  owner:
    name: alice
    kind: User
  containerRegistries:
    allowed:
    - docker.io
    - quay.io
    allowedRegex: ''

In case of non FQDI (non fully qualified Docker image) and official images hosted on Docker Hub, Capsule is going to retrieve the registry even if it's not explicit: a busybox:latest Pod running on a Tenant allowing docker.io will not be blocked, even if the image field is not explicit as docker.io/busybox:latest.

Alternatively, use a valid regular expression for a maximum flexibility

apiVersion: capsule.clastix.io/v1alpha1
kind: Tenant
metadata:
  name: oil
spec:
  owner:
    name: alice
    kind: User
  containerRegistries:
    allowed: []
    regex: "internal.registry.\\w.tld"

A Pod running internal.registry.foo.tld as registry will be allowed, as well internal.registry.bar.tld since these are matching the regular expression.

You can also set a catch-all regex entry as .* to allow every kind of registry, that would be the same result of unsetting containerRegistries at all

As per Ingress and Storage classes the allowed registries can be inspected from the Tenant's namespace

alice@caas# kubectl describe ns oil-production
Name:         oil-production
Labels:       capsule.clastix.io/tenant=oil
Annotations:  capsule.clastix.io/allowed-registries: docker.io
              capsule.clastix.io/allowed-registries-regexp: ^registry\.internal\.\w+$
...

What’s next

See how Bill, the cluster admin, can assign Pod Security Policies to Alice's tenant. Assign Pod Security Policies.

2.0 KiB Raw Blame History Unescape Escape

Assign Trusted Images Registries

What’s next

2.0 KiB

Raw Blame History