mirror of
https://github.com/FairwindsOps/polaris.git
synced 2026-08-23 22:26:34 +00:00
1 line
4.0 KiB
JavaScript
1 line
4.0 KiB
JavaScript
(window.webpackJsonp=window.webpackJsonp||[]).push([[9],{365:function(a,t,e){"use strict";e.r(t);var s=e(42),o=Object(s.a)({},(function(){var a=this,t=a.$createElement,e=a._self._c||t;return e("ContentSlotsDistributor",{attrs:{"slot-key":a.$parent.slotKey}},[e("h1",{attrs:{id:"admission-controller"}},[e("a",{staticClass:"header-anchor",attrs:{href:"#admission-controller"}},[a._v("#")]),a._v(" Admission Controller")]),a._v(" "),e("p",[a._v("Polaris can be run as an admission controller that acts as a validating webhook.\nThis accepts the same configuration as the dashboard, and can run the same validations.")]),a._v(" "),e("p",[a._v("The webhook will reject any workloads that trigger a danger-level check.\nThis is indicative of the greater goal of Polaris, not just to encourage better\nconfiguration through dashboard visibility, but to actually enforce it with this webhook.")]),a._v(" "),e("p",[a._v("Note that Polaris will not alter your workloads, only block workloads that don't conform to the configured policies.")]),a._v(" "),e("h2",{attrs:{id:"installation"}},[e("a",{staticClass:"header-anchor",attrs:{href:"#installation"}},[a._v("#")]),a._v(" Installation")]),a._v(" "),e("p",[a._v("A valid TLS certificate is required for the Polaris Validating Webhook. If you have cert-manager installed in your cluster then the install methods below will work.")]),a._v(" "),e("p",[a._v("If you don't use cert-manager, you'll need to:")]),a._v(" "),e("ul",[e("li",[a._v("Supply a CA Bundle with the "),e("code",[a._v("webhook.caBundle")])]),a._v(" "),e("li",[a._v("Create a TLS secret in your cluster with a valid certificate that uses that CA")]),a._v(" "),e("li",[a._v("Pass the name of that secret with the webhook.secretName parameter.")])]),a._v(" "),e("h3",{attrs:{id:"kubectl"}},[e("a",{staticClass:"header-anchor",attrs:{href:"#kubectl"}},[a._v("#")]),a._v(" kubectl")]),a._v(" "),e("div",{staticClass:"language-bash extra-class"},[e("pre",{pre:!0,attrs:{class:"language-bash"}},[e("code",[a._v("kubectl apply -f https://github.com/fairwindsops/polaris/releases/latest/download/webhook.yaml\n")])])]),e("h3",{attrs:{id:"helm"}},[e("a",{staticClass:"header-anchor",attrs:{href:"#helm"}},[a._v("#")]),a._v(" Helm")]),a._v(" "),e("div",{staticClass:"language-bash extra-class"},[e("pre",{pre:!0,attrs:{class:"language-bash"}},[e("code",[a._v("helm repo "),e("span",{pre:!0,attrs:{class:"token function"}},[a._v("add")]),a._v(" fairwinds-stable https://charts.fairwinds.com/stable\nhelm upgrade --install polaris fairwinds-stable/polaris --namespace polaris "),e("span",{pre:!0,attrs:{class:"token punctuation"}},[a._v("\\")]),a._v("\n --set webhook.enable"),e("span",{pre:!0,attrs:{class:"token operator"}},[a._v("=")]),a._v("true --set dashboard.enable"),e("span",{pre:!0,attrs:{class:"token operator"}},[a._v("=")]),a._v("false\n")])])]),e("h2",{attrs:{id:"workload-types"}},[e("a",{staticClass:"header-anchor",attrs:{href:"#workload-types"}},[a._v("#")]),a._v(" Workload Types")]),a._v(" "),e("p",[a._v("The webhook comes with built-in support for a handful of known controller types,\nsuch as Deployments, Jobs, and DaemonSets. To add new controller types,\nyou can set "),e("code",[a._v("webhook.rules")]),a._v(" in the\n"),e("a",{attrs:{href:"https://github.com/FairwindsOps/charts/tree/master/stable/polaris",target:"_blank",rel:"noopener noreferrer"}},[a._v("Helm chart"),e("OutboundLink")],1)]),a._v(" "),e("h2",{attrs:{id:"warnings"}},[e("a",{staticClass:"header-anchor",attrs:{href:"#warnings"}},[a._v("#")]),a._v(" Warnings")]),a._v(" "),e("p",[a._v("Unfortunately we have not found a way to display warnings as part of "),e("code",[a._v("kubectl")]),a._v("\noutput unless we are rejecting a workload altogether.")]),a._v(" "),e("p",[a._v("This means that any checks with a severity of "),e("code",[a._v("warning")]),a._v(" will still pass webhook validation,\nand the only evidence of that warning will either be in the Polaris dashboard or the\nPolaris webhook logs. This will change in a future version of Kubernetes.")])])}),[],!1,null,null,null);t.default=o.exports}}]); |