Skip to content

Commit 5ec9c05

Browse files
committed
rewording more
1 parent 56abc91 commit 5ec9c05

File tree

1 file changed

+14
-18
lines changed

1 file changed

+14
-18
lines changed

docs/vendor/replicated-sdk-customizing.md

Lines changed: 14 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -8,13 +8,9 @@ For information about how to use a custom domain for the Replicated SDK image, s
88

99
This section describes role-based access control (RBAC) for the Replicated SDK, including the default RBAC, minimum RBAC requirements, and how to install the SDK with custom RBAC.
1010

11-
It also describes how to enable the `replicated.minimalRBAC` field to use a less-permissive default RBAC role for the Replicated SDK version 1.7.0 and later.
12-
1311
### Default RBAC
1412

15-
This section describes the default RBAC role that is created for the Replicated SDK when the `replicated.minimalRBAC` field is false.
16-
17-
The SDK creates default Role, RoleBinding, and ServiceAccount objects during installation. The default Role allows the SDK to get, list, and watch all resources in the namespace, to create Secrets, and to update the `replicated`, `replicated-instance-report`, `replicated-custom-app-metrics-report`, and `replicated-meta-data` Secrets:
13+
The SDK creates default Role, RoleBinding, and ServiceAccount objects during installation. When `replicated.minimalRBAC` is false, the default Role allows the SDK to get, list, and watch all resources in the namespace, to create Secrets, and to update the `replicated`, `replicated-instance-report`, `replicated-custom-app-metrics-report`, and `replicated-meta-data` Secrets:
1814

1915
```yaml
2016
apiVersion: rbac.authorization.k8s.io/v1
@@ -51,21 +47,21 @@ rules:
5147
5248
### Minimal RBAC
5349
54-
This section describes the default RBAC role that is created for the Replicated SDK when the `replicated.minimalRBAC` field is true in version 1.7.0 and later.
50+
With the Replicated SDK version 1.7.0 and later, you can enable a fully-featured but less permissive RBAC role by setting `minimalRBAC` to true.
5551

56-
The permissions included in the default `minimalRBAC` Role vary depending on if you defined custom _status informers_ for your application. See one of the following sections for more information:
57-
* [Default `minimalRBAC` Role Without Custom Status Informers](#default-no-status-informers)
58-
* [Default `minimalRBAC` Role With Custom Status Informers](#default-status-informers)
52+
The permissions included in the Minimal RBAC role vary depending on if you defined custom _status informers_ for your application. See one of the following sections for more information:
53+
* [Default Minimal RBAC Role Without Custom Status Informers](#default-no-status-informers)
54+
* [Default Minimal RBAC Role With Custom Status Informers](#default-status-informers)
5955

6056
<details>
6157
<summary>What are status informers?</summary>
6258

6359
The Replicated Vendor Portal uses status informers to provide application status data. For more information about status informers, see [Helm Installations](/vendor/insights-app-status#helm-installations) in _Enabling and Understanding Application Status_.
6460
</details>
6561

66-
#### Default `minimalRBAC` Role Without Custom Status Informers {#default-no-status-informers}
62+
#### Default Minimal RBAC Role Without Custom Status Informers {#default-no-status-informers}
6763

68-
If you did _not_ define custom status informers for your application, then the default `minimalRBAC` Role includes permissions for the SDK to `get`, `list`, and `watch` the following resources in the namespace:
64+
If you did _not_ define custom status informers for your application, then the default minimal RBAC Role includes permissions for the SDK to `get`, `list`, and `watch` the following resources in the namespace:
6965
* Secrets
7066
* Deployments
7167
* StatefulSets
@@ -79,7 +75,7 @@ If you did _not_ define custom status informers for your application, then the d
7975

8076
These permissions allow the SDK to discover the Helm chart secret for your application, parse it to determine what resources to monitor, and then monitor those resources.
8177

82-
To enable `minimalRBAC`, set the value in your Helm chart as shown below:
78+
To enable Minimal RBAC, set the value in your Helm chart as shown below:
8379

8480
```yaml
8581
# Helm chart values.yaml
@@ -88,7 +84,7 @@ replicated:
8884
minimalRBAC: true
8985
```
9086

91-
The following shows the default RBAC role for the SDK when `minimalRBAC` is enabled and no customer status informers are defined:
87+
The following shows the default RBAC role for the SDK when Minimal RBAC is enabled and no customer status informers are defined:
9288

9389
```yaml
9490
# Generated RBAC role with no statusInformers
@@ -187,9 +183,9 @@ rules:
187183
- list
188184
```
189185

190-
#### Default `minimalRBAC` Role With Custom Status Informers {#default-status-informers}
186+
#### Default Minimal RBAC Role With Custom Status Informers {#default-status-informers}
191187

192-
If you defined custom status informers for your application, then the default `minimalRBAC` role is _not_ created with the ability to access all secrets, and other resources are specified by name when possible.
188+
If you defined custom status informers for your application, then the default Minimal RBAC role is _not_ created with the ability to access all secrets, and other resources are specified by name when possible.
193189

194190
For example, the following custom `statusInformer` configuration defines specific Deployment and Service resources as status informers for the application:
195191

@@ -205,7 +201,7 @@ replicated:
205201
- service/myapp
206202
```
207203

208-
Given the custom `statusInformer` configuration above, the following `minimalRBAC` role is created:
204+
Given the custom `statusInformer` configuration above, the following Minimal RBAC role is created:
209205

210206
```yaml
211207
# Generated RBAC role with deployment/replicated, deployment/myapp, service/replicated and service/myapp statusinformers
@@ -298,11 +294,11 @@ rules:
298294

299295
### Install the SDK with Custom RBAC
300296

301-
This section describes how to install the SDK with custom RBAC permissions, include the minimum RBAC requirements for custom roles. To install with custom RBAC, you can use a custom ServiceAccount or a custom ClusterRole. See the sections below for more information.
297+
To install with custom RBAC, you can use a custom ServiceAccount or a custom ClusterRole. See the sections below for more information.
302298

303299
#### Minimum RBAC Requirements
304300

305-
This section describes the minimum RBAC permissions required by the Replicated SDK. Any custom RBAC role that you create must include these permissions at minimum.
301+
Any custom RBAC role that you create must include these permissions.
306302

307303
The SDK requires the following minimum RBAC permissions to start:
308304
* Create Secrets.

0 commit comments

Comments
 (0)