You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: docs/vendor/replicated-sdk-customizing.md
+14-18Lines changed: 14 additions & 18 deletions
Original file line number
Diff line number
Diff line change
@@ -8,13 +8,9 @@ For information about how to use a custom domain for the Replicated SDK image, s
8
8
9
9
This section describes role-based access control (RBAC) for the Replicated SDK, including the default RBAC, minimum RBAC requirements, and how to install the SDK with custom RBAC.
10
10
11
-
It also describes how to enable the `replicated.minimalRBAC` field to use a less-permissive default RBAC role for the Replicated SDK version 1.7.0 and later.
12
-
13
11
### Default RBAC
14
12
15
-
This section describes the default RBAC role that is created for the Replicated SDK when the `replicated.minimalRBAC` field is false.
16
-
17
-
The SDK creates default Role, RoleBinding, and ServiceAccount objects during installation. The default Role allows the SDK to get, list, and watch all resources in the namespace, to create Secrets, and to update the `replicated`, `replicated-instance-report`, `replicated-custom-app-metrics-report`, and `replicated-meta-data` Secrets:
13
+
The SDK creates default Role, RoleBinding, and ServiceAccount objects during installation. When `replicated.minimalRBAC` is false, the default Role allows the SDK to get, list, and watch all resources in the namespace, to create Secrets, and to update the `replicated`, `replicated-instance-report`, `replicated-custom-app-metrics-report`, and `replicated-meta-data` Secrets:
18
14
19
15
```yaml
20
16
apiVersion: rbac.authorization.k8s.io/v1
@@ -51,21 +47,21 @@ rules:
51
47
52
48
### Minimal RBAC
53
49
54
-
This section describes the default RBAC role that is created for the Replicated SDK when the `replicated.minimalRBAC` field is true in version 1.7.0 and later.
50
+
With the Replicated SDK version 1.7.0 and later, you can enable a fully-featured but less permissive RBAC role by setting `minimalRBAC` to true.
55
51
56
-
The permissions included in the default `minimalRBAC` Role vary depending on if you defined custom _status informers_ for your application. See one of the following sections for more information:
57
-
* [Default `minimalRBAC` Role Without Custom Status Informers](#default-no-status-informers)
58
-
* [Default `minimalRBAC` Role With Custom Status Informers](#default-status-informers)
52
+
The permissions included in the Minimal RBAC role vary depending on if you defined custom _status informers_ for your application. See one of the following sections for more information:
53
+
* [Default Minimal RBAC Role Without Custom Status Informers](#default-no-status-informers)
54
+
* [Default Minimal RBAC Role With Custom Status Informers](#default-status-informers)
59
55
60
56
<details>
61
57
<summary>What are status informers?</summary>
62
58
63
59
The Replicated Vendor Portal uses status informers to provide application status data. For more information about status informers, see [Helm Installations](/vendor/insights-app-status#helm-installations) in _Enabling and Understanding Application Status_.
64
60
</details>
65
61
66
-
#### Default `minimalRBAC` Role Without Custom Status Informers {#default-no-status-informers}
62
+
#### Default Minimal RBAC Role Without Custom Status Informers {#default-no-status-informers}
67
63
68
-
If you did _not_ define custom status informers for your application, then the default `minimalRBAC` Role includes permissions for the SDK to `get`, `list`, and `watch` the following resources in the namespace:
64
+
If you did _not_ define custom status informers for your application, then the default minimal RBAC Role includes permissions for the SDK to `get`, `list`, and `watch` the following resources in the namespace:
69
65
* Secrets
70
66
* Deployments
71
67
* StatefulSets
@@ -79,7 +75,7 @@ If you did _not_ define custom status informers for your application, then the d
79
75
80
76
These permissions allow the SDK to discover the Helm chart secret for your application, parse it to determine what resources to monitor, and then monitor those resources.
81
77
82
-
To enable `minimalRBAC`, set the value in your Helm chart as shown below:
78
+
To enable Minimal RBAC, set the value in your Helm chart as shown below:
83
79
84
80
```yaml
85
81
# Helm chart values.yaml
@@ -88,7 +84,7 @@ replicated:
88
84
minimalRBAC: true
89
85
```
90
86
91
-
The following shows the default RBAC role for the SDK when `minimalRBAC` is enabled and no customer status informers are defined:
87
+
The following shows the default RBAC role for the SDK when Minimal RBAC is enabled and no customer status informers are defined:
92
88
93
89
```yaml
94
90
# Generated RBAC role with no statusInformers
@@ -187,9 +183,9 @@ rules:
187
183
- list
188
184
```
189
185
190
-
#### Default `minimalRBAC` Role With Custom Status Informers {#default-status-informers}
186
+
#### Default Minimal RBAC Role With Custom Status Informers {#default-status-informers}
191
187
192
-
If you defined custom status informers for your application, then the default `minimalRBAC` role is _not_ created with the ability to access all secrets, and other resources are specified by name when possible.
188
+
If you defined custom status informers for your application, then the default Minimal RBAC role is _not_ created with the ability to access all secrets, and other resources are specified by name when possible.
193
189
194
190
For example, the following custom `statusInformer` configuration defines specific Deployment and Service resources as status informers for the application:
195
191
@@ -205,7 +201,7 @@ replicated:
205
201
- service/myapp
206
202
```
207
203
208
-
Given the custom `statusInformer` configuration above, the following `minimalRBAC` role is created:
204
+
Given the custom `statusInformer` configuration above, the following Minimal RBAC role is created:
209
205
210
206
```yaml
211
207
# Generated RBAC role with deployment/replicated, deployment/myapp, service/replicated and service/myapp statusinformers
@@ -298,11 +294,11 @@ rules:
298
294
299
295
### Install the SDK with Custom RBAC
300
296
301
-
This section describes how to install the SDK with custom RBAC permissions, include the minimum RBAC requirements for custom roles. To install with custom RBAC, you can use a custom ServiceAccount or a custom ClusterRole. See the sections below for more information.
297
+
To install with custom RBAC, you can use a custom ServiceAccount or a custom ClusterRole. See the sections below for more information.
302
298
303
299
#### Minimum RBAC Requirements
304
300
305
-
This section describes the minimum RBAC permissions required by the Replicated SDK. Any custom RBAC role that you create must include these permissions at minimum.
301
+
Any custom RBAC role that you create must include these permissions.
306
302
307
303
The SDK requires the following minimum RBAC permissions to start:
0 commit comments