2018-04-27 00:09:55 +00:00
2019-03-02 18:14:04 +00:00
<!doctype html>
2018-04-27 00:09:55 +00:00
< html lang = "en" class = "no-js" >
< head >
< meta charset = "utf-8" >
< meta name = "viewport" content = "width=device-width,initial-scale=1" >
2019-11-08 14:46:32 +00:00
< link rel = "canonical" href = "https://kubernetes.github.io/ingress-nginx/deploy/rbac/" >
2018-04-27 00:09:55 +00:00
< link rel = "shortcut icon" href = "../../assets/images/favicon.png" >
2020-04-15 17:09:38 +00:00
< meta name = "generator" content = "mkdocs-1.1, mkdocs-material-5.1.0" >
2018-04-27 00:09:55 +00:00
< title > Role Based Access Control (RBAC) - NGINX Ingress Controller< / title >
2020-04-15 17:09:38 +00:00
< link rel = "stylesheet" href = "../../assets/stylesheets/main.89dc9fe3.min.css" >
2018-04-27 00:09:55 +00:00
2020-04-15 17:09:38 +00:00
< link rel = "stylesheet" href = "../../assets/stylesheets/palette.ecd4686e.min.css" >
2018-04-27 00:09:55 +00:00
2018-07-13 23:53:25 +00:00
< meta name = "theme-color" content = "#009688" >
2018-04-27 00:09:55 +00:00
2018-09-13 23:54:10 +00:00
< link href = "https://fonts.gstatic.com" rel = "preconnect" crossorigin >
2020-02-09 23:53:05 +00:00
< link rel = "stylesheet" href = "https://fonts.googleapis.com/css?family=Roboto:300,400,400i,700%7CRoboto+Mono&display=fallback" >
2020-04-15 17:09:38 +00:00
< style > body , input { font-family : "Roboto" , - apple-system , BlinkMacSystemFont , Helvetica , Arial , sans-serif } code , kbd , pre { font-family : "Roboto Mono" , SFMono-Regular , Consolas , Menlo , monospace } < / style >
2018-04-27 00:09:55 +00:00
2018-12-04 15:07:57 +00:00
2018-04-27 12:02:43 +00:00
< link rel = "stylesheet" href = "../../extra.css" >
2018-04-27 00:09:55 +00:00
2019-03-02 18:14:04 +00:00
2020-04-15 17:09:38 +00:00
< link rel = "preconnect dns-prefetch" href = "https://www.google-analytics.com" >
< script > window . ga = window . ga || function ( ) { ( ga . q = ga . q || [ ] ) . push ( arguments ) } , ga . l = + new Date , ga ( "create" , "UA-118407822-1" , "kubernetes.github.io" ) , ga ( "set" , "anonymizeIp" , ! 0 ) , ga ( "send" , "pageview" ) , document . addEventListener ( "DOMContentLoaded" , function ( ) { document . forms . search && document . forms . search . query . addEventListener ( "blur" , function ( ) { if ( this . value ) { var e = document . location . pathname ; ga ( "send" , "pageview" , e + "?q=" + this . value ) } } ) } ) , document . addEventListener ( "DOMContentSwitch" , function ( ) { ga ( "send" , "pageview" ) } ) < / script >
2019-03-02 18:14:04 +00:00
< script async src = "https://www.google-analytics.com/analytics.js" > < / script >
2018-04-27 00:09:55 +00:00
< / head >
2020-04-15 17:09:38 +00:00
2018-04-27 00:09:55 +00:00
< body dir = "ltr" data-md-color-primary = "teal" data-md-color-accent = "green" >
2018-07-13 23:53:25 +00:00
< input class = "md-toggle" data-md-toggle = "drawer" type = "checkbox" id = "__drawer" autocomplete = "off" >
< input class = "md-toggle" data-md-toggle = "search" type = "checkbox" id = "__search" autocomplete = "off" >
2020-04-15 17:09:38 +00:00
< label class = "md-overlay" for = "__drawer" > < / label >
< div data-md-component = "skip" >
< a href = "#role-based-access-control-rbac" class = "md-skip" >
Skip to content
< / a >
< / div >
< div data-md-component = "announce" >
< / div >
2018-04-27 00:09:55 +00:00
< header class = "md-header" data-md-component = "header" >
2020-04-15 17:09:38 +00:00
< nav class = "md-header-nav md-grid" aria-label = "Header" >
< a href = "https://kubernetes.github.io/ingress-nginx" title = "NGINX Ingress Controller" class = "md-header-nav__button md-logo" aria-label = "NGINX Ingress Controller" >
< svg xmlns = "http://www.w3.org/2000/svg" viewBox = "0 0 24 24" > < path d = "M12,8A3,3 0 0,0 15,5A3,3 0 0,0 12,2A3,3 0 0,0 9,5A3,3 0 0,0 12,8M12,11.54C9.64,9.35 6.5,8 3,8V19C6.5,19 9.64,20.35 12,22.54C14.36,20.35 17.5,19 21,19V8C17.5,8 14.36,9.35 12,11.54Z" / > < / svg >
< / a >
< label class = "md-header-nav__button md-icon" for = "__drawer" >
< svg xmlns = "http://www.w3.org/2000/svg" viewBox = "0 0 24 24" > < path d = "M3,6H21V8H3V6M3,11H21V13H3V11M3,16H21V18H3V16Z" / > < / svg >
< / label >
< div class = "md-header-nav__title" data-md-component = "header-title" >
< div class = "md-header-nav__ellipsis" >
< span class = "md-header-nav__topic md-ellipsis" >
NGINX Ingress Controller
< / span >
< span class = "md-header-nav__topic md-ellipsis" >
Role Based Access Control (RBAC)
< / span >
2018-04-27 00:09:55 +00:00
< / div >
2020-04-15 17:09:38 +00:00
< / div >
< label class = "md-header-nav__button md-icon" for = "__search" >
< svg xmlns = "http://www.w3.org/2000/svg" viewBox = "0 0 24 24" > < path d = "M9.5,3A6.5,6.5 0 0,1 16,9.5C16,11.11 15.41,12.59 14.44,13.73L14.71,14H15.5L20.5,19L19,20.5L14,15.5V14.71L13.73,14.44C12.59,15.41 11.11,16 9.5,16A6.5,6.5 0 0,1 3,9.5A6.5,6.5 0 0,1 9.5,3M9.5,5C7,5 5,7 5,9.5C5,12 7,14 9.5,14C12,14 14,12 14,9.5C14,7 12,5 9.5,5Z" / > < / svg >
< / label >
2018-04-27 00:09:55 +00:00
< div class = "md-search" data-md-component = "search" role = "dialog" >
2018-07-13 23:53:25 +00:00
< label class = "md-search__overlay" for = "__search" > < / label >
2018-04-27 00:09:55 +00:00
< div class = "md-search__inner" role = "search" >
< form class = "md-search__form" name = "search" >
2020-04-15 17:09:38 +00:00
< input type = "text" class = "md-search__input" name = "query" aria-label = "Search" placeholder = "Search" autocapitalize = "off" autocorrect = "off" autocomplete = "off" spellcheck = "false" data-md-component = "search-query" data-md-state = "active" >
< label class = "md-search__icon md-icon" for = "__search" >
< svg xmlns = "http://www.w3.org/2000/svg" viewBox = "0 0 24 24" > < path d = "M9.5,3A6.5,6.5 0 0,1 16,9.5C16,11.11 15.41,12.59 14.44,13.73L14.71,14H15.5L20.5,19L19,20.5L14,15.5V14.71L13.73,14.44C12.59,15.41 11.11,16 9.5,16A6.5,6.5 0 0,1 3,9.5A6.5,6.5 0 0,1 9.5,3M9.5,5C7,5 5,7 5,9.5C5,12 7,14 9.5,14C12,14 14,12 14,9.5C14,7 12,5 9.5,5Z" / > < / svg >
< svg xmlns = "http://www.w3.org/2000/svg" viewBox = "0 0 24 24" > < path d = "M20,11V13H8L13.5,18.5L12.08,19.92L4.16,12L12.08,4.08L13.5,5.5L8,11H20Z" / > < / svg >
< / label >
< button type = "reset" class = "md-search__icon md-icon" aria-label = "Clear" data-md-component = "search-reset" tabindex = "-1" >
< svg xmlns = "http://www.w3.org/2000/svg" viewBox = "0 0 24 24" > < path d = "M19,6.41L17.59,5L12,10.59L6.41,5L5,6.41L10.59,12L5,17.59L6.41,19L12,13.41L17.59,19L19,17.59L13.41,12L19,6.41Z" / > < / svg >
2018-04-27 00:09:55 +00:00
< / button >
< / form >
< div class = "md-search__output" >
< div class = "md-search__scrollwrap" data-md-scrollfix >
2020-04-15 17:09:38 +00:00
< div class = "md-search-result" data-md-component = "search-result" >
2018-04-27 00:09:55 +00:00
< div class = "md-search-result__meta" >
Type to start searching
< / div >
< ol class = "md-search-result__list" > < / ol >
< / div >
< / div >
< / div >
< / div >
< / div >
2020-04-15 17:09:38 +00:00
< div class = "md-header-nav__source" >
2018-04-27 00:09:55 +00:00
2020-04-15 17:09:38 +00:00
< a href = "https://github.com/kubernetes/ingress-nginx/" title = "Go to repository" class = "md-source" >
< div class = "md-source__icon md-icon" >
< svg xmlns = "http://www.w3.org/2000/svg" viewBox = "0 0 448 512" > < path d = "M439.55 236.05L244 40.45a28.87 28.87 0 0 0-40.81 0l-40.66 40.63 51.52 51.52c27.06-9.14 52.68 16.77 43.39 43.68l49.66 49.66c34.23-11.8 61.18 31 35.47 56.69-26.49 26.49-70.21-2.87-56-37.34L240.22 199v121.85c25.3 12.54 22.26 41.85 9.08 55a34.34 34.34 0 0 1-48.55 0c-17.57-17.6-11.07-46.91 11.25-56v-123c-20.8-8.51-24.6-30.74-18.64-45L142.57 101 8.45 235.14a28.86 28.86 0 0 0 0 40.81l195.61 195.6a28.86 28.86 0 0 0 40.8 0l194.69-194.69a28.86 28.86 0 0 0 0-40.81z" / > < / svg >
< / div >
2019-03-02 18:14:04 +00:00
< div class = "md-source__repository" >
kubernetes/ingress-nginx
< / div >
< / a >
2020-04-15 17:09:38 +00:00
< / div >
2018-04-27 00:09:55 +00:00
< / nav >
< / header >
2020-04-15 17:09:38 +00:00
< div class = "md-container" data-md-component = "container" >
2018-04-27 00:09:55 +00:00
2020-04-15 17:09:38 +00:00
2018-04-27 00:09:55 +00:00
2020-04-15 17:09:38 +00:00
< nav class = "md-tabs md-tabs--active" aria-label = "Tabs" data-md-component = "tabs" >
2018-04-27 00:09:55 +00:00
< div class = "md-tabs__inner md-grid" >
< ul class = "md-tabs__list" >
2018-09-13 23:54:10 +00:00
< li class = "md-tabs__item" >
2019-09-22 20:06:22 +00:00
< a href = "../.." class = "md-tabs__link" >
2018-09-13 23:54:10 +00:00
Welcome
< / a >
< / li >
2018-04-27 00:09:55 +00:00
< li class = "md-tabs__item" >
2019-09-22 20:06:22 +00:00
< a href = "../" class = "md-tabs__link md-tabs__link--active" >
2018-04-27 00:09:55 +00:00
Deployment
< / a >
< / li >
< li class = "md-tabs__item" >
2019-09-22 20:06:22 +00:00
< a href = "../../user-guide/nginx-configuration/" class = "md-tabs__link" >
2018-04-27 00:09:55 +00:00
User guide
< / a >
< / li >
< li class = "md-tabs__item" >
2019-09-22 20:06:22 +00:00
< a href = "../../examples/" class = "md-tabs__link" >
2018-04-27 00:09:55 +00:00
Examples
< / a >
< / li >
< / ul >
< / div >
< / nav >
2020-04-15 17:09:38 +00:00
2018-04-27 00:09:55 +00:00
2020-04-15 17:09:38 +00:00
< main class = "md-main" data-md-component = "main" >
< div class = "md-main__inner md-grid" >
2018-04-27 00:09:55 +00:00
< div class = "md-sidebar md-sidebar--primary" data-md-component = "navigation" >
< div class = "md-sidebar__scrollwrap" >
< div class = "md-sidebar__inner" >
2020-04-15 17:09:38 +00:00
< nav class = "md-nav md-nav--primary" aria-label = "Navigation" data-md-level = "0" >
< label class = "md-nav__title" for = "__drawer" >
< a href = "https://kubernetes.github.io/ingress-nginx" title = "NGINX Ingress Controller" class = "md-nav__button md-logo" aria-label = "NGINX Ingress Controller" >
2018-04-27 00:09:55 +00:00
2020-04-15 17:09:38 +00:00
< svg xmlns = "http://www.w3.org/2000/svg" viewBox = "0 0 24 24" > < path d = "M12,8A3,3 0 0,0 15,5A3,3 0 0,0 12,2A3,3 0 0,0 9,5A3,3 0 0,0 12,8M12,11.54C9.64,9.35 6.5,8 3,8V19C6.5,19 9.64,20.35 12,22.54C14.36,20.35 17.5,19 21,19V8C17.5,8 14.36,9.35 12,11.54Z" / > < / svg >
2018-08-04 22:29:33 +00:00
< / a >
2018-04-27 00:09:55 +00:00
NGINX Ingress Controller
< / label >
< div class = "md-nav__source" >
2020-04-15 17:09:38 +00:00
< a href = "https://github.com/kubernetes/ingress-nginx/" title = "Go to repository" class = "md-source" >
< div class = "md-source__icon md-icon" >
< svg xmlns = "http://www.w3.org/2000/svg" viewBox = "0 0 448 512" > < path d = "M439.55 236.05L244 40.45a28.87 28.87 0 0 0-40.81 0l-40.66 40.63 51.52 51.52c27.06-9.14 52.68 16.77 43.39 43.68l49.66 49.66c34.23-11.8 61.18 31 35.47 56.69-26.49 26.49-70.21-2.87-56-37.34L240.22 199v121.85c25.3 12.54 22.26 41.85 9.08 55a34.34 34.34 0 0 1-48.55 0c-17.57-17.6-11.07-46.91 11.25-56v-123c-20.8-8.51-24.6-30.74-18.64-45L142.57 101 8.45 235.14a28.86 28.86 0 0 0 0 40.81l195.61 195.6a28.86 28.86 0 0 0 40.8 0l194.69-194.69a28.86 28.86 0 0 0 0-40.81z" / > < / svg >
< / div >
2019-03-02 18:14:04 +00:00
< div class = "md-source__repository" >
kubernetes/ingress-nginx
< / div >
< / a >
2018-04-27 00:09:55 +00:00
< / div >
< ul class = "md-nav__list" data-md-scrollfix >
2018-09-13 23:54:10 +00:00
< li class = "md-nav__item md-nav__item--nested" >
2020-04-15 17:09:38 +00:00
< input class = "md-nav__toggle md-toggle" data-md-toggle = "nav-1" type = "checkbox" id = "nav-1" >
2018-09-13 23:54:10 +00:00
< label class = "md-nav__link" for = "nav-1" >
Welcome
2020-04-15 17:09:38 +00:00
< span class = "md-nav__icon md-icon" >
< svg xmlns = "http://www.w3.org/2000/svg" viewBox = "0 0 24 24" > < path d = "M8.59,16.58L13.17,12L8.59,7.41L10,6L16,12L10,18L8.59,16.58Z" / > < / svg >
< / span >
2018-09-13 23:54:10 +00:00
< / label >
2020-04-15 17:09:38 +00:00
< nav class = "md-nav" aria-label = "Welcome" data-md-level = "1" >
2018-09-13 23:54:10 +00:00
< label class = "md-nav__title" for = "nav-1" >
2020-04-15 17:09:38 +00:00
< span class = "md-nav__icon md-icon" >
< svg xmlns = "http://www.w3.org/2000/svg" viewBox = "0 0 24 24" > < path d = "M20,11V13H8L13.5,18.5L12.08,19.92L4.16,12L12.08,4.08L13.5,5.5L8,11H20Z" / > < / svg >
< / span >
2018-09-13 23:54:10 +00:00
Welcome
< / label >
< ul class = "md-nav__list" data-md-scrollfix >
2018-04-27 00:09:55 +00:00
< li class = "md-nav__item" >
< a href = "../.." title = "Welcome" class = "md-nav__link" >
Welcome
< / a >
< / li >
2018-09-13 23:54:10 +00:00
< li class = "md-nav__item" >
< a href = "../../how-it-works/" title = "How it works" class = "md-nav__link" >
How it works
< / a >
< / li >
< li class = "md-nav__item" >
< a href = "../../troubleshooting/" title = "Troubleshooting" class = "md-nav__link" >
Troubleshooting
< / a >
< / li >
2019-04-09 22:45:20 +00:00
< li class = "md-nav__item" >
< a href = "../../kubectl-plugin/" title = "kubectl plugin" class = "md-nav__link" >
kubectl plugin
< / a >
< / li >
2018-09-13 23:54:10 +00:00
< li class = "md-nav__item" >
< a href = "../../development/" title = "Development" class = "md-nav__link" >
Development
< / a >
< / li >
< / ul >
< / nav >
< / li >
2018-04-27 00:09:55 +00:00
< li class = "md-nav__item md-nav__item--active md-nav__item--nested" >
2020-04-15 17:09:38 +00:00
< input class = "md-nav__toggle md-toggle" data-md-toggle = "nav-2" type = "checkbox" id = "nav-2" checked >
2018-04-27 00:09:55 +00:00
< label class = "md-nav__link" for = "nav-2" >
Deployment
2020-04-15 17:09:38 +00:00
< span class = "md-nav__icon md-icon" >
< svg xmlns = "http://www.w3.org/2000/svg" viewBox = "0 0 24 24" > < path d = "M8.59,16.58L13.17,12L8.59,7.41L10,6L16,12L10,18L8.59,16.58Z" / > < / svg >
< / span >
2018-04-27 00:09:55 +00:00
< / label >
2020-04-15 17:09:38 +00:00
< nav class = "md-nav" aria-label = "Deployment" data-md-level = "1" >
2018-04-27 00:09:55 +00:00
< label class = "md-nav__title" for = "nav-2" >
2020-04-15 17:09:38 +00:00
< span class = "md-nav__icon md-icon" >
< svg xmlns = "http://www.w3.org/2000/svg" viewBox = "0 0 24 24" > < path d = "M20,11V13H8L13.5,18.5L12.08,19.92L4.16,12L12.08,4.08L13.5,5.5L8,11H20Z" / > < / svg >
< / span >
2018-04-27 00:09:55 +00:00
Deployment
< / label >
< ul class = "md-nav__list" data-md-scrollfix >
< li class = "md-nav__item" >
< a href = "../" title = "Installation Guide" class = "md-nav__link" >
Installation Guide
< / a >
< / li >
2018-09-04 23:47:40 +00:00
< li class = "md-nav__item" >
< a href = "../baremetal/" title = "Bare-metal considerations" class = "md-nav__link" >
Bare-metal considerations
< / a >
< / li >
2018-04-27 00:09:55 +00:00
< li class = "md-nav__item md-nav__item--active" >
2020-04-15 17:09:38 +00:00
< input class = "md-nav__toggle md-toggle" data-md-toggle = "toc" type = "checkbox" id = "__toc" >
2018-04-27 00:09:55 +00:00
2018-07-13 23:53:25 +00:00
< label class = "md-nav__link md-nav__link--active" for = "__toc" >
2018-04-27 00:09:55 +00:00
Role Based Access Control (RBAC)
2020-04-15 17:09:38 +00:00
< span class = "md-nav__icon md-icon" >
< svg xmlns = "http://www.w3.org/2000/svg" viewBox = "0 0 24 24" > < path d = "M3,9H17V7H3V9M3,13H17V11H3V13M3,17H17V15H3V17M19,17H21V15H19V17M19,7V9H21V7H19M19,13H21V11H19V13Z" / > < / svg >
< / span >
2018-04-27 00:09:55 +00:00
< / label >
< a href = "./" title = "Role Based Access Control (RBAC)" class = "md-nav__link md-nav__link--active" >
Role Based Access Control (RBAC)
< / a >
2020-04-15 17:09:38 +00:00
< nav class = "md-nav md-nav--secondary" aria-label = "Table of contents" >
2018-04-27 00:09:55 +00:00
2020-04-15 17:09:38 +00:00
< label class = "md-nav__title" for = "__toc" >
< span class = "md-nav__icon md-icon" >
< svg xmlns = "http://www.w3.org/2000/svg" viewBox = "0 0 24 24" > < path d = "M20,11V13H8L13.5,18.5L12.08,19.92L4.16,12L12.08,4.08L13.5,5.5L8,11H20Z" / > < / svg >
< / span >
Table of contents
< / label >
2018-04-27 00:09:55 +00:00
< ul class = "md-nav__list" data-md-scrollfix >
< li class = "md-nav__item" >
2019-09-22 20:06:22 +00:00
< a href = "#overview" class = "md-nav__link" >
2018-04-27 00:09:55 +00:00
Overview
< / a >
< / li >
< li class = "md-nav__item" >
2019-09-22 20:06:22 +00:00
< a href = "#service-accounts-created-in-this-example" class = "md-nav__link" >
2018-04-27 00:09:55 +00:00
Service Accounts created in this example
< / a >
< / li >
< li class = "md-nav__item" >
2019-09-22 20:06:22 +00:00
< a href = "#permissions-granted-in-this-example" class = "md-nav__link" >
2018-04-27 00:09:55 +00:00
Permissions Granted in this example
< / a >
2020-04-15 17:09:38 +00:00
< nav class = "md-nav" aria-label = "Permissions Granted in this example" >
2018-04-27 00:09:55 +00:00
< ul class = "md-nav__list" >
< li class = "md-nav__item" >
2019-09-22 20:06:22 +00:00
< a href = "#cluster-permissions" class = "md-nav__link" >
2018-04-27 00:09:55 +00:00
Cluster Permissions
< / a >
< / li >
< li class = "md-nav__item" >
2019-09-22 20:06:22 +00:00
< a href = "#namespace-permissions" class = "md-nav__link" >
2018-04-27 00:09:55 +00:00
Namespace Permissions
< / a >
< / li >
< li class = "md-nav__item" >
2019-09-22 20:06:22 +00:00
< a href = "#bindings" class = "md-nav__link" >
2018-04-27 00:09:55 +00:00
Bindings
< / a >
< / li >
< / ul >
< / nav >
< / li >
< / ul >
< / nav >
< / li >
2018-05-03 14:08:21 +00:00
2019-05-26 08:06:36 +00:00
< li class = "md-nav__item" >
< a href = "../validating-webhook/" title = "Validating Webhook (admission controller)" class = "md-nav__link" >
Validating Webhook (admission controller)
< / a >
< / li >
2018-05-03 14:08:21 +00:00
< li class = "md-nav__item" >
2018-09-13 23:54:10 +00:00
< a href = "../upgrade/" title = "Upgrade" class = "md-nav__link" >
Upgrade
2018-05-03 14:08:21 +00:00
< / a >
< / li >
2018-04-27 00:09:55 +00:00
< / ul >
< / nav >
< / li >
< li class = "md-nav__item md-nav__item--nested" >
2020-04-15 17:09:38 +00:00
< input class = "md-nav__toggle md-toggle" data-md-toggle = "nav-3" type = "checkbox" id = "nav-3" >
2018-04-27 00:09:55 +00:00
< label class = "md-nav__link" for = "nav-3" >
User guide
2020-04-15 17:09:38 +00:00
< span class = "md-nav__icon md-icon" >
< svg xmlns = "http://www.w3.org/2000/svg" viewBox = "0 0 24 24" > < path d = "M8.59,16.58L13.17,12L8.59,7.41L10,6L16,12L10,18L8.59,16.58Z" / > < / svg >
< / span >
2018-04-27 00:09:55 +00:00
< / label >
2020-04-15 17:09:38 +00:00
< nav class = "md-nav" aria-label = "User guide" data-md-level = "1" >
2018-04-27 00:09:55 +00:00
< label class = "md-nav__title" for = "nav-3" >
2020-04-15 17:09:38 +00:00
< span class = "md-nav__icon md-icon" >
< svg xmlns = "http://www.w3.org/2000/svg" viewBox = "0 0 24 24" > < path d = "M20,11V13H8L13.5,18.5L12.08,19.92L4.16,12L12.08,4.08L13.5,5.5L8,11H20Z" / > < / svg >
< / span >
2018-04-27 00:09:55 +00:00
User guide
< / label >
< ul class = "md-nav__list" data-md-scrollfix >
< li class = "md-nav__item md-nav__item--nested" >
2020-04-15 17:09:38 +00:00
< input class = "md-nav__toggle md-toggle" data-md-toggle = "nav-3-1" type = "checkbox" id = "nav-3-1" >
2018-04-27 00:09:55 +00:00
< label class = "md-nav__link" for = "nav-3-1" >
NGINX Configuration
2020-04-15 17:09:38 +00:00
< span class = "md-nav__icon md-icon" >
< svg xmlns = "http://www.w3.org/2000/svg" viewBox = "0 0 24 24" > < path d = "M8.59,16.58L13.17,12L8.59,7.41L10,6L16,12L10,18L8.59,16.58Z" / > < / svg >
< / span >
2018-04-27 00:09:55 +00:00
< / label >
2020-04-15 17:09:38 +00:00
< nav class = "md-nav" aria-label = "NGINX Configuration" data-md-level = "2" >
2018-04-27 00:09:55 +00:00
< label class = "md-nav__title" for = "nav-3-1" >
2020-04-15 17:09:38 +00:00
< span class = "md-nav__icon md-icon" >
< svg xmlns = "http://www.w3.org/2000/svg" viewBox = "0 0 24 24" > < path d = "M20,11V13H8L13.5,18.5L12.08,19.92L4.16,12L12.08,4.08L13.5,5.5L8,11H20Z" / > < / svg >
< / span >
2018-04-27 00:09:55 +00:00
NGINX Configuration
< / label >
< ul class = "md-nav__list" data-md-scrollfix >
< li class = "md-nav__item" >
2018-09-13 23:54:10 +00:00
< a href = "../../user-guide/nginx-configuration/" title = "Introduction" class = "md-nav__link" >
Introduction
2018-04-27 00:09:55 +00:00
< / a >
< / li >
2019-03-08 00:36:59 +00:00
< li class = "md-nav__item" >
< a href = "../../user-guide/basic-usage/" title = "Basic usage" class = "md-nav__link" >
Basic usage
< / a >
< / li >
2018-04-27 00:09:55 +00:00
< li class = "md-nav__item" >
< a href = "../../user-guide/nginx-configuration/annotations/" title = "Annotations" class = "md-nav__link" >
Annotations
< / a >
< / li >
< li class = "md-nav__item" >
2018-09-13 23:54:10 +00:00
< a href = "../../user-guide/nginx-configuration/configmap/" title = "ConfigMap" class = "md-nav__link" >
ConfigMap
2018-04-27 00:09:55 +00:00
< / a >
< / li >
< li class = "md-nav__item" >
< a href = "../../user-guide/nginx-configuration/custom-template/" title = "Custom NGINX template" class = "md-nav__link" >
Custom NGINX template
< / a >
< / li >
< li class = "md-nav__item" >
< a href = "../../user-guide/nginx-configuration/log-format/" title = "Log format" class = "md-nav__link" >
Log format
< / a >
< / li >
< / ul >
< / nav >
< / li >
< li class = "md-nav__item" >
< a href = "../../user-guide/cli-arguments/" title = "Command line arguments" class = "md-nav__link" >
Command line arguments
< / a >
< / li >
< li class = "md-nav__item" >
< a href = "../../user-guide/custom-errors/" title = "Custom errors" class = "md-nav__link" >
Custom errors
< / a >
< / li >
2018-05-03 14:08:21 +00:00
< li class = "md-nav__item" >
< a href = "../../user-guide/default-backend/" title = "Default backend" class = "md-nav__link" >
Default backend
< / a >
< / li >
2018-11-22 02:35:18 +00:00
< li class = "md-nav__item" >
< a href = "../../user-guide/exposing-tcp-udp-services/" title = "Exposing TCP and UDP services" class = "md-nav__link" >
Exposing TCP and UDP services
< / a >
< / li >
2019-08-01 23:58:36 +00:00
< li class = "md-nav__item" >
< a href = "../../user-guide/fcgi-services/" title = "Exposing FCGI services" class = "md-nav__link" >
Exposing FCGI services
< / a >
< / li >
2018-04-27 00:09:55 +00:00
< li class = "md-nav__item" >
2018-10-12 01:21:45 +00:00
< a href = "../../user-guide/ingress-path-matching/" title = "Regular expressions in paths" class = "md-nav__link" >
Regular expressions in paths
2018-04-27 00:09:55 +00:00
< / a >
< / li >
< li class = "md-nav__item" >
< a href = "../../user-guide/external-articles/" title = "External Articles" class = "md-nav__link" >
External Articles
< / a >
< / li >
< li class = "md-nav__item" >
< a href = "../../user-guide/miscellaneous/" title = "Miscellaneous" class = "md-nav__link" >
Miscellaneous
< / a >
< / li >
2018-08-22 19:35:46 +00:00
< li class = "md-nav__item" >
< a href = "../../user-guide/monitoring/" title = "Prometheus and Grafana installation" class = "md-nav__link" >
Prometheus and Grafana installation
< / a >
< / li >
2018-04-27 00:09:55 +00:00
< li class = "md-nav__item" >
2018-05-03 14:08:21 +00:00
< a href = "../../user-guide/multiple-ingress/" title = "Multiple Ingress controllers" class = "md-nav__link" >
Multiple Ingress controllers
2018-04-27 00:09:55 +00:00
< / a >
< / li >
< li class = "md-nav__item" >
2018-05-03 14:08:21 +00:00
< a href = "../../user-guide/tls/" title = "TLS/HTTPS" class = "md-nav__link" >
TLS/HTTPS
2018-04-27 00:09:55 +00:00
< / a >
< / li >
< li class = "md-nav__item md-nav__item--nested" >
2020-04-15 17:09:38 +00:00
< input class = "md-nav__toggle md-toggle" data-md-toggle = "nav-3-13" type = "checkbox" id = "nav-3-13" >
2018-04-27 00:09:55 +00:00
2019-08-01 23:58:36 +00:00
< label class = "md-nav__link" for = "nav-3-13" >
2018-04-27 00:09:55 +00:00
Third party addons
2020-04-15 17:09:38 +00:00
< span class = "md-nav__icon md-icon" >
< svg xmlns = "http://www.w3.org/2000/svg" viewBox = "0 0 24 24" > < path d = "M8.59,16.58L13.17,12L8.59,7.41L10,6L16,12L10,18L8.59,16.58Z" / > < / svg >
< / span >
2018-04-27 00:09:55 +00:00
< / label >
2020-04-15 17:09:38 +00:00
< nav class = "md-nav" aria-label = "Third party addons" data-md-level = "2" >
2019-08-01 23:58:36 +00:00
< label class = "md-nav__title" for = "nav-3-13" >
2020-04-15 17:09:38 +00:00
< span class = "md-nav__icon md-icon" >
< svg xmlns = "http://www.w3.org/2000/svg" viewBox = "0 0 24 24" > < path d = "M20,11V13H8L13.5,18.5L12.08,19.92L4.16,12L12.08,4.08L13.5,5.5L8,11H20Z" / > < / svg >
< / span >
2018-04-27 00:09:55 +00:00
Third party addons
< / label >
< ul class = "md-nav__list" data-md-scrollfix >
< li class = "md-nav__item" >
< a href = "../../user-guide/third-party-addons/modsecurity/" title = "ModSecurity Web Application Firewall" class = "md-nav__link" >
ModSecurity Web Application Firewall
< / a >
< / li >
< li class = "md-nav__item" >
< a href = "../../user-guide/third-party-addons/opentracing/" title = "OpenTracing" class = "md-nav__link" >
OpenTracing
< / a >
< / li >
< / ul >
< / nav >
< / li >
< / ul >
< / nav >
< / li >
< li class = "md-nav__item md-nav__item--nested" >
2020-04-15 17:09:38 +00:00
< input class = "md-nav__toggle md-toggle" data-md-toggle = "nav-4" type = "checkbox" id = "nav-4" >
2018-04-27 00:09:55 +00:00
< label class = "md-nav__link" for = "nav-4" >
Examples
2020-04-15 17:09:38 +00:00
< span class = "md-nav__icon md-icon" >
< svg xmlns = "http://www.w3.org/2000/svg" viewBox = "0 0 24 24" > < path d = "M8.59,16.58L13.17,12L8.59,7.41L10,6L16,12L10,18L8.59,16.58Z" / > < / svg >
< / span >
2018-04-27 00:09:55 +00:00
< / label >
2020-04-15 17:09:38 +00:00
< nav class = "md-nav" aria-label = "Examples" data-md-level = "1" >
2018-04-27 00:09:55 +00:00
< label class = "md-nav__title" for = "nav-4" >
2020-04-15 17:09:38 +00:00
< span class = "md-nav__icon md-icon" >
< svg xmlns = "http://www.w3.org/2000/svg" viewBox = "0 0 24 24" > < path d = "M20,11V13H8L13.5,18.5L12.08,19.92L4.16,12L12.08,4.08L13.5,5.5L8,11H20Z" / > < / svg >
< / span >
2018-04-27 00:09:55 +00:00
Examples
< / label >
< ul class = "md-nav__list" data-md-scrollfix >
< li class = "md-nav__item" >
2018-09-13 23:54:10 +00:00
< a href = "../../examples/" title = "Introduction" class = "md-nav__link" >
Introduction
2018-04-27 00:09:55 +00:00
< / a >
< / li >
< li class = "md-nav__item" >
2018-05-03 14:08:21 +00:00
< a href = "../../examples/PREREQUISITES/" title = "Prerequisites" class = "md-nav__link" >
Prerequisites
2018-04-27 00:09:55 +00:00
< / a >
< / li >
< li class = "md-nav__item" >
2018-09-13 23:54:10 +00:00
< a href = "../../examples/affinity/cookie/" title = "Sticky Sessions" class = "md-nav__link" >
Sticky Sessions
2018-04-27 00:09:55 +00:00
< / a >
< / li >
< li class = "md-nav__item md-nav__item--nested" >
2020-04-15 17:09:38 +00:00
< input class = "md-nav__toggle md-toggle" data-md-toggle = "nav-4-4" type = "checkbox" id = "nav-4-4" >
2018-04-27 00:09:55 +00:00
< label class = "md-nav__link" for = "nav-4-4" >
Auth
2020-04-15 17:09:38 +00:00
< span class = "md-nav__icon md-icon" >
< svg xmlns = "http://www.w3.org/2000/svg" viewBox = "0 0 24 24" > < path d = "M8.59,16.58L13.17,12L8.59,7.41L10,6L16,12L10,18L8.59,16.58Z" / > < / svg >
< / span >
2018-04-27 00:09:55 +00:00
< / label >
2020-04-15 17:09:38 +00:00
< nav class = "md-nav" aria-label = "Auth" data-md-level = "2" >
2018-04-27 00:09:55 +00:00
< label class = "md-nav__title" for = "nav-4-4" >
2020-04-15 17:09:38 +00:00
< span class = "md-nav__icon md-icon" >
< svg xmlns = "http://www.w3.org/2000/svg" viewBox = "0 0 24 24" > < path d = "M20,11V13H8L13.5,18.5L12.08,19.92L4.16,12L12.08,4.08L13.5,5.5L8,11H20Z" / > < / svg >
< / span >
2018-04-27 00:09:55 +00:00
Auth
< / label >
< ul class = "md-nav__list" data-md-scrollfix >
< li class = "md-nav__item" >
2018-09-13 23:54:10 +00:00
< a href = "../../examples/auth/basic/" title = "Basic Authentication" class = "md-nav__link" >
2018-04-27 00:09:55 +00:00
Basic Authentication
< / a >
< / li >
< li class = "md-nav__item" >
2018-09-13 23:54:10 +00:00
< a href = "../../examples/auth/client-certs/" title = "Client Certificate Authentication" class = "md-nav__link" >
2018-04-27 00:09:55 +00:00
Client Certificate Authentication
< / a >
< / li >
< li class = "md-nav__item" >
2018-09-13 23:54:10 +00:00
< a href = "../../examples/auth/external-auth/" title = "External Basic Authentication" class = "md-nav__link" >
2018-08-30 19:50:29 +00:00
External Basic Authentication
2018-04-27 00:09:55 +00:00
< / a >
< / li >
2018-05-03 14:08:21 +00:00
< li class = "md-nav__item" >
2018-09-13 23:54:10 +00:00
< a href = "../../examples/auth/oauth-external-auth/" title = "External OAUTH Authentication" class = "md-nav__link" >
2018-08-30 19:50:29 +00:00
External OAUTH Authentication
2018-05-03 14:08:21 +00:00
< / a >
< / li >
2018-04-27 00:09:55 +00:00
< / ul >
< / nav >
< / li >
< li class = "md-nav__item md-nav__item--nested" >
2020-04-15 17:09:38 +00:00
< input class = "md-nav__toggle md-toggle" data-md-toggle = "nav-4-5" type = "checkbox" id = "nav-4-5" >
2018-04-27 00:09:55 +00:00
< label class = "md-nav__link" for = "nav-4-5" >
Customization
2020-04-15 17:09:38 +00:00
< span class = "md-nav__icon md-icon" >
< svg xmlns = "http://www.w3.org/2000/svg" viewBox = "0 0 24 24" > < path d = "M8.59,16.58L13.17,12L8.59,7.41L10,6L16,12L10,18L8.59,16.58Z" / > < / svg >
< / span >
2018-04-27 00:09:55 +00:00
< / label >
2020-04-15 17:09:38 +00:00
< nav class = "md-nav" aria-label = "Customization" data-md-level = "2" >
2018-04-27 00:09:55 +00:00
< label class = "md-nav__title" for = "nav-4-5" >
2020-04-15 17:09:38 +00:00
< span class = "md-nav__icon md-icon" >
< svg xmlns = "http://www.w3.org/2000/svg" viewBox = "0 0 24 24" > < path d = "M20,11V13H8L13.5,18.5L12.08,19.92L4.16,12L12.08,4.08L13.5,5.5L8,11H20Z" / > < / svg >
< / span >
2018-04-27 00:09:55 +00:00
Customization
< / label >
< ul class = "md-nav__list" data-md-scrollfix >
< li class = "md-nav__item" >
2018-09-13 23:54:10 +00:00
< a href = "../../examples/customization/configuration-snippets/" title = "Configuration Snippets" class = "md-nav__link" >
2018-04-27 00:09:55 +00:00
Configuration Snippets
< / a >
< / li >
< li class = "md-nav__item" >
2018-09-13 23:54:10 +00:00
< a href = "../../examples/customization/custom-configuration/" title = "Custom Configuration" class = "md-nav__link" >
2018-04-27 00:09:55 +00:00
Custom Configuration
< / a >
< / li >
< li class = "md-nav__item" >
2018-09-13 23:54:10 +00:00
< a href = "../../examples/customization/custom-errors/" title = "Custom Errors" class = "md-nav__link" >
2018-04-27 00:09:55 +00:00
Custom Errors
< / a >
< / li >
< li class = "md-nav__item" >
2018-09-13 23:54:10 +00:00
< a href = "../../examples/customization/custom-headers/" title = "Custom Headers" class = "md-nav__link" >
2018-04-27 00:09:55 +00:00
Custom Headers
< / a >
< / li >
< li class = "md-nav__item" >
2018-09-13 23:54:10 +00:00
< a href = "../../examples/customization/external-auth-headers/" title = "External authentication" class = "md-nav__link" >
External authentication
2018-04-27 00:09:55 +00:00
< / a >
< / li >
< li class = "md-nav__item" >
2018-09-13 23:54:10 +00:00
< a href = "../../examples/customization/ssl-dh-param/" title = "Custom DH parameters for perfect forward secrecy" class = "md-nav__link" >
2018-05-03 14:08:21 +00:00
Custom DH parameters for perfect forward secrecy
2018-04-27 00:09:55 +00:00
< / a >
< / li >
< li class = "md-nav__item" >
2018-09-13 23:54:10 +00:00
< a href = "../../examples/customization/sysctl/" title = "Sysctl tuning" class = "md-nav__link" >
2018-04-27 00:09:55 +00:00
Sysctl tuning
< / a >
< / li >
< / ul >
< / nav >
< / li >
< li class = "md-nav__item" >
2018-09-13 23:54:10 +00:00
< a href = "../../examples/docker-registry/" title = "Docker registry" class = "md-nav__link" >
2018-04-27 00:09:55 +00:00
Docker registry
< / a >
< / li >
2018-05-12 01:26:30 +00:00
< li class = "md-nav__item" >
2018-09-13 23:54:10 +00:00
< a href = "../../examples/grpc/" title = "gRPC" class = "md-nav__link" >
2018-05-12 01:26:30 +00:00
gRPC
< / a >
< / li >
2018-04-27 00:09:55 +00:00
< li class = "md-nav__item" >
2018-09-13 23:54:10 +00:00
< a href = "../../examples/multi-tls/" title = "Multi TLS certificate termination" class = "md-nav__link" >
2018-04-27 00:09:55 +00:00
Multi TLS certificate termination
< / a >
< / li >
< li class = "md-nav__item" >
2018-09-13 23:54:10 +00:00
< a href = "../../examples/rewrite/" title = "Rewrite" class = "md-nav__link" >
2018-04-27 00:09:55 +00:00
Rewrite
< / a >
< / li >
< li class = "md-nav__item" >
2018-09-13 23:54:10 +00:00
< a href = "../../examples/static-ip/" title = "Static IPs" class = "md-nav__link" >
2018-04-27 00:09:55 +00:00
Static IPs
< / a >
< / li >
< li class = "md-nav__item" >
2018-09-13 23:54:10 +00:00
< a href = "../../examples/tls-termination/" title = "TLS termination" class = "md-nav__link" >
2018-04-27 00:09:55 +00:00
TLS termination
< / a >
< / li >
2019-08-01 23:58:36 +00:00
< li class = "md-nav__item" >
< a href = "../../examples/psp/" title = "Pod Security Policy (PSP)" class = "md-nav__link" >
Pod Security Policy (PSP)
< / a >
< / li >
2018-04-27 00:09:55 +00:00
< / ul >
< / nav >
< / li >
< / ul >
< / nav >
< / div >
< / div >
< / div >
< div class = "md-sidebar md-sidebar--secondary" data-md-component = "toc" >
< div class = "md-sidebar__scrollwrap" >
< div class = "md-sidebar__inner" >
2020-04-15 17:09:38 +00:00
< nav class = "md-nav md-nav--secondary" aria-label = "Table of contents" >
2018-04-27 00:09:55 +00:00
2020-04-15 17:09:38 +00:00
< label class = "md-nav__title" for = "__toc" >
< span class = "md-nav__icon md-icon" >
< svg xmlns = "http://www.w3.org/2000/svg" viewBox = "0 0 24 24" > < path d = "M20,11V13H8L13.5,18.5L12.08,19.92L4.16,12L12.08,4.08L13.5,5.5L8,11H20Z" / > < / svg >
< / span >
Table of contents
< / label >
2018-04-27 00:09:55 +00:00
< ul class = "md-nav__list" data-md-scrollfix >
< li class = "md-nav__item" >
2019-09-22 20:06:22 +00:00
< a href = "#overview" class = "md-nav__link" >
2018-04-27 00:09:55 +00:00
Overview
< / a >
< / li >
< li class = "md-nav__item" >
2019-09-22 20:06:22 +00:00
< a href = "#service-accounts-created-in-this-example" class = "md-nav__link" >
2018-04-27 00:09:55 +00:00
Service Accounts created in this example
< / a >
< / li >
< li class = "md-nav__item" >
2019-09-22 20:06:22 +00:00
< a href = "#permissions-granted-in-this-example" class = "md-nav__link" >
2018-04-27 00:09:55 +00:00
Permissions Granted in this example
< / a >
2020-04-15 17:09:38 +00:00
< nav class = "md-nav" aria-label = "Permissions Granted in this example" >
2018-04-27 00:09:55 +00:00
< ul class = "md-nav__list" >
< li class = "md-nav__item" >
2019-09-22 20:06:22 +00:00
< a href = "#cluster-permissions" class = "md-nav__link" >
2018-04-27 00:09:55 +00:00
Cluster Permissions
< / a >
< / li >
< li class = "md-nav__item" >
2019-09-22 20:06:22 +00:00
< a href = "#namespace-permissions" class = "md-nav__link" >
2018-04-27 00:09:55 +00:00
Namespace Permissions
< / a >
< / li >
< li class = "md-nav__item" >
2019-09-22 20:06:22 +00:00
< a href = "#bindings" class = "md-nav__link" >
2018-04-27 00:09:55 +00:00
Bindings
< / a >
< / li >
< / ul >
< / nav >
< / li >
< / ul >
< / nav >
< / div >
< / div >
< / div >
< div class = "md-content" >
< article class = "md-content__inner md-typeset" >
2020-04-15 17:09:38 +00:00
< a href = "https://github.com/kubernetes/ingress-nginx/edit/master/docs/deploy/rbac.md" title = "Edit this page" class = "md-content__button md-icon" >
< svg xmlns = "http://www.w3.org/2000/svg" viewBox = "0 0 24 24" > < path d = "M20.71,7.04C21.1,6.65 21.1,6 20.71,5.63L18.37,3.29C18,2.9 17.35,2.9 16.96,3.29L15.12,5.12L18.87,8.87M3,17.25V21H6.75L17.81,9.93L14.06,6.18L3,17.25Z" / > < / svg >
< / a >
2018-04-27 00:09:55 +00:00
2019-11-08 19:24:34 +00:00
< h1 id = "role-based-access-control-rbac" > Role Based Access Control (RBAC)< a class = "headerlink" href = "#role-based-access-control-rbac" title = "Permanent link" > ¶< / a > < / h1 >
< h2 id = "overview" > Overview< a class = "headerlink" href = "#overview" title = "Permanent link" > ¶< / a > < / h2 >
2018-04-27 00:09:55 +00:00
< p > This example applies to nginx-ingress-controllers being deployed in an environment with RBAC enabled.< / p >
< p > Role Based Access Control is comprised of four layers:< / p >
< ol >
2020-04-15 17:09:38 +00:00
< li > < code > ClusterRole< / code > - permissions assigned to a role that apply to an entire cluster< / li >
< li > < code > ClusterRoleBinding< / code > - binding a ClusterRole to a specific account< / li >
< li > < code > Role< / code > - permissions assigned to a role that apply to a specific namespace< / li >
< li > < code > RoleBinding< / code > - binding a Role to a specific account< / li >
2018-04-27 00:09:55 +00:00
< / ol >
< p > In order for RBAC to be applied to an nginx-ingress-controller, that controller
2020-04-15 17:09:38 +00:00
should be assigned to a < code > ServiceAccount< / code > . That < code > ServiceAccount< / code > should be
bound to the < code > Role< / code > s and < code > ClusterRole< / code > s defined for the nginx-ingress-controller.< / p >
2019-11-08 19:24:34 +00:00
< h2 id = "service-accounts-created-in-this-example" > Service Accounts created in this example< a class = "headerlink" href = "#service-accounts-created-in-this-example" title = "Permanent link" > ¶< / a > < / h2 >
2020-04-15 17:09:38 +00:00
< p > One ServiceAccount is created in this example, < code > nginx-ingress-serviceaccount< / code > .< / p >
2019-11-08 19:24:34 +00:00
< h2 id = "permissions-granted-in-this-example" > Permissions Granted in this example< a class = "headerlink" href = "#permissions-granted-in-this-example" title = "Permanent link" > ¶< / a > < / h2 >
2018-04-27 00:09:55 +00:00
< p > There are two sets of permissions defined in this example. Cluster-wide
2020-04-15 17:09:38 +00:00
permissions defined by the < code > ClusterRole< / code > named < code > nginx-ingress-clusterrole< / code > , and
namespace specific permissions defined by the < code > Role< / code > named < code > nginx-ingress-role< / code > .< / p >
2019-11-08 19:24:34 +00:00
< h3 id = "cluster-permissions" > Cluster Permissions< a class = "headerlink" href = "#cluster-permissions" title = "Permanent link" > ¶< / a > < / h3 >
2018-04-27 00:09:55 +00:00
< p > These permissions are granted in order for the nginx-ingress-controller to be
able to function as an ingress across the cluster. These permissions are
2020-04-15 17:09:38 +00:00
granted to the ClusterRole named < code > nginx-ingress-clusterrole< / code > < / p >
2018-04-27 00:09:55 +00:00
< ul >
2020-04-15 17:09:38 +00:00
< li > < code > configmaps< / code > , < code > endpoints< / code > , < code > nodes< / code > , < code > pods< / code > , < code > secrets< / code > : list, watch< / li >
< li > < code > nodes< / code > : get< / li >
< li > < code > services< / code > , < code > ingresses< / code > : get, list, watch< / li >
< li > < code > events< / code > : create, patch< / li >
< li > < code > ingresses/status< / code > : update< / li >
2018-04-27 00:09:55 +00:00
< / ul >
2019-11-08 19:24:34 +00:00
< h3 id = "namespace-permissions" > Namespace Permissions< a class = "headerlink" href = "#namespace-permissions" title = "Permanent link" > ¶< / a > < / h3 >
2018-04-27 00:09:55 +00:00
< p > These permissions are granted specific to the nginx-ingress namespace. These
2020-04-15 17:09:38 +00:00
permissions are granted to the Role named < code > nginx-ingress-role< / code > < / p >
2018-04-27 00:09:55 +00:00
< ul >
2020-04-15 17:09:38 +00:00
< li > < code > configmaps< / code > , < code > pods< / code > , < code > secrets< / code > : get< / li >
< li > < code > endpoints< / code > : get< / li >
2018-04-27 00:09:55 +00:00
< / ul >
< p > Furthermore to support leader-election, the nginx-ingress-controller needs to
2020-04-15 17:09:38 +00:00
have access to a < code > configmap< / code > using the resourceName < code > ingress-controller-leader-nginx< / code > < / p >
2018-04-27 00:09:55 +00:00
< blockquote >
< p > Note that resourceNames can NOT be used to limit requests using the “create”
verb because authorizers only have access to information that can be obtained
from the request URL, method, and headers (resource names in a “create” request
are part of the request body).< / p >
< / blockquote >
< ul >
2020-04-15 17:09:38 +00:00
< li > < code > configmaps< / code > : get, update (for resourceName < code > ingress-controller-leader-nginx< / code > )< / li >
< li > < code > configmaps< / code > : create< / li >
2018-04-27 00:09:55 +00:00
< / ul >
2020-04-15 17:09:38 +00:00
< p > This resourceName is the concatenation of the < code > election-id< / code > and the
< code > ingress-class< / code > as defined by the ingress-controller, which defaults to:< / p >
2018-04-27 00:09:55 +00:00
< ul >
2020-04-15 17:09:38 +00:00
< li > < code > election-id< / code > : < code > ingress-controller-leader< / code > < / li >
< li > < code > ingress-class< / code > : < code > nginx< / code > < / li >
< li > < code > resourceName< / code > : < code > < election-id> -< ingress-class> < / code > < / li >
2018-04-27 00:09:55 +00:00
< / ul >
< p > Please adapt accordingly if you overwrite either parameter when launching the
nginx-ingress-controller.< / p >
2019-11-08 19:24:34 +00:00
< h3 id = "bindings" > Bindings< a class = "headerlink" href = "#bindings" title = "Permanent link" > ¶< / a > < / h3 >
2020-04-15 17:09:38 +00:00
< p > The ServiceAccount < code > nginx-ingress-serviceaccount< / code > is bound to the Role
< code > nginx-ingress-role< / code > and the ClusterRole < code > nginx-ingress-clusterrole< / code > .< / p >
2018-04-27 00:09:55 +00:00
< p > The serviceAccountName associated with the containers in the deployment must
match the serviceAccount. The namespace references in the Deployment metadata,
container arguments, and POD_NAMESPACE should be in the nginx-ingress namespace.< / p >
< / article >
< / div >
< / div >
< / main >
< footer class = "md-footer" >
< div class = "md-footer-nav" >
2020-04-15 17:09:38 +00:00
< nav class = "md-footer-nav__inner md-grid" aria-label = "Footer" >
2018-04-27 00:09:55 +00:00
2020-04-15 17:09:38 +00:00
< a href = "../baremetal/" title = "Bare-metal considerations" class = "md-footer-nav__link md-footer-nav__link--prev" rel = "prev" >
< div class = "md-footer-nav__button md-icon" >
< svg xmlns = "http://www.w3.org/2000/svg" viewBox = "0 0 24 24" > < path d = "M20,11V13H8L13.5,18.5L12.08,19.92L4.16,12L12.08,4.08L13.5,5.5L8,11H20Z" / > < / svg >
2018-04-27 00:09:55 +00:00
< / div >
2020-04-15 17:09:38 +00:00
< div class = "md-footer-nav__title" >
< div class = "md-ellipsis" >
2018-04-27 00:09:55 +00:00
< span class = "md-footer-nav__direction" >
Previous
< / span >
2018-09-04 23:47:40 +00:00
Bare-metal considerations
2020-04-15 17:09:38 +00:00
< / div >
2018-04-27 00:09:55 +00:00
< / div >
< / a >
2020-04-15 17:09:38 +00:00
< a href = "../validating-webhook/" title = "Validating Webhook (admission controller)" class = "md-footer-nav__link md-footer-nav__link--next" rel = "next" >
< div class = "md-footer-nav__title" >
< div class = "md-ellipsis" >
2018-04-27 00:09:55 +00:00
< span class = "md-footer-nav__direction" >
Next
< / span >
2019-05-26 08:06:36 +00:00
Validating Webhook (admission controller)
2020-04-15 17:09:38 +00:00
< / div >
2018-04-27 00:09:55 +00:00
< / div >
2020-04-15 17:09:38 +00:00
< div class = "md-footer-nav__button md-icon" >
< svg xmlns = "http://www.w3.org/2000/svg" viewBox = "0 0 24 24" > < path d = "M4,11V13H16L10.5,18.5L11.92,19.92L19.84,12L11.92,4.08L10.5,5.5L16,11H4Z" / > < / svg >
2018-04-27 00:09:55 +00:00
< / div >
< / a >
< / nav >
< / div >
< div class = "md-footer-meta md-typeset" >
< div class = "md-footer-meta__inner md-grid" >
< div class = "md-footer-copyright" >
2020-04-15 17:09:38 +00:00
Made with
2020-02-09 23:53:05 +00:00
< a href = "https://squidfunk.github.io/mkdocs-material/" target = "_blank" rel = "noopener" >
2020-04-15 17:09:38 +00:00
Material for MkDocs
< / a >
2018-04-27 00:09:55 +00:00
< / div >
< / div >
< / div >
< / footer >
< / div >
2020-04-15 17:09:38 +00:00
< script src = "../../assets/javascripts/vendor.36cbf620.min.js" > < / script >
< script src = "../../assets/javascripts/bundle.00c583dd.min.js" > < / script > < script id = "__lang" type = "application/json" > { "clipboard.copy" : "Copy to clipboard" , "clipboard.copied" : "Copied to clipboard" , "search.config.lang" : "en" , "search.config.pipeline" : "trimmer, stopWordFilter" , "search.config.separator" : "[\\s\\-]+" , "search.result.placeholder" : "Type to start searching" , "search.result.none" : "No matching documents" , "search.result.one" : "1 matching document" , "search.result.other" : "# matching documents" } < / script >
< script >
app = initialize({
base: "../..",
features: ["tabs", "instant"],
search: Object.assign({
worker: "../../assets/javascripts/worker/search.7f7c8775.min.js"
}, typeof search !== "undefined" & & search)
})
< / script >
2018-04-27 00:09:55 +00:00
< / body >
< / html >
