Deploy GitHub Pages

This commit is contained in:
Travis Bot 2019-11-08 19:24:34 +00:00
parent bc6e898a19
commit cf75938808
56 changed files with 483 additions and 475 deletions

View file

@ -1341,14 +1341,14 @@
<a href="https://github.com/kubernetes/ingress-nginx/edit/master/docs/deploy/validating-webhook.md" title="Edit this page" class="md-icon md-content__icon">&#xE3C9;</a>
<h1 id="validating-webhook-admission-controller">Validating webhook (admission controller)<a class="headerlink" href="#validating-webhook-admission-controller" title="Permanent link">&para;</a></h1>
<h2 id="overview">Overview<a class="headerlink" href="#overview" title="Permanent link">&para;</a></h2>
<h1 id="validating-webhook-admission-controller">Validating webhook (admission controller)<a class="headerlink" href="#validating-webhook-admission-controller" title="Permanent link"></a></h1>
<h2 id="overview">Overview<a class="headerlink" href="#overview" title="Permanent link"></a></h2>
<p>Nginx ingress controller offers the option to validate ingresses before they enter the cluster, ensuring controller will generate a valid configuration.</p>
<p>This controller is called, when <a href="https://kubernetes.io/docs/reference/access-authn-authz/admission-controllers/#validatingadmissionwebhook">ValidatingAdmissionWebhook</a> is enabled, by the Kubernetes API server each time a new ingress is to enter the cluster, and rejects objects for which the generated nginx configuration fails to be validated.</p>
<p>This feature requires some further configuration of the cluster, hence it is an optional feature, this section explains how to enable it for your cluster.</p>
<h2 id="configure-the-webhook">Configure the webhook<a class="headerlink" href="#configure-the-webhook" title="Permanent link">&para;</a></h2>
<h3 id="generate-the-webhook-certificate">Generate the webhook certificate<a class="headerlink" href="#generate-the-webhook-certificate" title="Permanent link">&para;</a></h3>
<h4 id="self-signed-certificate">Self signed certificate<a class="headerlink" href="#self-signed-certificate" title="Permanent link">&para;</a></h4>
<h2 id="configure-the-webhook">Configure the webhook<a class="headerlink" href="#configure-the-webhook" title="Permanent link"></a></h2>
<h3 id="generate-the-webhook-certificate">Generate the webhook certificate<a class="headerlink" href="#generate-the-webhook-certificate" title="Permanent link"></a></h3>
<h4 id="self-signed-certificate">Self signed certificate<a class="headerlink" href="#self-signed-certificate" title="Permanent link"></a></h4>
<p>Validating webhook must be served using TLS, you need to generate a certificate. Note that kube API server is checking the hostname of the certificate, the common name of your certificate will need to match the service name.</p>
<div class="admonition example">
<p class="admonition-title">Example</p>
@ -1357,7 +1357,7 @@
</pre></div>
</div>
<h5 id="using-kubernetes-ca">Using Kubernetes CA<a class="headerlink" href="#using-kubernetes-ca" title="Permanent link">&para;</a></h5>
<h5 id="using-kubernetes-ca">Using Kubernetes CA<a class="headerlink" href="#using-kubernetes-ca" title="Permanent link"></a></h5>
<p>Kubernetes also provides primitives to sign a certificate request. Here is an example on how to use it</p>
<div class="admonition example">
<p class="admonition-title">Example</p>
@ -1426,7 +1426,7 @@ kubectl create secret generic ingress-nginx.svc <span class="se">\</span>
</pre></div>
</div>
<h4 id="using-helm">Using helm<a class="headerlink" href="#using-helm" title="Permanent link">&para;</a></h4>
<h4 id="using-helm">Using helm<a class="headerlink" href="#using-helm" title="Permanent link"></a></h4>
<p>To generate the certificate using helm, you can use the following snippet</p>
<div class="admonition example">
<p class="admonition-title">Example</p>
@ -1436,7 +1436,7 @@ kubectl create secret generic ingress-nginx.svc <span class="se">\</span>
</pre></div>
</div>
<h3 id="ingress-controller-flags">Ingress controller flags<a class="headerlink" href="#ingress-controller-flags" title="Permanent link">&para;</a></h3>
<h3 id="ingress-controller-flags">Ingress controller flags<a class="headerlink" href="#ingress-controller-flags" title="Permanent link"></a></h3>
<p>To enable the feature in the ingress controller, you <em>need</em> to provide 3 flags to the command line.</p>
<table>
<thead>
@ -1464,10 +1464,10 @@ kubectl create secret generic ingress-nginx.svc <span class="se">\</span>
</tr>
</tbody>
</table>
<h3 id="kube-api-server-flags">kube API server flags<a class="headerlink" href="#kube-api-server-flags" title="Permanent link">&para;</a></h3>
<h3 id="kube-api-server-flags">kube API server flags<a class="headerlink" href="#kube-api-server-flags" title="Permanent link"></a></h3>
<p>Validating webhook feature requires specific setup on the kube API server side. Depending on your kubernetes version, the flag can, or not, be enabled by default.
To check that your kube API server runs with the required flags, please refer to the <a href="https://kubernetes.io/docs/reference/access-authn-authz/admission-controllers/#validatingadmissionwebhook">kubernetes</a> documentation.</p>
<h3 id="additional-kubernetes-objects">Additional kubernetes objects<a class="headerlink" href="#additional-kubernetes-objects" title="Permanent link">&para;</a></h3>
<h3 id="additional-kubernetes-objects">Additional kubernetes objects<a class="headerlink" href="#additional-kubernetes-objects" title="Permanent link"></a></h3>
<p>Once both the ingress controller and the kube API server are configured to serve the webhook, add the you can configure the webhook with the following objects:</p>
<div class="codehilite"><pre><span></span><span class="nt">apiVersion</span><span class="p">:</span> <span class="l l-Scalar l-Scalar-Plain">v1</span>
<span class="nt">kind</span><span class="p">:</span> <span class="l l-Scalar l-Scalar-Plain">Service</span>