Deploy GitHub Pages
This commit is contained in:
parent
bc6e898a19
commit
cf75938808
56 changed files with 483 additions and 475 deletions
|
|
@ -1341,14 +1341,14 @@
|
|||
<a href="https://github.com/kubernetes/ingress-nginx/edit/master/docs/deploy/validating-webhook.md" title="Edit this page" class="md-icon md-content__icon"></a>
|
||||
|
||||
|
||||
<h1 id="validating-webhook-admission-controller">Validating webhook (admission controller)<a class="headerlink" href="#validating-webhook-admission-controller" title="Permanent link">¶</a></h1>
|
||||
<h2 id="overview">Overview<a class="headerlink" href="#overview" title="Permanent link">¶</a></h2>
|
||||
<h1 id="validating-webhook-admission-controller">Validating webhook (admission controller)<a class="headerlink" href="#validating-webhook-admission-controller" title="Permanent link"> ¶</a></h1>
|
||||
<h2 id="overview">Overview<a class="headerlink" href="#overview" title="Permanent link"> ¶</a></h2>
|
||||
<p>Nginx ingress controller offers the option to validate ingresses before they enter the cluster, ensuring controller will generate a valid configuration.</p>
|
||||
<p>This controller is called, when <a href="https://kubernetes.io/docs/reference/access-authn-authz/admission-controllers/#validatingadmissionwebhook">ValidatingAdmissionWebhook</a> is enabled, by the Kubernetes API server each time a new ingress is to enter the cluster, and rejects objects for which the generated nginx configuration fails to be validated.</p>
|
||||
<p>This feature requires some further configuration of the cluster, hence it is an optional feature, this section explains how to enable it for your cluster.</p>
|
||||
<h2 id="configure-the-webhook">Configure the webhook<a class="headerlink" href="#configure-the-webhook" title="Permanent link">¶</a></h2>
|
||||
<h3 id="generate-the-webhook-certificate">Generate the webhook certificate<a class="headerlink" href="#generate-the-webhook-certificate" title="Permanent link">¶</a></h3>
|
||||
<h4 id="self-signed-certificate">Self signed certificate<a class="headerlink" href="#self-signed-certificate" title="Permanent link">¶</a></h4>
|
||||
<h2 id="configure-the-webhook">Configure the webhook<a class="headerlink" href="#configure-the-webhook" title="Permanent link"> ¶</a></h2>
|
||||
<h3 id="generate-the-webhook-certificate">Generate the webhook certificate<a class="headerlink" href="#generate-the-webhook-certificate" title="Permanent link"> ¶</a></h3>
|
||||
<h4 id="self-signed-certificate">Self signed certificate<a class="headerlink" href="#self-signed-certificate" title="Permanent link"> ¶</a></h4>
|
||||
<p>Validating webhook must be served using TLS, you need to generate a certificate. Note that kube API server is checking the hostname of the certificate, the common name of your certificate will need to match the service name.</p>
|
||||
<div class="admonition example">
|
||||
<p class="admonition-title">Example</p>
|
||||
|
|
@ -1357,7 +1357,7 @@
|
|||
</pre></div>
|
||||
|
||||
</div>
|
||||
<h5 id="using-kubernetes-ca">Using Kubernetes CA<a class="headerlink" href="#using-kubernetes-ca" title="Permanent link">¶</a></h5>
|
||||
<h5 id="using-kubernetes-ca">Using Kubernetes CA<a class="headerlink" href="#using-kubernetes-ca" title="Permanent link"> ¶</a></h5>
|
||||
<p>Kubernetes also provides primitives to sign a certificate request. Here is an example on how to use it</p>
|
||||
<div class="admonition example">
|
||||
<p class="admonition-title">Example</p>
|
||||
|
|
@ -1426,7 +1426,7 @@ kubectl create secret generic ingress-nginx.svc <span class="se">\</span>
|
|||
</pre></div>
|
||||
|
||||
</div>
|
||||
<h4 id="using-helm">Using helm<a class="headerlink" href="#using-helm" title="Permanent link">¶</a></h4>
|
||||
<h4 id="using-helm">Using helm<a class="headerlink" href="#using-helm" title="Permanent link"> ¶</a></h4>
|
||||
<p>To generate the certificate using helm, you can use the following snippet</p>
|
||||
<div class="admonition example">
|
||||
<p class="admonition-title">Example</p>
|
||||
|
|
@ -1436,7 +1436,7 @@ kubectl create secret generic ingress-nginx.svc <span class="se">\</span>
|
|||
</pre></div>
|
||||
|
||||
</div>
|
||||
<h3 id="ingress-controller-flags">Ingress controller flags<a class="headerlink" href="#ingress-controller-flags" title="Permanent link">¶</a></h3>
|
||||
<h3 id="ingress-controller-flags">Ingress controller flags<a class="headerlink" href="#ingress-controller-flags" title="Permanent link"> ¶</a></h3>
|
||||
<p>To enable the feature in the ingress controller, you <em>need</em> to provide 3 flags to the command line.</p>
|
||||
<table>
|
||||
<thead>
|
||||
|
|
@ -1464,10 +1464,10 @@ kubectl create secret generic ingress-nginx.svc <span class="se">\</span>
|
|||
</tr>
|
||||
</tbody>
|
||||
</table>
|
||||
<h3 id="kube-api-server-flags">kube API server flags<a class="headerlink" href="#kube-api-server-flags" title="Permanent link">¶</a></h3>
|
||||
<h3 id="kube-api-server-flags">kube API server flags<a class="headerlink" href="#kube-api-server-flags" title="Permanent link"> ¶</a></h3>
|
||||
<p>Validating webhook feature requires specific setup on the kube API server side. Depending on your kubernetes version, the flag can, or not, be enabled by default.
|
||||
To check that your kube API server runs with the required flags, please refer to the <a href="https://kubernetes.io/docs/reference/access-authn-authz/admission-controllers/#validatingadmissionwebhook">kubernetes</a> documentation.</p>
|
||||
<h3 id="additional-kubernetes-objects">Additional kubernetes objects<a class="headerlink" href="#additional-kubernetes-objects" title="Permanent link">¶</a></h3>
|
||||
<h3 id="additional-kubernetes-objects">Additional kubernetes objects<a class="headerlink" href="#additional-kubernetes-objects" title="Permanent link"> ¶</a></h3>
|
||||
<p>Once both the ingress controller and the kube API server are configured to serve the webhook, add the you can configure the webhook with the following objects:</p>
|
||||
<div class="codehilite"><pre><span></span><span class="nt">apiVersion</span><span class="p">:</span> <span class="l l-Scalar l-Scalar-Plain">v1</span>
|
||||
<span class="nt">kind</span><span class="p">:</span> <span class="l l-Scalar l-Scalar-Plain">Service</span>
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue