mirrors/velero
1
0
Fork 0
mirror of https://github.com/vmware-tanzu/velero.git synced 2026-09-28 18:55:46 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

add velero.io site content, move docs to under site/docs (#1489)

Browse Source 
* Adding in Jekyll site | Adjusting gitignore for Jekyll build | Moving docs to site folder

Signed-off-by: Lee Springer <lee@smalltalk.agency>

Adding in Jekyll site | Adjusting gitignore for Jekyll build | Moving docs to site folder

Signed-off-by: Lee Springer <lee@smalltalk.agency>

* Restore main.go to original location

Signed-off-by: Lee Springer <lee@smalltalk.agency>

* Updates to footer

Signed-off-by: Lee Springer <lee@smalltalk.agency>

* Updates to homepage links

Signed-off-by: Lee Springer <lee@smalltalk.agency>

* Content updates

Signed-off-by: Lee Springer <lee@smalltalk.agency>
This commit is contained in:
Lee Springer
2019-05-17 10:56:03 -07:00
committed by Steve Kriss
parent 5d8df26b35
commit d995018a3e
840 changed files with 47509 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
site/docs/master/rbac.md
+47
View File
@@ -0,0 +1,47 @@
# Run Velero more securely with restrictive RBAC settings
By default Velero runs with an RBAC policy of ClusterRole `cluster-admin`. This is to make sure that Velero can back up or restore anything in your cluster. But `cluster-admin` access is wide open -- it gives Velero components access to everything in your cluster. Depending on your environment and your security needs, you should consider whether to configure additional RBAC policies with more restrictive access.
**Note:** Roles and RoleBindings are associated with a single namespaces, not with an entire cluster. PersistentVolume backups are associated only with an entire cluster. This means that any backups or restores that use a restrictive Role and RoleBinding pair can manage only the resources that belong to the namespace. You do not need a wide open RBAC policy to manage PersistentVolumes, however. You can configure a ClusterRole and ClusterRoleBinding that allow backups and restores only of PersistentVolumes, not of all objects in the cluster.
For more information about RBAC and access control generally in Kubernetes, see the Kubernetes documentation about [access control][1], [managing service accounts][2], and [RBAC authorization][3].
## Set up Roles and RoleBindings
Here's a sample Role and RoleBinding pair.
```yaml
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
namespace: YOUR_NAMESPACE_HERE
name: ROLE_NAME_HERE
labels:
component: velero
rules:
- apiGroups:
- velero.io
verbs:
- "*"
resources:
- "*"
```
```yaml
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
name: ROLEBINDING_NAME_HERE
subjects:
- kind: ServiceAccount
name: YOUR_SERVICEACCOUNT_HERE
roleRef:
kind: Role
name: ROLE_NAME_HERE
apiGroup: rbac.authorization.k8s.io
```
[1]: https://kubernetes.io/docs/reference/access-authn-authz/controlling-access/
[2]: https://kubernetes.io/docs/reference/access-authn-authz/service-accounts-admin/
[3]: https://kubernetes.io/docs/reference/access-authn-authz/rbac/
[4]: namespace.md