Bogdan Dobrelya 48e77cd8bb Drop linux capabilities and rework users/groups ... * Drop linux capabilities for unprivileged containerized worlkoads Kargo configures for deployments. * Configure required securityContext/user/group/groups for kube components' static manifests, etcd, calico-rr and k8s apps, like dnsmasq daemonset. * Rework cloud-init (etcd) users creation for CoreOS. * Fix nologin paths, adjust defaults for addusers role and ensure supplementary groups membership added for users. * Add netplug user for network plugins (yet unused by privileged networking containers though). * Grant the kube and netplug users read access for etcd certs via the etcd certs group. * Grant group read access to kube certs via the kube cert group. * Remove priveleged mode for calico-rr and run it under its uid/gid and supplementary etcd_cert group. * Adjust docs. * Align cpu/memory limits and dropped caps with added rkt support for control plane. Signed-off-by: Bogdan Dobrelya <bogdando@mail.ru>		2017-01-20 08:50:42 +01:00
..
check_certs.yml	Fix creation and sync of etcd certs	2016-12-28 14:21:17 +04:00
configure.yml	Drop non systemd OS types support	2017-01-02 12:14:03 +01:00
gen_certs.yml	Drop linux capabilities and rework users/groups	2017-01-20 08:50:42 +01:00
install_docker.yml	Allowing etcd to run via rkt	2017-01-03 10:10:38 -06:00
install_host.yml	Allowing etcd to run via rkt	2017-01-03 10:10:38 -06:00
install_rkt.yml	Allowing etcd to run via rkt	2017-01-03 10:10:38 -06:00
main.yml	Drop linux capabilities and rework users/groups	2017-01-20 08:50:42 +01:00
pre_upgrade.yml	Drop linux capabilities and rework users/groups	2017-01-20 08:50:42 +01:00
refresh_config.yml	Remove etcd-proxy from all nodes and use etcd multiaccess	2016-11-09 13:31:12 +03:00
set_cluster_health.yml	Rework ignore_errors to report no reds	2016-12-27 13:00:50 +01:00
set_facts.yml	Drop linux capabilities and rework users/groups	2017-01-20 08:50:42 +01:00