c12s-kubespray/docs
Bogdan Dobrelya cb2e5ac776 Drop linux capabilities and rework users/groups
* Drop linux capabilities for unprivileged containerized
  worlkoads Kargo configures for deployments.
* Configure required securityContext/user/group/groups for kube
  components' static manifests, etcd, calico-rr and k8s apps,
  like dnsmasq daemonset.
* Rework cloud-init (etcd) users creation for CoreOS.
* Fix nologin paths, adjust defaults for addusers role and ensure
  supplementary groups membership added for users.
* Add netplug user for network plugins (yet unused by privileged
  networking containers though).
* Grant the kube and netplug users read access for etcd certs via
  the etcd certs group.
* Grant group read access to kube certs via the kube cert group.
* Remove priveleged mode for calico-rr and run it under its uid/gid
  and supplementary etcd_cert group.
* Adjust docs.
* Align cpu/memory limits and dropped caps with added rkt support
  for control plane.

Signed-off-by: Bogdan Dobrelya <bogdando@mail.ru>
2017-01-20 08:50:42 +01:00
..
figures Introduce dns_mode and resolvconf_mode and implement docker_dns mode 2017-01-05 23:38:51 +01:00
ansible.md Docs updates 2017-01-11 15:39:35 +01:00
aws.md changed to the correct link 2016-09-29 17:44:24 +03:00
azure.md Add documentation link for contrib/azurerm 2016-12-13 16:30:52 +01:00
calico.md Add calico/routereflector support 2016-12-14 13:44:10 +01:00
cloud.md add documentation 2016-07-04 14:37:30 +02:00
comparisons.md Update docs 2017-01-09 16:32:55 +01:00
coreos.md add documentation 2016-07-04 14:37:30 +02:00
dns-stack.md Introduce dns_mode and resolvconf_mode and implement docker_dns mode 2017-01-05 23:38:51 +01:00
downloads.md Add download_always_pull check and sha256 for docker images 2016-12-20 17:02:09 +01:00
flannel.md add documentation 2016-07-04 14:37:30 +02:00
getting-started.md Docs updates 2017-01-11 15:39:35 +01:00
ha-mode.md Add doc updates. 2017-01-17 13:15:48 -06:00
large-deployments.md Systemd units, limits, and bin path fixes 2016-12-28 15:49:42 +01:00
netcheck.md Add advanced net check for DNS K8s app 2016-11-28 13:23:25 +01:00
openstack.md add documentation 2016-07-04 14:37:30 +02:00
roadmap.md Update roadmap.md 2016-11-17 12:44:30 -05:00
security.md Drop linux capabilities and rework users/groups 2017-01-20 08:50:42 +01:00
test_cases.md Add coreos-alpha weave manual CI builds 2016-12-22 11:00:31 +01:00
upgrades.md Add document outlining upgrade process 2016-12-07 16:33:08 +03:00
vagrant.md add documentation 2016-07-04 14:37:30 +02:00
vars.md Comment cloud providers private networks use cases 2017-01-02 11:40:56 +01:00