github/kubernetes
1
0
Fork 0
mirror of https://github.com/k3s-io/kubernetes.git synced 2026-01-04 23:17:50 +00:00
Code Issues Projects Releases Wiki Activity

Service account proposal.

Browse Source 
COMMIT_BLOCKED_ON_GENDOCS
This commit is contained in:
Eric Tune
2014-11-11 10:52:31 -08:00
parent 17feadf977
commit 38a85ef81e
3 changed files with 171 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
docs/design/security_context.md
View File

@@ -172,13 +172,13 @@ type IDMapping struct {
// IDMappingRange specifies a mapping between container IDs and node IDs
type IDMappingRange struct {
// ContainerID is the starting container ID
// ContainerID is the starting container UID or GID
ContainerID int
// HostID is the starting host ID
// HostID is the starting host UID or GID
HostID int
// Length is the length of the ID range
// Length is the length of the UID/GID range
Length int
}
@@ -187,4 +187,4 @@ type IDMappingRange struct {
#### Security Context Lifecycle
The lifecycle of a security context will be tied to that of a service account. It is expected that a service account with a default security context will be created for every Kubernetes namespace (without administrator intervention). If resources need to be allocated when creating a security context (for example, assign a range of host uids/gids), a pattern such as [finalizers](https://github.com/GoogleCloudPlatform/kubernetes/issues/3585) can be used before declaring the security context / service account / namespace ready for use.
The lifecycle of a security context will be tied to that of a service account. It is expected that a service account with a default security context will be created for every Kubernetes namespace (without administrator intervention). If resources need to be allocated when creating a security context (for example, assign a range of host uids/gids), a pattern such as [finalizers](https://github.com/GoogleCloudPlatform/kubernetes/issues/3585) can be used before declaring the security context / service account / namespace ready for use.