Skip to content
体验新版
项目
组织
正在加载...
登录
切换导航
打开侧边栏
李少辉-开发者
gitlab-foss
提交
c8fa9047
G
gitlab-foss
项目概览
李少辉-开发者
/
gitlab-foss
通知
15
Star
0
Fork
0
代码
文件
提交
分支
Tags
贡献者
分支图
Diff
Issue
0
列表
看板
标记
里程碑
合并请求
0
Wiki
0
Wiki
分析
仓库
DevOps
项目成员
Pages
G
gitlab-foss
项目概览
项目概览
详情
发布
仓库
仓库
文件
提交
分支
标签
贡献者
分支图
比较
Issue
0
Issue
0
列表
看板
标记
里程碑
合并请求
0
合并请求
0
Pages
分析
分析
仓库分析
DevOps
Wiki
0
Wiki
成员
成员
收起侧边栏
关闭侧边栏
动态
分支图
创建新Issue
提交
Issue看板
体验新版 GitCode,发现更多精彩内容 >>
提交
c8fa9047
编写于
8月 30, 2018
作者:
T
Thong Kuah
浏览文件
操作
浏览文件
下载
电子邮件补丁
差异文件
Add documentation for RBAC experiment support for GitLab Managed Apps
上级
bf0179b7
变更
1
隐藏空白更改
内联
并排
Showing
1 changed file
with
36 addition
and
0 deletion
+36
-0
doc/user/project/clusters/index.md
doc/user/project/clusters/index.md
+36
-0
未找到文件。
doc/user/project/clusters/index.md
浏览文件 @
c8fa9047
...
...
@@ -130,6 +130,42 @@ The newer [RBAC](https://kubernetes.io/docs/admin/authorization/rbac/)
authorization will be supported in a
[
future release
](
https://gitlab.com/gitlab-org/gitlab-ce/issues/29398
)
.
### Role-based access control (RBAC) experimental support
> [Introduced](https://gitlab.com/gitlab-org/gitlab-ce/merge_requests/21401) in GitLab 11.3.
Experimental support for RBAC-enabled clusters is currently hidden behind a feature flag. Once
you have enabled the feature flag, GitLab will now be configured to
create the necessary service accounts and privilleges in order to
install and run
[
GitLab Managed Applications
](
#installing-applications
)
.
You can enable the feature flag from a Rails console:
```
ruby
Feature
.
enable
(
'rbac_clusters'
)
```
If you are
[
adding an existing Kubernetes
cluster
](
#adding-an-existing-kubernetes-cluster
)
, you will be asked if
the cluster you are adding is a RBAC-enabled cluster. Enabling this
setting will create a
`tiller`
service account in the
`gitlab-managed-apps`
namespace when you install Helm Tiller into your cluster.
This service account will be added to the installed Helm Tiller
and will be used by Helm to install and run
[
GitLab Managed
Applications
](
#installing-applications
)
.
The
`tiller`
service account will have cluster-wide access (
`cluster-admin`
clusterrole).
If you are creating a
[
new GKE cluster via
GitLab
](
#adding-and-creating-a-new-gke-cluster-via-gitlab
)
, GitLab will
automatically create an RBAC-enabled cluster. A
`tiller`
service account
will be created as well and added to Helm Tiller.
NOTE:
**Note:**
Auto DevOps will not successfully complete in cluster that only has RBAC
authorization enabled. RBAC support for Auto DevOps is planned in a
[
future release
](
https://gitlab.com/gitlab-org/gitlab-ce/issues/44597
)
.
### Security of GitLab Runners
GitLab Runners have the
[
privileged mode
](
https://docs.gitlab.com/runner/executors/docker.html#the-privileged-mode
)
...
...
编辑
预览
Markdown
is supported
0%
请重试
或
添加新附件
.
添加附件
取消
You are about to add
0
people
to the discussion. Proceed with caution.
先完成此消息的编辑!
取消
想要评论请
注册
或
登录