Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Only listen to configured k8s namespaces. #1895

Merged
merged 7 commits into from Oct 10, 2017
Merged

Only listen to configured k8s namespaces. #1895

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
7 commits
Select commit Hold shift + click to select a range
c65a1f9
[kubernetes] Watch configured namespaces only.
timoreimann Jul 23, 2017
e293f95
[kubernetes] Log event type names only.
timoreimann Jul 24, 2017
7994272
Change default namespace to NamespaceAll ("").
timoreimann Aug 18, 2017
a9b8180
Switch to shared informer and reduce redundancy.
timoreimann Aug 20, 2017
d0ac8f5
Bump resync period to 1 minute.
timoreimann Aug 28, 2017
81ccd89
Increase sync period to 10 minutes.
timoreimann Oct 5, 2017
4bf41d5
Update documentation.
timoreimann Oct 7, 2017
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Jump to
Jump to file
Failed to load files.
Diff view
Diff view
11 changes: 7 additions & 4 deletions docs/user-guide/kubernetes.md
View file
Open in desktop
Expand Up @@ -15,12 +15,13 @@ on your machine, as it is the quickest way to get a local Kubernetes cluster set

### Role Based Access Control configuration (Kubernetes 1.6+ only)

Kubernetes introduces [Role Based Access Control (RBAC)](https://kubernetes.io/docs/admin/authorization/rbac/) in 1.6+ to allow fine-grained control of Kubernetes resources and api.
Kubernetes introduces [Role Based Access Control (RBAC)](https://kubernetes.io/docs/admin/authorization/rbac/) in 1.6+ to allow fine-grained control of Kubernetes resources and API.

If your cluster is configured with RBAC, you may need to authorize Træfik to use the Kubernetes API using ClusterRole and ClusterRoleBinding resources:
If your cluster is configured with RBAC, you will need to authorize Træfik to use the Kubernetes API. There are two ways to set up the proper permission: Via namespace-specific RoleBindings or a single, global ClusterRoleBinding.

!!! note
your cluster may have suitable ClusterRoles already setup, but the following should work everywhere
RoleBindings per namespace enable to restrict granted permissions to the very namespaces only that Træfik is watching over, thereby following the least-privileges principle. This is the preferred approach if Træfik is not supposed to watch all namespaces, and the set of namespaces does not change dynamically. Otherwise, a single ClusterRoleBinding must be employed.

For the sake of simplicity, this guide will use a ClusterRoleBinding:

```yaml
---
Expand Down Expand Up @@ -69,6 +70,8 @@ subjects:
kubectl apply -f https://raw.githubusercontent.com/containous/traefik/master/examples/k8s/traefik-rbac.yaml
```

For namespaced restrictions, one RoleBinding is required per watched namespace along with a corresponding configuration of Træfik's `kubernetes.namespaces` parameter.

## Deploy Træfik using a Deployment or DaemonSet

It is possible to use Træfik with a [Deployment](https://kubernetes.io/docs/concepts/workloads/controllers/deployment/) or a [DaemonSet](https://kubernetes.io/docs/concepts/workloads/controllers/daemonset/) object,
Expand Down