DevFW-CICD/ingress-nginx-helm
12
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Docs: Add a multi-tenant warning. (#12099)

Browse source 
Co-authored-by: James Strong <strong.james.e@gmail.com>
This commit is contained in:
k8s-infra-cherrypick-robot 2024-10-04 04:51:35 -07:00 committed by GitHub
parent d640ceaadf
commit 6cc603a63a
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
3 changed files with 14 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
README.md
View file

@ -17,6 +17,8 @@ balancer.
See the [Getting Started](https://kubernetes.github.io/ingress-nginx/deploy/) document.
Do not use in multi-tenant Kubernetes production installations. This project assumes that users that can create Ingress objects are administrators of the cluster. See the [FAQ](https://kubernetes.github.io/ingress-nginx/faq/#faq) for more.
## Troubleshooting
If you encounter issues, review the [troubleshooting docs](docs/troubleshooting.md),

2
docs/deploy/hardening-guide.md
View file

@ -1,6 +1,8 @@
# Hardening Guide
Do not use in multi-tenant Kubernetes production installations. This project assumes that users that can create Ingress objects are administrators of the cluster.
## Overview
There are several ways to do hardening and securing of nginx. In this documentation two guides are used, the guides are
overlapping in some points:

10
docs/faq.md
View file

@ -1,6 +1,16 @@
# FAQ
## Multi-tenant Kubernetes
Do not use in multi-tenant Kubernetes production installations. This project assumes that users that can create Ingress objects are administrators of the cluster.
For example, the Ingress NGINX control plane has global and per Ingress configuration options that make it insecure, if enabled, in a multi-tenant environment.
For example, enabling snippets, a global configuration, allows any Ingress object to run arbitrary Lua code that could affect the security of all Ingress objects that a controller is running.
We changed the default to allow snippets to `false` in https://github.com/kubernetes/ingress-nginx/pull/10393.
## Multiple controller in one cluster
Question - How can I easily install multiple instances of the ingress-nginx controller in the same cluster?