1614027cd4
* clarify link * Add section headers * console blocks * grpc example json was not valid * multi-tls update text The preceding point 1 related to4f2cb51ef8/ingress/controllers/nginx/examples/ingress.yamland the deployments referenced in4f2cb51ef8/ingress/controllers/nginx/examples/README.mdThey are not relevant to the current instructions. * add whitespace around parens * grammar setup would be a proper noun, but it is not the intended concept, which is a state * grammar * is-only * via * Use bullets for choices * ingress-controller nginx is a distinct brand. generally this repo talks about ingress-controller, although it is quite inconsistent about how... * drop stray paren * OAuth is a brand and needs an article here also GitHub is a brand * Indent text under numbered lists * use e.g. * Document that customer header config maps changes do not trigger updates This should be removed if https://github.com/kubernetes/ingress-nginx/issues/5238 is fixed. * article * period * infinitive verb + period * clarify that the gRPC server is responsible for listening for TCP traffic and not some other part of the backend application * avoid using ; and reword * whitespace * brand: gRPC * only-does is the right form `for` adds nothing here * spelling: GitHub * punctuation `;` is generally not the right punctuation... * drop stray `to` * sentence * backticks * fix link * Improve readability of compare/vs * Renumber list * punctuation * Favor Ingress-NGINX and Ingress NGINX * Simplify custom header restart text * Undo typo damage Co-authored-by: Josh Soref <jsoref@users.noreply.github.com>
17 lines
868 B
Markdown
17 lines
868 B
Markdown
# Pod Security Policy (PSP)
|
|
|
|
In most clusters today, by default, all resources (e.g. `Deployments` and `ReplicatSets`)
|
|
have permissions to create pods.
|
|
Kubernetes however provides a more fine-grained authorization policy called
|
|
[Pod Security Policy (PSP)](https://kubernetes.io/docs/concepts/policy/pod-security-policy/).
|
|
|
|
PSP allows the cluster owner to define the permission of each object, for example creating a pod.
|
|
If you have PSP enabled on the cluster, and you deploy ingress-nginx,
|
|
you will need to provide the `Deployment` with the permissions to create pods.
|
|
|
|
Before applying any objects, first apply the PSP permissions by running:
|
|
```console
|
|
kubectl apply -f https://raw.githubusercontent.com/kubernetes/ingress-nginx/main/docs/examples/psp/psp.yaml
|
|
```
|
|
|
|
Note: PSP permissions must be granted before the creation of the `Deployment` and the `ReplicaSet`.
|