some improved formatting.
This commit is contained in:
		
							parent
							
								
									a5b858ff27
								
							
						
					
					
						commit
						a78d857a87
					
				
							
								
								
									
										35
									
								
								README.md
									
									
									
									
									
								
							
							
						
						
									
										35
									
								
								README.md
									
									
									
									
									
								
							| @ -7,12 +7,14 @@ Basic idea: | |||||||
| 
 | 
 | ||||||
| Allowed communication betwen applications is configured as follows: | Allowed communication betwen applications is configured as follows: | ||||||
| 
 | 
 | ||||||
|  | ``` | ||||||
| communication:  | communication:  | ||||||
| - from: app1 | - from: app1 | ||||||
|   to: app2 |   to: app2 | ||||||
|   ports: |   ports: | ||||||
|     - 80 |     - 80 | ||||||
|     - linkerd-admin |     - linkerd-admin | ||||||
|  | ``` | ||||||
| 
 | 
 | ||||||
| Ports are optional. When omitted all ports are intended | Ports are optional. When omitted all ports are intended | ||||||
| 
 | 
 | ||||||
| @ -28,11 +30,8 @@ There are also standard capablities for an application such as: | |||||||
| * linkerd: addes egress to linkerd-jaeger, egress to linkerd, ingress from | * linkerd: addes egress to linkerd-jaeger, egress to linkerd, ingress from | ||||||
|   linkerd-viz |   linkerd-viz | ||||||
|    |    | ||||||
| capablities can also be defined at the namespace level, which means they  |  | ||||||
| apply to each pod in the namespace.  |  | ||||||
| 
 |  | ||||||
| 
 |  | ||||||
| 
 | 
 | ||||||
|  | ``` | ||||||
| networks:  | networks:  | ||||||
|   - name: internet |   - name: internet | ||||||
|     cidr: 0.0.0.0/0 |     cidr: 0.0.0.0/0 | ||||||
| @ -40,8 +39,11 @@ networks: | |||||||
|       - 10.0.0.0/8 |       - 10.0.0.0/8 | ||||||
|       - 172.16.0.0/12 |       - 172.16.0.0/12 | ||||||
|       - 192.168.0.0/16  |       - 192.168.0.0/16  | ||||||
|  | ``` | ||||||
| 
 | 
 | ||||||
| 
 | capablities can also be defined at the namespace level, which means they | ||||||
|  | apply to each pod in the namespace | ||||||
|  | ``` | ||||||
| namespaces:       | namespaces:       | ||||||
| - namespace: wamblee-org  | - namespace: wamblee-org  | ||||||
|   capabilities: |   capabilities: | ||||||
| @ -75,32 +77,11 @@ communications: | |||||||
|     - httpd-wamblee-org |     - httpd-wamblee-org | ||||||
|   to: |   to: | ||||||
|     - nexus-server |     - nexus-server | ||||||
|   porst: |   ports: | ||||||
|     - 8081 |     - 8081 | ||||||
|     - 8082 |     - 8082 | ||||||
|      |      | ||||||
|   |   | ||||||
| Handling of capabilities:  |  | ||||||
| 1. capabilities at namespace level is defined a template that gets the namespace name.   |  | ||||||
| 
 |  | ||||||
|    Ingress template |  | ||||||
|        |  | ||||||
|       from:  |  | ||||||
|         - linkerd-viz |  | ||||||
|       to: |  | ||||||
|         - {{ application }} |  | ||||||
|          |  | ||||||
|    egress template |  | ||||||
|         |  | ||||||
|       from:  |  | ||||||
|         - {{ application }}  |  | ||||||
|       to:  |  | ||||||
|         - linkerd-jaeger |  | ||||||
|         - linkerd  |  | ||||||
|     |  | ||||||
|    The templates are evaluated for an application and then parsed, and added |  | ||||||
|    to the allowed communications.  |  | ||||||
| 
 |  | ||||||
| 
 | 
 | ||||||
| Linkerd extension:  | Linkerd extension:  | ||||||
| * for each application an optional service account is defined, when not  | * for each application an optional service account is defined, when not  | ||||||
|  | |||||||
		Loading…
	
		Reference in New Issue
	
	Block a user