some improved formatting.
This commit is contained in:
parent
a5b858ff27
commit
a78d857a87
39
README.md
39
README.md
@ -7,13 +7,15 @@ Basic idea:
|
|||||||
|
|
||||||
Allowed communication betwen applications is configured as follows:
|
Allowed communication betwen applications is configured as follows:
|
||||||
|
|
||||||
|
```
|
||||||
communication:
|
communication:
|
||||||
- from: app1
|
- from: app1
|
||||||
to: app2
|
to: app2
|
||||||
ports:
|
ports:
|
||||||
- 80
|
- 80
|
||||||
- linkerd-admin
|
- linkerd-admin
|
||||||
|
```
|
||||||
|
|
||||||
Ports are optional. When omitted all ports are intended
|
Ports are optional. When omitted all ports are intended
|
||||||
|
|
||||||
There are pre-defined applications such as api-server.
|
There are pre-defined applications such as api-server.
|
||||||
@ -28,11 +30,8 @@ There are also standard capablities for an application such as:
|
|||||||
* linkerd: addes egress to linkerd-jaeger, egress to linkerd, ingress from
|
* linkerd: addes egress to linkerd-jaeger, egress to linkerd, ingress from
|
||||||
linkerd-viz
|
linkerd-viz
|
||||||
|
|
||||||
capablities can also be defined at the namespace level, which means they
|
|
||||||
apply to each pod in the namespace.
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
```
|
||||||
networks:
|
networks:
|
||||||
- name: internet
|
- name: internet
|
||||||
cidr: 0.0.0.0/0
|
cidr: 0.0.0.0/0
|
||||||
@ -40,8 +39,11 @@ networks:
|
|||||||
- 10.0.0.0/8
|
- 10.0.0.0/8
|
||||||
- 172.16.0.0/12
|
- 172.16.0.0/12
|
||||||
- 192.168.0.0/16
|
- 192.168.0.0/16
|
||||||
|
```
|
||||||
|
|
||||||
|
capablities can also be defined at the namespace level, which means they
|
||||||
|
apply to each pod in the namespace
|
||||||
|
```
|
||||||
namespaces:
|
namespaces:
|
||||||
- namespace: wamblee-org
|
- namespace: wamblee-org
|
||||||
capabilities:
|
capabilities:
|
||||||
@ -75,32 +77,11 @@ communications:
|
|||||||
- httpd-wamblee-org
|
- httpd-wamblee-org
|
||||||
to:
|
to:
|
||||||
- nexus-server
|
- nexus-server
|
||||||
porst:
|
ports:
|
||||||
- 8081
|
- 8081
|
||||||
- 8082
|
- 8082
|
||||||
|
|
||||||
|
|
||||||
Handling of capabilities:
|
|
||||||
1. capabilities at namespace level is defined a template that gets the namespace name.
|
|
||||||
|
|
||||||
Ingress template
|
|
||||||
|
|
||||||
from:
|
|
||||||
- linkerd-viz
|
|
||||||
to:
|
|
||||||
- {{ application }}
|
|
||||||
|
|
||||||
egress template
|
|
||||||
|
|
||||||
from:
|
|
||||||
- {{ application }}
|
|
||||||
to:
|
|
||||||
- linkerd-jaeger
|
|
||||||
- linkerd
|
|
||||||
|
|
||||||
The templates are evaluated for an application and then parsed, and added
|
|
||||||
to the allowed communications.
|
|
||||||
|
|
||||||
|
|
||||||
Linkerd extension:
|
Linkerd extension:
|
||||||
* for each application an optional service account is defined, when not
|
* for each application an optional service account is defined, when not
|
||||||
|
Loading…
Reference in New Issue
Block a user