reinoud/flux2-hub-spoke-example
1
0
Fork 0
mirror of https://github.com/fluxcd/flux2-hub-spoke-example.git synced 2025-07-27 15:53:19 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

Add security considerations to docs

Browse source 
Signed-off-by: Stefan Prodan <stefan.prodan@gmail.com>
This commit is contained in:
Stefan Prodan 2024-04-10 18:40:44 +03:00
parent cdfd4393e6
commit f9b88a06f1
No known key found for this signature in database
GPG key ID: 3299AEB0E4085BAF
1 changed files with 20 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

20
README.md
View file

@ -196,6 +196,26 @@ ingress-nginx-controller 2/2 2
> deploying to production. For more information, see the guide
> [Promote Flux Helm Releases with GitHub Actions](https://fluxcd.io/flux/use-cases/gh-actions-helm-promotion/).
## Security considerations and dependency management
In the `deploy/tenants` dir we provision the tenant namespaces and RBAC resources. There are two types of tenants:
- cluster admins - have full access to the cluster resources and can deploy HelmReleases that contain CRD controllers
- app operators - have restricted access to the app namespaces and can't manage cluster-wide resources like CRDs
At bootstrap, Flux provisions the tenant namespaces and RBAC resources in the target clusters.
The `deploy/apps` HelmReleases are deployed using the `flux-restricted` service account while the
`deploy/infra-controllers` HelmReleases and the `deploy/infra-configs` custom resources
are deployed using the `flux-cluster-admin` service account.
To enforce the RBAC restrictions, and to provision the controllers before the custom resources, we use the
`dependsOn` feature in the `hub/staging.yaml` and `hub/production.yaml` to order the reconciliation like so:
1. `tenants` (namespaces, service accounts and role bindings resources)
2. `infra-controllers` (CRD controllers - depends on `tenants`)
3. `infra-configs` (cluster-wide custom resources - depends on `infra-controllers`)
4. `apps` (app workloads - depends on `infra-configs`)
## Testing
After making changes to the manifests, you can validate them locally with [kubeconform](https://github.com/yannh/kubeconform) by running: