Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

docs(capabilities): add for sidecar, move schema to bottom of page #1429

Merged
merged 1 commit into from
Aug 7, 2023
Merged

docs(capabilities): add for sidecar, move schema to bottom of page #1429

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
28 changes: 19 additions & 9 deletions app/_src/production/dp-config/dpp-on-kubernetes.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -161,6 +161,16 @@

Notice how `kuma.io/service` is built on `<serviceName>_<namespace>_svc_<port>` and `kuma.io/protocol` is the `appProtocol` field of your service entry.

## Capabilities

{% if_version lte:2.3.x %}
The only required
[capability](https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container) for the sidecar is `NET_BIND_SERVICE`.
{% endif_version %}{% if_version gte:2.4.x %}
The sidecar doesn't need any [capabilities](https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container) and works with `drop: ["ALL"]`.
{% endif_version %} Use [`ContainerPatch`](#custom-container-configuration) to
control capabilities for the sidecar.

## Lifecycle

### Joining the mesh
Expand Down Expand Up @@ -236,20 +246,20 @@

{% warning %}
In the vast majority of cases you shouldn't need to override the sidecar and
init-container configurations. `ContainerPatch` is a feature which requires good
init container configurations. `ContainerPatch` is a feature which requires good
understanding of both {{site.mesh_product_name}} and Kubernetes.
{% endwarning %}

The specification of `ContainerPatch` consists of the list of [jsonpatch](https://datatracker.ietf.org/doc/html/rfc6902)
strings which describe the modifications to be performed.
A `ContainerPatch` specification consists of the list of [JSON patch](https://datatracker.ietf.org/doc/html/rfc6902)

Check failure on line 253 in app/_src/production/dp-config/dpp-on-kubernetes.md

View workflow job for this annotation

GitHub Actions / Lint docs 

[vale] reported by reviewdog 🐶
[Vale.Terms] Use 'json' instead of 'JSON'.

Raw Output:
{"message": "[Vale.Terms] Use 'json' instead of 'JSON'.", "location": {"path": "app/_src/production/dp-config/dpp-on-kubernetes.md", "range": {"start": {"line": 253, "column": 59}}}, "severity": "ERROR"}
strings that describe the modifications. Consult [the entire
resource schema](#schema).

### Example

{% warning %}
When using ContainerPath, every `value` field must be valid JSON.
When using ContainerPath, every `value` field must be a string containing valid JSON.

Check failure on line 260 in app/_src/production/dp-config/dpp-on-kubernetes.md

View workflow job for this annotation

GitHub Actions / Lint docs 

[vale] reported by reviewdog 🐶
[Vale.Terms] Use 'json' instead of 'JSON'.

Raw Output:
{"message": "[Vale.Terms] Use 'json' instead of 'JSON'.", "location": {"path": "app/_src/production/dp-config/dpp-on-kubernetes.md", "range": {"start": {"line": 260, "column": 81}}}, "severity": "ERROR"}
{% endwarning %}


```yaml
apiVersion: kuma.io/v1alpha1
kind: ContainerPatch
Expand Down Expand Up @@ -418,10 +428,6 @@
If a workload refers to a `ContainerPatch` which does not exist, the injection
will explicitly fail and log the failure.

### Schema

{% json_schema kuma.io_containerpatches type=crd %}

## Direct access to services

By default, on Kubernetes data plane proxies communicate with each other by leveraging the `ClusterIP` address of the `Service` resources. Also by default, any request made to another service is automatically load balanced client-side by the data plane proxy that originates the request (they are load balanced by the local Envoy proxy sidecar proxy).
Expand Down Expand Up @@ -467,3 +473,7 @@
{% warning %}
Using `*` to directly access every service is a resource intensive operation, so we must use it carefully.
{% endwarning %}

### Schema

{% json_schema kuma.io_containerpatches type=crd %}

Check failure on line 479 in app/_src/production/dp-config/dpp-on-kubernetes.md

View workflow job for this annotation

GitHub Actions / Lint docs 

[vale] reported by reviewdog 🐶
[Vale.Terms] Use 'CRD' instead of 'crd'.

Raw Output:
{"message": "[Vale.Terms] Use 'CRD' instead of 'crd'.", "location": {"path": "app/_src/production/dp-config/dpp-on-kubernetes.md", "range": {"start": {"line": 479, "column": 46}}}, "severity": "ERROR"}
Loading