diff --git a/concepts/index.xml b/concepts/index.xml index 1efbb70d..58ed32b6 100644 --- a/concepts/index.xml +++ b/concepts/index.xml @@ -54,7 +54,7 @@ The ManagedClusterSet and ManagedClusterSetBinding API v1beta1 version will no l Mon, 01 Jan 0001 00:00:00 +0000 https://open-cluster-management.io/concepts/manifestwork/ - What is ManifestWork Status tracking Fine-grained field values tracking Garbage collection Delete options Resource Race and Adoption Permission setting for work agent Treating defaulting/immutable fields in API Dynamic identity authorization What is ManifestWork ManifestWork is used to define a group of Kubernetes resources on the hub to be applied to the managed cluster. In the open-cluster-management project, a ManifestWork resource must be created in the cluster namespace. + What is ManifestWork Status tracking Fine-grained field values tracking Garbage collection Delete options Resource Race and Adoption Permission setting for work agent Treating defaulting/immutable fields in API Dynamic identity authorization What is ManifestWork ManifestWork is used to define a group of Kubernetes resources on the hub to be applied to the managed cluster. In the open-cluster-management project, a ManifestWork resource must be created in the cluster namespace. diff --git a/concepts/manifestwork/index.html b/concepts/manifestwork/index.html index be5f8ea8..df769b90 100644 --- a/concepts/manifestwork/index.html +++ b/concepts/manifestwork/index.html @@ -267,10 +267,7 @@

ManifestWork

  • Resource Race and Adoption
    • - - -
  • Permission setting for work agent -
    @@ -516,7 +513,7 @@

    Delete options

    manifest will not be updated by it.

    Instead of create the second ManifestWork, user can also set HPA for this deployment. HPA will also take the ownership of replicas, and the update of replicas field in the first ManifestWork will return conflict condition.

    -

    Permission setting for work agent

    +

    Permission setting for work agent

    All workload manifests are applied to the managed cluster by the work agent, and by default the work agent has the following permission for the managed cluster:

    Below is an example use ManifestWork to give klusterlet-work-sa permission for resource machines.cluster.x-k8s.io

    + +
    apiVersion: work.open-cluster-management.io/v1
+kind: ManifestWork
+metadata:
+  namespace: cluster1
+  name: permission-set
+spec:
+  workload:
+    manifests:
+      - apiVersion: rbac.authorization.k8s.io/v1
+        kind: ClusterRole
+        metadata:
+          name: open-cluster-management:klusterlet-work:my-role
+          labels:
+            open-cluster-management.io/aggregate-to-work: "true"  # with this label, the clusterRole will be selected to aggregate
+        rules:
+          # Allow agent to managed machines
+          - apiGroups: ["cluster.x-k8s.io"]
+            resources: ["machines"]
+            verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
+
    apiVersion: work.open-cluster-management.io/v1
 kind: ManifestWork
 metadata:
diff --git a/index.xml b/index.xml
index 34915ced..404de0c6 100644
--- a/index.xml
+++ b/index.xml
@@ -164,7 +164,7 @@ The ManagedClusterSet and ManagedClusterSetBinding API v1beta1 version will no l
       Mon, 01 Jan 0001 00:00:00 +0000
       
       https://open-cluster-management.io/concepts/manifestwork/
-      What is ManifestWork Status tracking  Fine-grained field values tracking   Garbage collection  Delete options   Resource Race and Adoption   Permission setting for work agent  Treating defaulting/immutable fields in API Dynamic identity authorization     What is ManifestWork ManifestWork is used to define a group of Kubernetes resources on the hub to be applied to the managed cluster. In the open-cluster-management project, a ManifestWork resource must be created in the cluster namespace.
+      What is ManifestWork Status tracking  Fine-grained field values tracking   Garbage collection  Delete options   Resource Race and Adoption Permission setting for work agent Treating defaulting/immutable fields in API Dynamic identity authorization     What is ManifestWork ManifestWork is used to define a group of Kubernetes resources on the hub to be applied to the managed cluster. In the open-cluster-management project, a ManifestWork resource must be created in the cluster namespace.
     
     
     
diff --git a/zh/concepts/index.xml b/zh/concepts/index.xml
index 3e10fb67..7913f580 100644
--- a/zh/concepts/index.xml
+++ b/zh/concepts/index.xml
@@ -57,7 +57,7 @@ The ManagedClusterSet and ManagedClusterSetBinding API v1beta1 version will no l
       Mon, 01 Jan 0001 00:00:00 +0000
       
       https://open-cluster-management.io/zh/concepts/manifestwork/
-      What is ManifestWork Status tracking  Fine-grained field values tracking   Garbage collection  Delete options   Resource Race and Adoption   Permission setting for work agent  Treating defaulting/immutable fields in API Dynamic identity authorization     What is ManifestWork ManifestWork is used to define a group of Kubernetes resources on the hub to be applied to the managed cluster. In the open-cluster-management project, a ManifestWork resource must be created in the cluster namespace.
+      What is ManifestWork Status tracking  Fine-grained field values tracking   Garbage collection  Delete options   Resource Race and Adoption Permission setting for work agent Treating defaulting/immutable fields in API Dynamic identity authorization     What is ManifestWork ManifestWork is used to define a group of Kubernetes resources on the hub to be applied to the managed cluster. In the open-cluster-management project, a ManifestWork resource must be created in the cluster namespace.
     
     
     
diff --git a/zh/concepts/manifestwork/index.html b/zh/concepts/manifestwork/index.html
index c0014eda..ea040a44 100644
--- a/zh/concepts/manifestwork/index.html
+++ b/zh/concepts/manifestwork/index.html
@@ -271,10 +271,7 @@ 
    资源下发
  • Resource Race and Adoption
    • - - -
  • Permission setting for work agent -
    @@ -520,7 +517,7 @@

    Delete options

    manifest will not be updated by it.

    Instead of create the second ManifestWork, user can also set HPA for this deployment. HPA will also take the ownership of replicas, and the update of replicas field in the first ManifestWork will return conflict condition.

    -

    Permission setting for work agent

    +

    Permission setting for work agent

    All workload manifests are applied to the managed cluster by the work agent, and by default the work agent has the following permission for the managed cluster:

      @@ -543,12 +540,38 @@

      Permission setting for work agent

    • add permission on the hub cluster by another ManifestWork, the ManifestWork includes
        -
      • an aggregated clusterRole for your to-be-applied resources to the existing admin clusterRole
        • +
      • an clusterRole with label "open-cluster-management.io/aggregate-to-work": "true" for your to-be-applied +resources, the rules defined in the clusterRole will be aggregated to the work agent(OCM version >= v0.12.0)
      • OR role/clusterRole roleBinding/clusterRoleBinding for the klusterlet-work-sa service account

    Below is an example use ManifestWork to give klusterlet-work-sa permission for resource machines.cluster.x-k8s.io

    +
      +
    • Option 1: Use aggregated clusterRole
      • +
    +
    apiVersion: work.open-cluster-management.io/v1
+kind: ManifestWork
+metadata:
+  namespace: cluster1
+  name: permission-set
+spec:
+  workload:
+    manifests:
+      - apiVersion: rbac.authorization.k8s.io/v1
+        kind: ClusterRole
+        metadata:
+          name: open-cluster-management:klusterlet-work:my-role
+          labels:
+            open-cluster-management.io/aggregate-to-work: "true"  # with this label, the clusterRole will be selected to aggregate
+        rules:
+          # Allow agent to managed machines
+          - apiGroups: ["cluster.x-k8s.io"]
+            resources: ["machines"]
+            verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
+
      +
    • Option 2: Use clusterRole and clusterRoleBinding
      • +
    apiVersion: work.open-cluster-management.io/v1
 kind: ManifestWork
 metadata:
diff --git a/zh/index.xml b/zh/index.xml
index 87bf7224..a9a91298 100644
--- a/zh/index.xml
+++ b/zh/index.xml
@@ -166,7 +166,7 @@ The ManagedClusterSet and ManagedClusterSetBinding API v1beta1 version will no l
       Mon, 01 Jan 0001 00:00:00 +0000
       
       https://open-cluster-management.io/zh/concepts/manifestwork/
-      What is ManifestWork Status tracking  Fine-grained field values tracking   Garbage collection  Delete options   Resource Race and Adoption   Permission setting for work agent  Treating defaulting/immutable fields in API Dynamic identity authorization     What is ManifestWork ManifestWork is used to define a group of Kubernetes resources on the hub to be applied to the managed cluster. In the open-cluster-management project, a ManifestWork resource must be created in the cluster namespace.
+      What is ManifestWork Status tracking  Fine-grained field values tracking   Garbage collection  Delete options   Resource Race and Adoption Permission setting for work agent Treating defaulting/immutable fields in API Dynamic identity authorization     What is ManifestWork ManifestWork is used to define a group of Kubernetes resources on the hub to be applied to the managed cluster. In the open-cluster-management project, a ManifestWork resource must be created in the cluster namespace.