-
Book Overview & Buying
-
Table Of Contents
-
Feedback & Rating

Kubernetes – An Enterprise Guide
By :

So far in this chapter, we’ve built policies that are self-contained. When checking whether an image is coming from a pre-authorized registry, the only data we needed was from the policy and the containers. This is often not enough information to make a policy decision. In this section, we’ll work on building a policy that relies on other objects in your cluster to make policy decisions.
Before diving into the implementation, let’s talk about the use case. It’s common to limit which namespaces can have Ingress
objects. If a namespace hosts a workload that doesn’t require any inbound access, why allow an Ingress
object at all? You may think you can enforce this using RBAC by limiting what tenants are allowed to deploy using a Role
and RoleBinding
, but this has some limitations:
admin
and edit ClusterRoles
are default aggregate ClusterRoles
, so you would need to create a new ClusterRole
that enumerates...