Skip to content

Commit

Permalink
Merge pull request helm#3680 from bacongobbler/fix-doc-style
Browse files Browse the repository at this point in the history
add newline after header
  • Loading branch information
Matthew Fisher authored Mar 14, 2018
2 parents 06f7b7c + 4214997 commit b335bfd
Showing 1 changed file with 1 addition and 0 deletions.
1 change: 1 addition & 0 deletions docs/securing_installation.md
Original file line number Diff line number Diff line change
Expand Up @@ -41,6 +41,7 @@ Helm and Tiller are designed to install, remove, and modify logical applications
Specific users and teams -- developers, operators, system and network administrators -- will need their own portion of the cluster in which they can use Helm and Tiller without risking other portions of the cluster. This means using a Kubernetes cluster with RBAC enabled and Tiller configured to enforce them. For more information about using RBAC in Kubernetes, see [Using RBAC Authorization](rbac.md).

#### Tiller and User Permissions

Tiller in its current form does not provide a way to map user credentials to specific permissions within Kubernetes. When Tiller is running inside of the cluster, it operates with the permissions of its service account. If no service account name is supplied to Tiller, it runs with the default service account for that namespace. This means that all Tiller operations on that server are executed using the Tiller pod's credentials and permissions.

To properly limit what Tiller itself can do, the standard Kubernetes RBAC mechanisms must be attached to Tiller, including Roles and RoleBindings that place explicit limits on what things a Tiller instance can install, and where.
Expand Down

0 comments on commit b335bfd

Please sign in to comment.