From 52b85594a5b8146b46feffd75625d67245e46cff Mon Sep 17 00:00:00 2001 From: Dawn W <51414965+DawnWood-Docker@users.noreply.github.com> Date: Tue, 16 Jul 2019 08:42:59 -0700 Subject: [PATCH] Update admission-controllers.md --- ee/ucp/admin/configure/admission-controllers.md | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/ee/ucp/admin/configure/admission-controllers.md b/ee/ucp/admin/configure/admission-controllers.md index bc78412334..3d4ab0a076 100644 --- a/ee/ucp/admin/configure/admission-controllers.md +++ b/ee/ucp/admin/configure/admission-controllers.md @@ -30,16 +30,16 @@ correctly removed from UCP's Node scheduling authorization backend. - Simplifies creation of `RoleBindings` and `ClusterRoleBindings` resources by automatically converting user, organization, and team Subject names into their corresponding unique identifiers. - - Prevents users from deleting the builtin `cluster-admin` `ClusterRole` or + - Prevents users from deleting the built-in `cluster-admin` `ClusterRole` or `ClusterRoleBinding` resources. - Prevents under-privileged users from creating or updating `PersistintVolume` resources with host paths. - - Works in conjunction with the builtin `PodSecurityPolicies` admission + - Works in conjunction with the built-in `PodSecurityPolicies` admission controller to prevent under-privileged users from creating `Pods` with privileged options. - **CheckImageSigning** Enforces UCP's Docker Content Trust policy which, if enabled, requires that all -Pods use container images which have been digitally signed by trusted and +pods use container images which have been digitally signed by trusted and authorized users which are members of one or more teams in UCP. - **UCPNodeSelector** Adds a `com.docker.ucp.orchestrator.kubernetes:*` toleration to pods in the @@ -50,6 +50,6 @@ not run on swarm-only nodes, which UCP taints with affinity to prevent pods from running on manager nodes depending on UCP's settings. -**Note:** you cannot enable or disable your own admission controllers. For more information about why, see [Supportability of custom kubernetes flags in universal control plane](https://success.docker.com/article/supportability-of-custom-kubernetes-flags-in-universal-control-plane) +**Note:** you cannot enable or disable your own admission controllers. For more information, see [Supportability of custom kubernetes flags in universal control plane](https://success.docker.com/article/supportability-of-custom-kubernetes-flags-in-universal-control-plane) -For more information about pod security policies in Docker, see [Pod security policies](/ee/ucp/kubernetes/pod-security-policies.md). \ No newline at end of file +For more information about pod security policies in Docker, see [Pod security policies](/ee/ucp/kubernetes/pod-security-policies.md).