From bdb73a58edf36b85004dce99993e66c08d577d5e Mon Sep 17 00:00:00 2001 From: Cybozu Neco Date: Thu, 14 Nov 2024 10:17:55 +0000 Subject: [PATCH] update --- design.html | 2 +- helm.html | 1 + print.html | 3 ++- searchindex.js | 2 +- searchindex.json | 2 +- 5 files changed, 6 insertions(+), 4 deletions(-) diff --git a/design.html b/design.html index fa1e3ce..2b17a6f 100644 --- a/design.html +++ b/design.html @@ -243,7 +243,7 @@

Goals

  • Tenant users can create and delete sub-namespaces by creating and deleting a custom resource in a root or a sub-namespace.
  • Template namespace diff --git a/helm.html b/helm.html index e70a56e..1d57ce4 100644 --- a/helm.html +++ b/helm.html @@ -222,6 +222,7 @@

    Values

    controller.replicasint2Specify the number of replicas of the controller Pod. controller.resourcesobject{"requests":{"cpu":"100m","memory":"20Mi"}}Specify resources. controller.terminationGracePeriodSecondsint10Specify terminationGracePeriodSeconds. +webhook.allowCascadingDeletionboolfalseEnable to allow cascading deletion of namespaces. Accurate webhooks will only allow deletion of a namespace with children if this option is enabled. image.pullPolicystringnilAccurate image pullPolicy. image.repositorystring"ghcr.io/cybozu-go/accurate"Accurate image repository to use. image.tagstring{{ .Chart.AppVersion }}Accurate image tag to use. diff --git a/print.html b/print.html index e0808f0..f0a18d1 100644 --- a/print.html +++ b/print.html @@ -521,6 +521,7 @@

    Values

    controller.replicasint2Specify the number of replicas of the controller Pod. controller.resourcesobject{"requests":{"cpu":"100m","memory":"20Mi"}}Specify resources. controller.terminationGracePeriodSecondsint10Specify terminationGracePeriodSeconds. +webhook.allowCascadingDeletionboolfalseEnable to allow cascading deletion of namespaces. Accurate webhooks will only allow deletion of a namespace with children if this option is enabled. image.pullPolicystringnilAccurate image pullPolicy. image.repositorystring"ghcr.io/cybozu-go/accurate"Accurate image repository to use. image.tagstring{{ .Chart.AppVersion }}Accurate image tag to use. @@ -1120,7 +1121,7 @@

    Goals

  • Tenant users can create and delete sub-namespaces by creating and deleting a custom resource in a root or a sub-namespace.
  • Template namespace diff --git a/searchindex.js b/searchindex.js index db17a46..b3f4aa0 100644 --- a/searchindex.js +++ b/searchindex.js @@ -1 +1 @@ -Object.assign(window.search, {"doc_urls":["index.html#accurate-documentation","overview.html#overview","overview.html#soft-multi-tenancy-in-kubernetes","overview.html#what-is-accurate","overview.html#features","concepts.html#concepts","concepts.html#namespace-types","concepts.html#resource-propagation","concepts.html#propagating-generated-resources-deprecated","getting_started.html#getting-started","config.html#configurations","config.html#helm-chart-values","config.html#configuration-file","config.html#clusterrolebindings","config.html#feature-gates","setup.html#deploying-accurate","helm.html#accurate-helm-chart","helm.html#how-to-use-accurate-helm-repository","helm.html#quick-start","helm.html#installing-cert-manager","helm.html#installing-customresourcedefinitions-optional","helm.html#installing-the-chart","helm.html#values","helm.html#generate-manifests","install-plugin.html#installing-kubectl-plugin","install-plugin.html#installing-using-krew","install-plugin.html#installing-manually","usage.html#usage","info.html#showing-information","info.html#show-the-hierarchical-list-of-sub-namespaces","info.html#show-all-template-namespaces","info.html#show-the-properties-of-a-namespace","templates.html#setting-up-templates","templates.html#setting-a-namespace-as-a-template","templates.html#reverting-a-template-namespace-to-a-normal-one","templates.html#setting-a-reference-to-a-template-namespace","templates.html#unsetting-a-reference-to-a-template-namespace","propagation.html#propagating-resources","propagation.html#annotating-a-resource-for-propagation","propagation.html#annotating-a-resource-to-propagate-resources-created-from-it-deprecated","subnamespaces.html#sub-namespace-operations","subnamespaces.html#setting-a-namespace-as-a-root-namespace","subnamespaces.html#preparing-resources-for-tenant-users","subnamespaces.html#reverting-a-root-namespace-to-a-normal-one","subnamespaces.html#creating-a-sub-namespace","subnamespaces.html#creating-a-sub-namespace-with-additional-labelsannotations","subnamespaces.html#deleting-a-created-sub-namespace","subnamespaces.html#changing-the-parent-of-a-sub-namespace","subnamespaces.html#converting-a-normal-namespace-to-a-sub-namespace","subnamespaces.html#converting-a-sub-namespace-to-a-root-namespace","crd_subnamespace.html#custom-resources","crd_subnamespace.html#sub-resources","commands.html#commands","kubectl-accurate.html#kubectl-accurate","kubectl-accurate.html#features","kubectl-accurate.html#generic-options","kubectl-accurate.html#commands","kubectl-accurate.html#list-root","kubectl-accurate.html#namespace-describe-ns","kubectl-accurate.html#namespace-set-type-ns-type","kubectl-accurate.html#template-list-template","kubectl-accurate.html#template-set-ns-template","kubectl-accurate.html#template-unset-ns","kubectl-accurate.html#sub-create-name-ns","kubectl-accurate.html#sub-delete-name","kubectl-accurate.html#sub-move-ns-parent","kubectl-accurate.html#sub-graft-ns-parent","kubectl-accurate.html#sub-cut-ns","kubectl-accurate.html#sub-list-root","accurate-controller.html#accurate-controller","accurate-controller.html#configuration-file","accurate-controller.html#environment-variables","accurate-controller.html#command-line-flags","labels.html#labels-used-by-accurate","annotations.html#annotations-used-by-accurate","design.html#design-notes","design.html#overview","design.html#why-do-we-need-another-namespace-controller-in-the-first-place","design.html#goals","design.html#things-to-be-avoided","design.html#no-webhooks-for-propagated-resources","design.html#subnamespaces-are-not-related-to-parent-child-relationships","reconcile.html#how-accurate-reconciles-resources","reconcile.html#subnamespace-custom-resource","reconcile.html#namespaces","reconcile.html#namespaces-that-are-labeled-with-accuratecybozucomtemplate","reconcile.html#namespaces-wo-accuratecybozucomtype-and-accuratecybozucomtemplate-labels","reconcile.html#template-namespace","reconcile.html#root-namespace","reconcile.html#sub-namespace","reconcile.html#watched-namespace-scoped-resources","reconcile.html#resources-annotated-with-accuratecybozucomfrom","reconcile.html#resources-annotated-with-accuratecybozucompropagate","reconcile.html#resources-owned-by-another-resource-that-is-annotated-with-accuratecybozucompropagate-generated-deprecated","release.html#release-procedure","release.html#labeling","release.html#versioning","release.html#bump-version","maintenance.html#maintenance","maintenance.html#how-to-update-supported-kubernetes","maintenance.html#how-to-update-dependencies"],"index":{"documentStore":{"docInfo":{"0":{"body":14,"breadcrumbs":3,"title":2},"1":{"body":10,"breadcrumbs":2,"title":1},"10":{"body":0,"breadcrumbs":4,"title":1},"100":{"body":11,"breadcrumbs":3,"title":2},"11":{"body":4,"breadcrumbs":6,"title":3},"12":{"body":390,"breadcrumbs":5,"title":2},"13":{"body":81,"breadcrumbs":4,"title":1},"14":{"body":100,"breadcrumbs":5,"title":2},"15":{"body":63,"breadcrumbs":6,"title":2},"16":{"body":0,"breadcrumbs":7,"title":3},"17":{"body":14,"breadcrumbs":8,"title":4},"18":{"body":0,"breadcrumbs":6,"title":2},"19":{"body":8,"breadcrumbs":7,"title":3},"2":{"body":127,"breadcrumbs":5,"title":4},"20":{"body":81,"breadcrumbs":7,"title":3},"21":{"body":49,"breadcrumbs":6,"title":2},"22":{"body":193,"breadcrumbs":5,"title":1},"23":{"body":12,"breadcrumbs":6,"title":2},"24":{"body":18,"breadcrumbs":8,"title":3},"25":{"body":18,"breadcrumbs":8,"title":3},"26":{"body":121,"breadcrumbs":7,"title":2},"27":{"body":14,"breadcrumbs":2,"title":1},"28":{"body":0,"breadcrumbs":5,"title":2},"29":{"body":14,"breadcrumbs":8,"title":5},"3":{"body":54,"breadcrumbs":2,"title":1},"30":{"body":14,"breadcrumbs":6,"title":3},"31":{"body":27,"breadcrumbs":6,"title":3},"32":{"body":36,"breadcrumbs":7,"title":3},"33":{"body":23,"breadcrumbs":7,"title":3},"34":{"body":16,"breadcrumbs":9,"title":5},"35":{"body":22,"breadcrumbs":8,"title":4},"36":{"body":14,"breadcrumbs":8,"title":4},"37":{"body":20,"breadcrumbs":5,"title":2},"38":{"body":26,"breadcrumbs":6,"title":3},"39":{"body":72,"breadcrumbs":9,"title":6},"4":{"body":101,"breadcrumbs":2,"title":1},"40":{"body":34,"breadcrumbs":7,"title":3},"41":{"body":50,"breadcrumbs":8,"title":4},"42":{"body":42,"breadcrumbs":8,"title":4},"43":{"body":16,"breadcrumbs":9,"title":5},"44":{"body":21,"breadcrumbs":7,"title":3},"45":{"body":47,"breadcrumbs":9,"title":5},"46":{"body":15,"breadcrumbs":8,"title":4},"47":{"body":26,"breadcrumbs":8,"title":4},"48":{"body":24,"breadcrumbs":9,"title":5},"49":{"body":26,"breadcrumbs":9,"title":5},"5":{"body":0,"breadcrumbs":2,"title":1},"50":{"body":1,"breadcrumbs":5,"title":2},"51":{"body":88,"breadcrumbs":5,"title":2},"52":{"body":0,"breadcrumbs":2,"title":1},"53":{"body":5,"breadcrumbs":5,"title":2},"54":{"body":74,"breadcrumbs":4,"title":1},"55":{"body":179,"breadcrumbs":5,"title":2},"56":{"body":5,"breadcrumbs":4,"title":1},"57":{"body":11,"breadcrumbs":5,"title":2},"58":{"body":6,"breadcrumbs":6,"title":3},"59":{"body":14,"breadcrumbs":8,"title":5},"6":{"body":52,"breadcrumbs":3,"title":2},"60":{"body":18,"breadcrumbs":6,"title":3},"61":{"body":6,"breadcrumbs":7,"title":4},"62":{"body":4,"breadcrumbs":6,"title":3},"63":{"body":13,"breadcrumbs":7,"title":4},"64":{"body":12,"breadcrumbs":6,"title":3},"65":{"body":15,"breadcrumbs":7,"title":4},"66":{"body":14,"breadcrumbs":7,"title":4},"67":{"body":20,"breadcrumbs":6,"title":3},"68":{"body":5,"breadcrumbs":6,"title":3},"69":{"body":12,"breadcrumbs":5,"title":2},"7":{"body":29,"breadcrumbs":3,"title":2},"70":{"body":82,"breadcrumbs":5,"title":2},"71":{"body":10,"breadcrumbs":5,"title":2},"72":{"body":229,"breadcrumbs":6,"title":3},"73":{"body":38,"breadcrumbs":4,"title":3},"74":{"body":54,"breadcrumbs":4,"title":3},"75":{"body":18,"breadcrumbs":4,"title":2},"76":{"body":34,"breadcrumbs":3,"title":1},"77":{"body":42,"breadcrumbs":8,"title":6},"78":{"body":137,"breadcrumbs":3,"title":1},"79":{"body":88,"breadcrumbs":4,"title":2},"8":{"body":32,"breadcrumbs":5,"title":4},"80":{"body":40,"breadcrumbs":5,"title":3},"81":{"body":19,"breadcrumbs":7,"title":5},"82":{"body":13,"breadcrumbs":5,"title":3},"83":{"body":19,"breadcrumbs":5,"title":3},"84":{"body":0,"breadcrumbs":3,"title":1},"85":{"body":63,"breadcrumbs":5,"title":3},"86":{"body":9,"breadcrumbs":7,"title":5},"87":{"body":16,"breadcrumbs":4,"title":2},"88":{"body":12,"breadcrumbs":4,"title":2},"89":{"body":70,"breadcrumbs":4,"title":2},"9":{"body":21,"breadcrumbs":4,"title":2},"90":{"body":7,"breadcrumbs":6,"title":4},"91":{"body":53,"breadcrumbs":5,"title":3},"92":{"body":42,"breadcrumbs":5,"title":3},"93":{"body":10,"breadcrumbs":10,"title":8},"94":{"body":5,"breadcrumbs":4,"title":2},"95":{"body":19,"breadcrumbs":3,"title":1},"96":{"body":8,"breadcrumbs":3,"title":1},"97":{"body":39,"breadcrumbs":4,"title":2},"98":{"body":0,"breadcrumbs":2,"title":1},"99":{"body":39,"breadcrumbs":4,"title":3}},"docs":{"0":{"body":"Accurate is a Kubernetes controller for soft multi-tenancy environments. It is currently developed and maintained by Cybozu . The repository is at https://github.com/cybozu-go/accurate .","breadcrumbs":"Accurate » Accurate documentation","id":"0","title":"Accurate documentation"},"1":{"body":"Accurate is a Kubernetes controller to help operations in large soft multi-tenancy environments.","breadcrumbs":"Overview » Overview","id":"1","title":"Overview"},"10":{"body":"","breadcrumbs":"Getting started » Configurations » Configurations","id":"10","title":"Configurations"},"100":{"body":"Renovate will create PRs that update dependencies once a week. However, Kubernetes is only updated with patched versions.","breadcrumbs":"Maintenance » How to update dependencies","id":"100","title":"How to update dependencies"},"11":{"body":"Read Helm Chart for details.","breadcrumbs":"Getting started » Configurations » Helm Chart values","id":"11","title":"Helm Chart values"},"12":{"body":"accurate-controller reads its configurations from a configuration file. The repository includes an example as follows: # Labels to be propagated to sub-namespaces.\n# It is also possible to specify a glob pattern that can be interpreted by Go's \"path.Match\" func.\n# https://pkg.go.dev/path#Match\nlabelKeys:\n- team # Annotations to be propagated to sub-namespaces.\n# It is also possible to specify a glob pattern that can be interpreted by Go's \"path.Match\" func.\n# https://pkg.go.dev/path#Match\nannotationKeys:\n# An example to propagate an annotation for MetalLB\n# https://metallb.universe.tf/usage/#requesting-specific-ips\n- metallb.universe.tf/address-pool # Labels to be propagated to sub-namespaces from SubNamespace resource.\n# It is also possible to specify a glob pattern that can be interpreted by Go's \"path.Match\" func.\n# https://pkg.go.dev/path#Match\nsubNamespaceLabelKeys:\n- app # Annotations to be propagated to sub-namespaces from SubNamespace resource.\n# It is also possible to specify a glob pattern that can be interpreted by Go's \"path.Match\" func.\n# https://pkg.go.dev/path#Match\nsubNamespaceAnnotationKeys:\n- foo.bar/baz # List of GVK for namespace-scoped resources that can be propagated.\n# Any namespace-scoped resource is allowed.\nwatches:\n- group: rbac.authorization.k8s.io version: v1 kind: Role\n- group: rbac.authorization.k8s.io version: v1 kind: RoleBinding\n- version: v1 kind: Secret\n- version: v1 kind: ResourceQuota # List of nameing policy for SubNamespaces.\n# root and match are both regular expressions.\n# When a SubNamespace is created in a tree starting from a root namespace and the root namespace's name matches the \"root\" regular expression, the SubNamespace name is validated with the \"match\" regular expression.\n#\n# \"match\" namingPolicies can use variables of regexp capture group naming of \"root\" namingPolicies.\n# example:\n# root: ^app-(?P.*)\n# match: ^app-${team}-.*\n# root namespace: app-team1\n# compiled match naming policy: ^app-team1-.*\n# This feature is provided using https://pkg.go.dev/regexp#Regexp.Expand\nnamingPolicies: [] Only labels and annotations specified in the configuration file will be inherited. Be careful that some labels or annotations affect security configurations or the system. For example, pod-security.kubernetes.io/* labels control the security capabilities of Pods in a Namespace. Likewise, Accurate watches only namespace-scope resources specified in the configuration file. You can edit the Helm Chart values as needed. \ncontroller: config: # controller.config.labelKeys -- Labels to be propagated to sub-namespaces. # It is also possible to specify a glob pattern that can be interpreted by Go's \"path.Match\" func. ## https://pkg.go.dev/path#Match labelKeys: [] # - team # controller.config.annotationKeys -- Annotations to be propagated to sub-namespaces. # It is also possible to specify a glob pattern that can be interpreted by Go's \"path.Match\" func. ## https://pkg.go.dev/path#Match annotationKeys: [] # An example to propagate an annotation for MetalLB # https://metallb.universe.tf/usage/#requesting-specific-ips # - metallb.universe.tf/address-pool # Labels to be propagated to sub-namespaces from SubNamespace resource. # It is also possible to specify a glob pattern that can be interpreted by Go's \"path.Match\" func. # https://pkg.go.dev/path#Match subNamespaceLabelKeys: - app # Annotations to be propagated to sub-namespaces from SubNamespace resource. # It is also possible to specify a glob pattern that can be interpreted by Go's \"path.Match\" func. # https://pkg.go.dev/path#Match subNamespaceAnnotationKeys: - foo.bar/baz # controller.config.watches -- List of GVK for namespace-scoped resources that can be propagated. # Any namespace-scoped resource is allowed. watches: - group: rbac.authorization.k8s.io version: v1 kind: Role - group: rbac.authorization.k8s.io version: v1 kind: RoleBinding - version: v1 kind: Secret # controller.config.namingPolicies -- List of nameing policy for SubNamespaces. # root and match are both regular expressions. # When a SubNamespace is created in a tree starting from a root namespace and the root namespace's name matches the \"root\" regular expression, the SubNamespace name is validated with the \"match\" regular expression. # # \"match\" namingPolicies can use variables of regexp capture group naming of \"root\" namingPolicies. # example: # root: ^app-(?P.*) # match: ^app-${team}-.* # root namespace: app-team1 # compiled match naming policy: ^app-team1-.* # This feature is provided using https://pkg.go.dev/regexp#Regexp.Expand namingPolicies: - root: foo match: foo_.* - root: bar match: bar_.* - root: ^app-(?P.*) match: ^app-${team}-.*\n","breadcrumbs":"Getting started » Configurations » Configuration file","id":"12","title":"Configuration file"},"13":{"body":"A built-in ClusterRole admin is bound by default to allow accurate-controller to watch and propagate namespace-scope resources. However, admin does not contain verbs for ResourceQuota and may not contain custom resources. If you need to watch and propagate resources not included in admin ClusterRole, add additional ClusterRole/ClusterRoleBinding to accurate-controller-manager ServiceAccount. Set the controller.additionalRBAC.rules in the Helm Chart values. The following example Helm chart values is to watch and propagate ResourceQuotas. \ncontroller: additionalRBAC: # controller.additionalRBAC.rules -- Specify the RBAC rules to be added to the controller. # ClusterRole and ClusterRoleBinding are created with the names `{{ release name }}-additional-resources`. # The rules defined here will be used for the ClusterRole rules. rules: - apiGroups: - \"\" resources: - resourcequotas verbs: - get - list - watch - create - patch - delete\n","breadcrumbs":"Getting started » Configurations » ClusterRoleBindings","id":"13","title":"ClusterRoleBindings"},"14":{"body":"Feature gates are a set of key=value pairs that describe operator features. You can turn these features on or off using the --feature-gates command line flag. Use -h flag to see a full set of feature gates. To set feature gates, use the --feature-gates flag assigned to a list of feature pairs: --feature-gates=...,DisablePropagateGenerated=false The following table is a summary of the feature gates that you can set. The \"Since\" column contains the Accurate release when a feature is introduced or its release stage is changed. The \"Until\" column, if not empty, contains the last Accurate release in which you can still use a feature gate. {{< table caption=\"Feature gates for features in Alpha or Beta states\" sortable=\"true\" >}} Feature Default Stage Since Until DisablePropagateGenerated false Alpha 1.2.0 1.3.0 DisablePropagateGenerated true Beta 1.3.0 Each feature gate is designed for enabling/disabling a specific feature: DisablePropagateGenerated: Disable propagating generated resources , which is a feature subject for removal soon.","breadcrumbs":"Getting started » Configurations » Feature Gates","id":"14","title":"Feature Gates"},"15":{"body":"(Optional) Prepare cert-manager Accurate depends on cert-manager to issue TLS certificate for admission webhooks. If cert-manager is not installed on your cluster, install it as follows: $ curl -fsLO https://github.com/jetstack/cert-manager/releases/latest/download/cert-manager.yaml\n$ kubectl apply -f cert-manager.yaml Setup Accurate Helm repository $ helm repo add accurate https://cybozu-go.github.io/accurate/\n$ helm repo update Configuration Helm chart values Read Configurations for details. Install the Accurate Helm chart $ helm install --create-namespace --namespace accurate accurate accurate/accurate -f values.yaml","breadcrumbs":"Getting started » Deploying Accurate » Deploying Accurate","id":"15","title":"Deploying Accurate"},"16":{"body":"","breadcrumbs":"Getting started » Helm Chart » Accurate Helm Chart","id":"16","title":"Accurate Helm Chart"},"17":{"body":"You need to add this repository to your Helm repositories: helm repo add accurate https://cybozu-go.github.io/accurate/\nhelm repo update","breadcrumbs":"Getting started » Helm Chart » How to use Accurate Helm repository","id":"17","title":"How to use Accurate Helm repository"},"18":{"body":"","breadcrumbs":"Getting started » Helm Chart » Quick start","id":"18","title":"Quick start"},"19":{"body":"$ curl -fsL https://github.com/jetstack/cert-manager/releases/latest/download/cert-manager.yaml | kubectl apply -f -","breadcrumbs":"Getting started » Helm Chart » Installing cert-manager","id":"19","title":"Installing cert-manager"},"2":{"body":"Kubernetes does not provide multi-tenancy functions on its own. It merely provides Namespaces along with Role-Based Access Control (RBAC) to isolate resources such as Pods. Soft multi-tenancy is a kind of technique to implement Namespace-based multi-tenancy on Kubernetes. On the other hand, hard multi-tenancy provides a virtual kube-apiserver for each tenant to isolate privileges completely. In a soft multi-tenancy environment, a cluster admin grants privileges in a Namespace to a group of tenant users by creating RoleBinding object like this: apiVersion: rbac.authorization.k8s.io/v1\nkind: RoleBinding\nmetadata: namespace: tenant name: admin\nroleRef: apiGroup: rbac.authorization.k8s.io kind: ClusterRole name: admin\nsubjects:\n- kind: Group name: group-for-tenant apiGroup: rbac.authorization.k8s.io admin ClusterRole is a built-in role to give admin privileges on any kind of namespace-scope resources. With this RoleBinding, users in group-for-tenant can freely create/edit/delete namespace-scope resources in tenant Namespace. In many cases, a tenant needs to have multiple Namespaces to run multiple independent applications. However, tenant users are not allowed to create or delete Namespaces because Namespace is a cluster-scope resource. Otherwise, they would be able to delete other tenants' Namespaces!","breadcrumbs":"Overview » Soft multi-tenancy in Kubernetes","id":"2","title":"Soft multi-tenancy in Kubernetes"},"20":{"body":"Accurate does not use the official helm method of installing CRD resources. This is because it makes upgrading CRDs impossible with helm CLI alone. The helm team explain the limitations of their approach here . The Accurate Helm chart default is to install and manage CRDs with Helm and add annotations preventing Helm from uninstalling the CRD when the Helm release is uninstalled. The recommended approach is to let helm manage CRDs, but if you want to manage CRDs yourself, now is the time. $ kubectl apply -k https://github.com/cybozu-go/accurate//config/crd-only/ NOTE: Since the CRDs contain configuration of conversion webhooks, you may have to tweak the webhook settings if installing the chart using non-standard values. If you decided to manage CRDs outside of Helm, make sure you set the crds.enabled Helm value to false.","breadcrumbs":"Getting started » Helm Chart » Installing CustomResourceDefinitions (optional)","id":"20","title":"Installing CustomResourceDefinitions (optional)"},"21":{"body":"NOTE: This installation method requires cert-manager to be installed beforehand. To install the chart with the release name accurate using a dedicated namespace(recommended): $ helm install --create-namespace --namespace accurate accurate accurate/accurate Specify parameters using --set key=value[,key=value] argument to helm install. Alternatively a YAML file that specifies the values for the parameters can be provided like this: $ helm install --create-namespace --namespace accurate accurate -f values.yaml accurate/accurate","breadcrumbs":"Getting started » Helm Chart » Installing the Chart","id":"21","title":"Installing the Chart"},"22":{"body":"Key Type Default Description controller.additionalRBAC.rules list [] Specify the RBAC rules to be added to the controller. ClusterRole and ClusterRoleBinding are created with the names {{ release name }}-additional-resources. The rules defined here will be used for the ClusterRole rules. controller.additionalRBAC.clusterRoles list [] Specify additional ClusterRoles to be granted to the accurate controller. \"admin\" is recommended to allow the controller to manage common namespace-scoped resources. controller.config.annotationKeys list [] Annotations to be propagated to sub-namespaces. It is also possible to specify a glob pattern that can be interpreted by Go's \"path.Match\" func. controller.config.labelKeys list [] Labels to be propagated to sub-namespaces. It is also possible to specify a glob pattern that can be interpreted by Go's \"path.Match\" func. controller.config.watches list [{\"group\":\"rbac.authorization.k8s.io\",\"kind\":\"Role\",\"version\":\"v1\"},{\"group\":\"rbac.authorization.k8s.io\",\"kind\":\"RoleBinding\",\"version\":\"v1\"},{\"kind\":\"Secret\",\"version\":\"v1\"}] List of GVK for namespace-scoped resources that can be propagated. Any namespace-scoped resource is allowed. controller.config.propagateAnnotationKeyExcludes list [\"*kubernetes.io/*\"] Annotations to exclude when propagating resources. It is also possible to specify a glob pattern that can be interpreted by Go's \"path.Match\" func. controller.config.propagateLabelKeyExcludes list [\"*kubernetes.io/*\"] Labels to exclude when propagating resources. It is also possible to specify a glob pattern that can be interpreted by Go's \"path.Match\" func. controller.extraArgs list [] Optional additional arguments. controller.replicas int 2 Specify the number of replicas of the controller Pod. controller.resources object {\"requests\":{\"cpu\":\"100m\",\"memory\":\"20Mi\"}} Specify resources. controller.terminationGracePeriodSeconds int 10 Specify terminationGracePeriodSeconds. image.pullPolicy string nil Accurate image pullPolicy. image.repository string \"ghcr.io/cybozu-go/accurate\" Accurate image repository to use. image.tag string {{ .Chart.AppVersion }} Accurate image tag to use. crds.enabled bool true Decides if the CRDs should be installed as part of the Helm installation. crds.keep bool true Setting this to true will prevent Helm from uninstalling the CRD when the Helm release is uninstalled. installCRDs bool true Controls if CRDs are automatically installed and managed as part of your Helm release. Deprecated: Use crds.enabled and crds.keep instead.","breadcrumbs":"Getting started » Helm Chart » Values","id":"22","title":"Values"},"23":{"body":"You can use the helm template command to render manifests. $ helm template --namespace accurate accurate accurate/accurate","breadcrumbs":"Getting started » Helm Chart » Generate Manifests","id":"23","title":"Generate Manifests"},"24":{"body":"kubectl-accurate is a plugin for kubectl to make operations of Accurate easy. It is strongly recommended to install kubectl-accurate though Accurate can be used without the plugin.","breadcrumbs":"Getting started » Installing kubectl plugin » Installing kubectl plugin","id":"24","title":"Installing kubectl plugin"},"25":{"body":"Krew is the plugin manager for kubectl command-line tool. See the documentation for how to install Krew. $ kubectl krew update\n$ kubectl krew install accurate","breadcrumbs":"Getting started » Installing kubectl plugin » Installing using Krew","id":"25","title":"Installing using Krew"},"26":{"body":"Set OS to the operating system name OS is one of linux, windows, or darwin (MacOS). If Go is available, OS can be set automatically as follows: $ OS=$(go env GOOS) Set ARCH to the operating system name ARCH is one of amd64 or arm64. If Go is available, ARCH can be set automatically as follows: $ ARCH=$(go env GOARCH) Set VERSION to the accurate version See the Accurate release page: https://github.com/cybozu-go/accurate/releases $ VERSION=< The version you want to install > Download the binary and put it in a directory of your PATH. The following is an example to install the plugin in /usr/local/bin. $ curl -L -sS https://github.com/cybozu-go/accurate/releases/download/$(VERSION)/kubectl-accurate_$(VERSION)_$(OS)_$(ARCH).tar.gz \\ | tar xz -C /usr/local/bin kubectl-accurate Check the installation Run kubectl accurate -h and see the output looks like: $ kubectl accurate -h\naccurate is a subcommand of kubectl to manage Accurate features. Usage: accurate [command] Available Commands: completion generate the autocompletion script for the specified shell help Help about any command list List namespace trees hierarchically namespace namespace subcommand sub sub-namespace command template template subcommand\n...","breadcrumbs":"Getting started » Installing kubectl plugin » Installing manually","id":"26","title":"Installing manually"},"27":{"body":"Accurate can be used imperatively using kubectl or declaratively with YAML manifests. The following sections will show you the usage in both ways.","breadcrumbs":"Usage » Usage","id":"27","title":"Usage"},"28":{"body":"","breadcrumbs":"Usage » Showing information » Showing information","id":"28","title":"Showing information"},"29":{"body":"Use kubectl accurate list: $ kubectl accurate list root1 root2 ⮡sub1 root3 subroot1 ⮡sn1 subroot2","breadcrumbs":"Usage » Showing information » Show the hierarchical list of sub-namespaces","id":"29","title":"Show the hierarchical list of sub-namespaces"},"3":{"body":"Accurate introduces a namespace-scope custom resource called SubNamespace . With SubNamespace, tenant users can create a Namespace by creating a SubNamespace, and delete the created Namespace by deleting the SubNamespace. The created Namespace is considered a child of the Namespace where the SubNamespace is created. The child Namespace may inherit labels and annotations from its parent Namespace. Accurate also propagates resources such as Role, RoleBinding, or Secret from a parent Namespace to its children Namespaces. Without propagating Role/RoleBinding, the tenant user would be able to do nothing in newly created Namespaces.","breadcrumbs":"Overview » What is Accurate?","id":"3","title":"What is Accurate?"},"30":{"body":"Use kubectl accurate template list: $ kubectl accurate template list template1 template2 ⮡reference1 ⮡reference2 template3","breadcrumbs":"Usage » Showing information » Show all template Namespaces","id":"30","title":"Show all template Namespaces"},"31":{"body":"Use kubectl accurate ns describe: $ kubectl accurate ns describe root2\nName: root2\nType: root\n# of children: 1 Resources:\nKind Name From Mode\n-------- -------- -------- --------\nRole role1 tmpl3 create\nSecret mysecret create","breadcrumbs":"Usage » Showing information » Show the properties of a Namespace","id":"31","title":"Show the properties of a Namespace"},"32":{"body":"Template is a feature of Accurate to propagate labels, annotations, and resources between normal Namespaces. Any Namespace except for sub-namespaces can reference a template Namespace. So, a template Namespace can reference another template Namespace. In the following examples, represents a Namespace name to be changed. Likewise,