public/rancher-docs
1
0
Fork 0
mirror of https://github.com/rancher/rancher-docs.git synced 2026-08-19 00:20:37 +00:00
Code Issues Packages Projects Releases Wiki Activity

Add version for alwayspullimages

Browse Source
This commit is contained in:
Sebastiaan van Steenis
2019-03-22 10:07:37 -07:00
committed by Denise Schannon
parent ed0e64ba23
commit 52336ccde9
1 changed files with 3 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
content/rke/v0.1.x/en/config-options/services/_index.md
+3 -1
View File
@@ -30,6 +30,8 @@ services:
# Expose a different port range for NodePort services
service_node_port_range: 30000-32767
pod_security_policy: false
# Enable AlwaysPullImages Admission controller plugin
# Available as of v0.2.0
always_pull_images: false
```
@@ -41,7 +43,7 @@ RKE supports the following options for the `kube-api` service :
- **Node Port Range** (`service_node_port_range`) - The port range to be used for Kubernetes services created with the [type](https://kubernetes.io/docs/concepts/services-networking/service/#publishing-services-service-types) `NodePort`. By default, the port range is `30000-32767`.
- **Pod Security Policy** (`pod_security_policy`) - An option to enable the [Kubernetes Pod Security Policy](https://kubernetes.io/docs/concepts/policy/pod-security-policy/). By default, we do not enable pod security policies as it is set to `false`.
> **Note:** If you set `pod_security_policy` value to `true`, RKE will configure an open policy to allow any pods to work on the cluster. You will need to configure your own policies to fully utilize PSP.
- **Always Pull Images** (`always_pull_images`) - Enable `AlwaysPullImages` Admission controller plugin. Enabling `AlwaysPullImages` is a security best practice. It forces Kubernetes to validate the image and pull credentials with the remote image registry. Local image layer cache will still be used, but it does add a small bit of overhead when launching containers to pull and compare image hashes.
- **Always Pull Images** (`always_pull_images`) - Enable `AlwaysPullImages` Admission controller plugin. Enabling `AlwaysPullImages` is a security best practice. It forces Kubernetes to validate the image and pull credentials with the remote image registry. Local image layer cache will still be used, but it does add a small bit of overhead when launching containers to pull and compare image hashes. _Note: Available as of v0.2.0_
## Kubernetes Controller Manager