Skip to content

Commit bcc461d

Browse files
committed
Address Derek's comments: ingress and how to disable
Signed-off-by: manuelbuil <[email protected]>
1 parent 50bc333 commit bcc461d

File tree

1 file changed

+7
-2
lines changed

1 file changed

+7
-2
lines changed

docs/adrs/010-security-responder.md

Lines changed: 7 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -50,6 +50,7 @@ The collected data will include the following information:
5050
- serverNodeCount
5151
- agentNodeCount
5252
- cni-plugin
53+
- ingress-controller
5354
- os
5455
- selinux
5556

@@ -65,19 +66,23 @@ Example payload structure:
6566
"serverNodeCount": 3,
6667
"agentNodeCount": 2,
6768
"cni-plugin": "flannel",
69+
"ingress-controller": "rke2-ingress-nginx",
6870
"os": "ubuntu",
6971
"selinux": "enabled"
7072
}
7173
}
7274
```
7375

74-
The `clusteruuid` is needed to differentiate between different deployments (the UUID of `kube-system`). It is completely random and does not expose privacy considerations.
76+
The `clusteruuid` is needed to differentiate between different deployments (the UUID of `kube-system`). It is completely random and does not expose privacy considerations. We could even consider hashing it to increase the obfuscation.
7577

7678
### Configuration Interface Example
7779

80+
The security-responder is packaged using a helm chart. We can interact with it as we do with other helm charts. For example, to disable it:
81+
7882
```yaml
7983
# /etc/rancher/rke2/config.yaml
80-
security-responder-enabled: true # default
84+
disable:
85+
- rke2-security-responder
8186
```
8287
8388
## Alternatives Considered

0 commit comments

Comments
 (0)