You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: docs/reference/workload-identities/README.mdx
+8-8Lines changed: 8 additions & 8 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -5,7 +5,7 @@ title: Workload identity and resolution
5
5
Otterize supports two approaches for specifying workload identity in Kubernetes: explicit and implicit.
6
6
7
7
## Explicitly specifying `Kind`
8
-
This approach requires specifying both the name, possibly with a namespace, and the kind of the service in the intent, ensuring precise identification.
8
+
This approach requires specifying both the name, possibly with a namespace, and the kind of the workload in the intent, ensuring precise identification.
9
9
```yaml
10
10
apiVersion: k8s.otterize.com/v2beta1
11
11
kind: ClientIntents
@@ -24,17 +24,17 @@ This approach requires specifying both the name, possibly with a namespace, and
24
24
- service:
25
25
name: server.example-ns
26
26
```
27
-
In the YAML above, the service`client` is a `Deployment` in the namespace `otterize-tutorial-istio-mapping`, and it intends to call the service `server`is a `Service` in the namespace `example-ns`.
27
+
In the YAML above, the workload`client` is a `Deployment` in the namespace `otterize-tutorial-istio-mapping`, and it intends to call the workload `server`, which is a `Service`, in the namespace `example-ns`.
28
28
29
29
30
30
### Kubernetes workload identity resolution
31
31
How do Otterize operators decide what is the identity of the workload that runs within the pod? The algorithm is as follows:
32
32
33
-
1. If the pod has an `intents.otterize.com/workload-name` annotation, its value is used as the service name. (You can change which annotation is used by setting `global.serviceNameOverrideAnnotationName` — see the [docs](/reference/otterize-chart#global-parameters).) This allows developers and
34
-
automations to explicitly name services, if needed. The value must not contain a period `.` as a period is used to separate service name and namespace, when the service is from a different namespace: `svcname.namespace`.
33
+
1. If the pod has an `intents.otterize.com/workload-name` annotation, its value is used as the workload name. (You can change which annotation is used by setting `global.workloadNameOverrideAnnotationName` — see the [docs](/reference/otterize-chart#global-parameters).) This allows developers and
34
+
automations to explicitly name workloads, if needed. The value must not contain a period `.` as a period is used to separate workload name and namespace, when the workload is from a different namespace: `server.namespace`.
35
35
2. If there is no `intents.otterize.com/workload-name` annotation, a recursive look-up is performed for the Kubernetes resource owner of
36
-
the pod, until the root resource is reached, and its name is used as the service name. For example, if you have
36
+
the pod, until the root resource is reached, and its name is used as the workload name. For example, if you have
37
37
a `Deployment` named `checkoutservice`, which then creates and owns a `ReplicaSet`, which then creates and owns
38
-
a `Pod`, then the service name for that pod is `checkoutservice` - same as the name of the `Deployment`. This is
39
-
intended to capture the likely-more-meaningful "human name" of the service. If the resulting service name contains
40
-
a period `.`, it is replaced with an underscore `_`. Periods are used in service names to denote namespaces, e.g. `svcname.namespace`.
38
+
a `Pod`, then the workload name for that pod is `checkoutservice` - same as the name of the `Deployment`. This is
39
+
intended to capture the likely-more-meaningful "human name" of the workload. If the resulting workload name contains
40
+
a period `.`, it is replaced with an underscore `_`. Periods are used in workload names to denote namespaces, e.g. `server.namespace`.
0 commit comments