mirror of https://git.rancher.io/charts
13 lines
891 B
Markdown
13 lines
891 B
Markdown
# externalip-webhook
|
||
|
||
This chart was created to mitigate [CVE-2020-8554](https://www.cvedetails.com/cve/CVE-2020-8554/)
|
||
|
||
External IP Webhook is a validating k8s webhook which prevents services from using random external IPs.
|
||
Cluster administrators can specify list of CIDRs allowed to be used as external IP by specifying `allowed-external-ip-cidrs` parameter. The webhook will only allow services which either don’t set external IP, or whose external IPs are within the range specified by the administrator.
|
||
|
||
External IP Webhook certificates are required. They can be generated in 2 ways:
|
||
* cert-manager: This is the default chart configuration. Cert manager should be already installed at the k8s cluster
|
||
* uploading certs: Disable `Cert Manager integration` and set `Secret name` and `CA Bundle` at `Certificates` section.
|
||
|
||
For more information, review the Helm README of this chart.
|