Skip to content

Commit 2c8f030

Browse files
authored
Update deployment-safeguards-in-azure-kubernetes-service.md
1 parent bdd9c16 commit 2c8f030

1 file changed

Lines changed: 3 additions & 3 deletions

File tree

support/azure/azure-kubernetes/extensions/deployment-safeguards-in-azure-kubernetes-service.md

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -48,16 +48,16 @@ To disable deployment safeguards entirely, run the following command:
4848

4949
### Why can I turn on Deployment Safeguards without Azure Policy permissions?
5050

51-
Deployment Safeguards uses Azure Policy as an implementation detail. To turn on Deployment Safeguards on an AKS cluster, you do not have to have the
51+
Deployment Safeguards uses Azure Policy as an implementation detail. To turn on Deployment Safeguards on an AKS cluster, you don't have to have the
5252
correct permissions to assign or delete Azure Policies.
5353

5454
## 4. Why does my deployment resource get admitted even though it doesn\'t follow best practices?
5555

56-
Deployment safeguards enforce best practice standards through Azure Policy controls. It has policies that validate against Kubernetes resources. To evaluate and enforce cluster components, Azure Policy extends [Gatekeeper](https://open-policy-agent.github.io/gatekeeper/website/). Gatekeeper enforcement also currently operates in a [fail-open model](https://open-policy-agent.github.io/gatekeeper/website/docs/failing-closed/#considerations). Because there are no guarantee that Gatekeeper will respond to our networking call, we make sure that, in this case, the validation is skipped so that the denial doesn't block your deployments.
56+
Deployment safeguards enforce best practice standards through Azure Policy controls. It has policies that validate against Kubernetes resources. To evaluate and enforce cluster components, Azure Policy extends [Gatekeeper](https://open-policy-agent.github.io/gatekeeper/website/). Gatekeeper enforcement also currently operates in a [fail-open model](https://open-policy-agent.github.io/gatekeeper/website/docs/failing-closed/#considerations). There are no guarantees that Gatekeeper will respond to our networking call. Therefore, we make sure that the validation doesn't run in such cases so that the denial doesn't block your deployments.
5757

5858
## Additional tips
5959

60-
- All safeguard policies are bundled. They cannot be individually toggled.
60+
- All safeguard policies are bundled. They can't be individually toggled.
6161

6262
- Use the [AKS GitHub repo](https://github.com/Azure/AKS/issues) to request new safeguard features.
6363

0 commit comments

Comments
 (0)