whentimeslows/website
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Add doc for AllowedFlexVolume (#6563)

Browse Source
This commit is contained in:
Haoran Wang
2017-12-13 05:27:16 +08:00
committed by Steve Perry
parent acd3944bda
commit 0503058f97
1 changed files with 39 additions and 18 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/concepts/policy/pod-security-policy.md
+21
View File
@@ -40,6 +40,7 @@ administrator to control the following:
| Running of a container that allow privilege escalation from its parent | [`allowPrivilegeEscalation`](#allowprivilegeescalation) | | Running of a container that allow privilege escalation from its parent | [`allowPrivilegeEscalation`](#allowprivilegeescalation) |
| Control whether a process can gain more privileges than its parent process | [`defaultAllowPrivilegeEscalation`](#defaultallowprivilegeescalation) | | Control whether a process can gain more privileges than its parent process | [`defaultAllowPrivilegeEscalation`](#defaultallowprivilegeescalation) |
| Whitelist of allowed host paths | [`allowedHostPaths`](#allowedhostpaths) | | Whitelist of allowed host paths | [`allowedHostPaths`](#allowedhostpaths) |
| Whitelist of the flex volume drivers | [`allowedFlexVolumes`](#allowedflexvolumes) |
_Pod Security Policies_ are comprised of settings and strategies that _Pod Security Policies_ are comprised of settings and strategies that
control the security features a pod has access to. These settings fall control the security features a pod has access to. These settings fall
@@ -162,6 +163,26 @@ spec:
- pathPrefix: "/foo" - pathPrefix: "/foo"
``` ```
### AllowedFlexVolumes
This specifies a whitelist of flex volume drivers that are allowed
to be used by flexVolume. An empty list means there is no restriction on the drivers. Please
make sure `volumes` contains the `flexVolume` volume type, no flex volume driver is allowed
otherwise. For example:
```yaml
apiVersion: extensions/v1beta1
kind: PodSecurityPolicy
metadata:
name: allow-flex-volumes
spec:
volumes:
- flexVolume
allowedFlexVolumes:
- driver: example/lvm
- driver: example/cifs
```
## Admission ## Admission
[_Admission control_ with `PodSecurityPolicy`](/docs/admin/admission-controllers/#podsecuritypolicy) [_Admission control_ with `PodSecurityPolicy`](/docs/admin/admission-controllers/#podsecuritypolicy)