Add doc for AllowedFlexVolume (#6563)

docs/concepts/policy/pod-security-policy.md

@@ -40,6 +40,7 @@ administrator to control the following:
 | Running of a container that allow privilege escalation from its parent     | [`allowPrivilegeEscalation`](#allowprivilegeescalation)               |
 | Control whether a process can gain more privileges than its parent process | [`defaultAllowPrivilegeEscalation`](#defaultallowprivilegeescalation) |
 | Whitelist of allowed host paths                                            | [`allowedHostPaths`](#allowedhostpaths)                               |
+| Whitelist of the flex volume drivers                                       | [`allowedFlexVolumes`](#allowedflexvolumes)                           |
 
 _Pod Security Policies_ are comprised of settings and strategies that
 control the security features a pod has access to. These settings fall
@@ -162,6 +163,26 @@ spec:
     - pathPrefix: "/foo"
 ```
 
+### AllowedFlexVolumes
+
+This specifies a whitelist of flex volume drivers that are allowed
+to be used by flexVolume. An empty list means there is no restriction on the drivers. Please
+make sure `volumes` contains the `flexVolume` volume type, no flex volume driver is allowed
+otherwise. For example:
+
+```yaml
+apiVersion: extensions/v1beta1
+kind: PodSecurityPolicy
+metadata:
+  name: allow-flex-volumes
+spec:
+  volumes:
+  - flexVolume
+  allowedFlexVolumes:
+  - driver: example/lvm
+  - driver: example/cifs
+```
+
 ## Admission
 
 [_Admission control_ with `PodSecurityPolicy`](/docs/admin/admission-controllers/#podsecuritypolicy)