From 0b80570fdd5c8910d396b476a07b66fe4ef93dbc Mon Sep 17 00:00:00 2001 From: krmayankk Date: Mon, 24 Sep 2018 21:13:32 -0700 Subject: [PATCH] add runasgroup in psp (#10076) --- .../en/docs/concepts/policy/pod-security-policy.md | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/content/en/docs/concepts/policy/pod-security-policy.md b/content/en/docs/concepts/policy/pod-security-policy.md index 27bb494370..8570ea99a3 100644 --- a/content/en/docs/concepts/policy/pod-security-policy.md +++ b/content/en/docs/concepts/policy/pod-security-policy.md @@ -491,6 +491,17 @@ image. No default provided. Setting `allowPrivilegeEscalation=false` is strongly recommended with this strategy. - *RunAsAny* - No default provided. Allows any `runAsUser` to be specified. +**RunAsGroup** - Controls the what primary group ID containers run as. + +- *MustRunAs* - Requires at least one `range` to be specified. Uses the +minimum value of the first range as the default. Validates against all ranges. +- *MustRunAsNonRoot* - Requires that the pod be submitted with a non-zero +`runAsUser` or have the `USER` directive defined (using a numeric GID) in the +image. No default provided. Setting `allowPrivilegeEscalation=false` is strongly +recommended with this strategy. +- *RunAsAny* - No default provided. Allows any `runAsGroup` to be specified. + + **SupplementalGroups** - Controls which group IDs containers add. - *MustRunAs* - Requires at least one `range` to be specified. Uses the