From 0e8f7ded2d67e7779bce3615425431f19d263a22 Mon Sep 17 00:00:00 2001 From: Slava Semushin Date: Wed, 29 Mar 2017 18:02:34 +0200 Subject: [PATCH] Add PodSecurityPolicy admission controller. --- docs/admin/admission-controllers.md | 11 +++++++++++ docs/user-guide/pod-security-policy/index.md | 2 +- 2 files changed, 12 insertions(+), 1 deletion(-) diff --git a/docs/admin/admission-controllers.md b/docs/admin/admission-controllers.md index 124dc9e319..02cb8c1e5e 100644 --- a/docs/admin/admission-controllers.md +++ b/docs/admin/admission-controllers.md @@ -257,6 +257,17 @@ storage classes and how to mark a storage class as default. This plug-in sets the default forgiveness toleration for pods, which have no forgiveness tolerations, to tolerate the taints `notready:NoExecute` and `unreachable:NoExecute` for 5 minutes. +### PodSecurityPolicy + +This plug-in acts on creation and modification of the pod and determines if it should be admitted +based on the requested security context and the available Pod Security Policies. + +For Kubernetes < 1.6.0, the API Server must enable the extensions/v1beta1/podsecuritypolicy API +extensions group (`--runtime-config=extensions/v1beta1/podsecuritypolicy=true`). + +See also [Pod Security Policy documentation](/docs/user-guide/pod-security-policy/index.md) +for more information. + ## Is there a recommended set of plug-ins to use? Yes. diff --git a/docs/user-guide/pod-security-policy/index.md b/docs/user-guide/pod-security-policy/index.md index 5744c1d849..26d49c8e97 100644 --- a/docs/user-guide/pod-security-policy/index.md +++ b/docs/user-guide/pod-security-policy/index.md @@ -185,7 +185,7 @@ podsecuritypolicy "permissive" deleted In order to use Pod Security Policies in your cluster you must ensure the following -1. You have enabled the api type `extensions/v1beta1/podsecuritypolicy` +1. You have enabled the api type `extensions/v1beta1/podsecuritypolicy` (only for versions prior 1.6) 1. You have enabled the admission controller `PodSecurityPolicy` 1. You have defined your policies