add docs for AllowPrivilegeEscalation (#5448)

Signed-off-by: Jess Frazelle <acidburn@microsoft.com>

docs/tasks/configure-pod-container/security-context-2.yaml

@@ -1,7 +1,7 @@
 apiVersion: v1
 kind: Pod
 metadata:
-  name: security-context-demo-2 
+  name: security-context-demo-2
 spec:
   securityContext:
     runAsUser: 1000
@@ -10,3 +10,4 @@ spec:
     image: gcr.io/google-samples/node-hello:1.0
     securityContext:
       runAsUser: 2000
+      allowPrivilegeEscalation: false

docs/tasks/configure-pod-container/security-context.md

@@ -24,6 +24,8 @@ a Pod or Container. Security context settings include:
 
 * [Seccomp](https://en.wikipedia.org/wiki/Seccomp): Limit a process's access to open file descriptors.
 
+* AllowPrivilegeEscalation: Controls whether a process can gain more privileges than its parent process. This bool directly controls whether the [`no_new_privs`](https://www.kernel.org/doc/Documentation/prctl/no_new_privs.txt) flag gets set on the container process. AllowPrivilegeEscalation is true always when the container is: 1) run as Privileged OR 2) has `CAP_SYS_ADMIN`.
+
 For more information about security mechanisms in Linux, see
 [Overview of Linux Kernel Security Features](https://www.linux.com/learn/overview-linux-kernel-security-features)
 
@@ -345,6 +347,8 @@ label given to all Containers in the Pod as well as the Volumes.
 * [Security Contexts design document](https://git.k8s.io/community/contributors/design-proposals/security_context.md)
 * [Ownership Management design document](https://git.k8s.io/community/contributors/design-proposals/volume-ownership-management.md)
 * [Pod Security Policies](/docs/concepts/policy/pod-security-policy/)
+* [AllowPrivilegeEscalation design
+  document](https://git.k8s.io/community/contributors/design-proposals/auth/no-new-privs.md)
 
 
 {% endcapture %}

docs/tasks/configure-pod-container/security-context.yaml

@@ -1,7 +1,7 @@
 apiVersion: v1
 kind: Pod
 metadata:
-  name: security-context-demo  
+  name: security-context-demo
 spec:
   securityContext:
     runAsUser: 1000
@@ -15,3 +15,4 @@ spec:
     volumeMounts:
     - name: sec-ctx-vol
       mountPath: /data/demo
+      allowPrivilegeEscalation: false