whentimeslows/website
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Reference the kubernetes.io/psp annotation on the PodSecurityPolicy concept page

Browse Source
This commit is contained in:
mtardy
2022-06-28 21:12:30 +02:00
parent 60ee2c2d14
commit 453f4e61f6
1 changed files with 12 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
content/en/docs/concepts/security/pod-security-policy.md
+12 -1
View File
@@ -214,6 +214,9 @@ controller selects policies according to the following criteria:
2. If the pod must be defaulted or mutated, the first PodSecurityPolicy 2. If the pod must be defaulted or mutated, the first PodSecurityPolicy
(ordered by name) to allow the pod is selected. (ordered by name) to allow the pod is selected.
When a Pod is validated against a PodSecurityPolicy, [a `kubernetes.io/psp` annotation](/docs/reference/labels-annotations-taints/#kubernetes-io-psp)
is added with its name as its value.
{{< note >}} {{< note >}}
During update operations (during which mutations to pod specs are disallowed) During update operations (during which mutations to pod specs are disallowed)
only non-mutating PodSecurityPolicies are used to validate the pod. only non-mutating PodSecurityPolicies are used to validate the pod.
@@ -332,7 +335,15 @@ The output is similar to this
pod "pause" created pod "pause" created
``` ```
It works as expected! But any attempts to create a privileged pod should still It works as expected! You can verify that the pod was validated against the
newly created PodSecurityPolicy:
```shell
kubectl-user get pod pause -o yaml | grep kubernetes.io/psp
kubernetes.io/psp: example
```
But any attempts to create a privileged pod should still
be denied: be denied:
```shell ```shell