whentimeslows/website
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge master into dev-1.20 to keep in sync

Browse Source
This commit is contained in:
eagleusb
2020-10-22 17:44:02 +02:00
parent a9b21d2f4f 167a19e0b8
commit 45ec60bed5
268 changed files with 11321 additions and 55429 deletions
Download Patch File Download Diff File Expand all files Collapse all files
content/en/docs/concepts/policy/pod-security-policy.md
+11 -7
View File
@@ -140,13 +140,17 @@ For a complete example of authorizing a PodSecurityPolicy, see
### Troubleshooting
- The [Controller Manager](/docs/reference/command-line-tools-reference/kube-controller-manager/) must be run
against [the secured API port](/docs/reference/access-authn-authz/controlling-access/),
and must not have superuser permissions. Otherwise requests would bypass
authentication and authorization modules, all PodSecurityPolicy objects would be
allowed, and users would be able to create privileged containers. For more details
on configuring Controller Manager authorization, see
[Controller Roles](/docs/reference/access-authn-authz/rbac/#controller-roles).
- The [controller manager](/docs/reference/command-line-tools-reference/kube-controller-manager/)
must be run against the secured API port and must not have superuser permissions. See
[Controlling Access to the Kubernetes API](/docs/concepts/security/controlling-access)
to learn about API server access controls.
If the controller manager connected through the trusted API port (also known as the
`localhost` listener), requests would bypass authentication and authorization modules;
all PodSecurityPolicy objects would be allowed, and users would be able to create grant
themselves the ability to create privileged containers.
For more details on configuring controller manager authorization, see
[Controller Roles](/docs/reference/access-authn-authz/rbac/#controller-roles).
## Policy Order