From 59d3e1e7a215a2eaeeadcc7fb92cd956e9cf30e4 Mon Sep 17 00:00:00 2001 From: Christopher Negus Date: Tue, 26 Apr 2022 13:39:55 +0000 Subject: [PATCH] Update pod security docs for dockershim removal --- content/en/docs/concepts/security/pod-security-policy.md | 3 +-- content/en/examples/policy/restricted-psp.yaml | 1 + 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/content/en/docs/concepts/security/pod-security-policy.md b/content/en/docs/concepts/security/pod-security-policy.md index a8e90040ed..30b0c8bab0 100644 --- a/content/en/docs/concepts/security/pod-security-policy.md +++ b/content/en/docs/concepts/security/pod-security-policy.md @@ -658,8 +658,7 @@ added. Capabilities listed in `RequiredDropCapabilities` must not be included in **DefaultAddCapabilities** - The capabilities which are added to containers by default, in addition to the runtime defaults. See the -[Docker documentation](https://docs.docker.com/engine/reference/run/#runtime-privilege-and-linux-capabilities) -for the default list of capabilities when using the Docker runtime. +the documentation for your container runtime for information on working with Linux capabilities. ### SELinux diff --git a/content/en/examples/policy/restricted-psp.yaml b/content/en/examples/policy/restricted-psp.yaml index 0837c5a3ce..b18545a266 100644 --- a/content/en/examples/policy/restricted-psp.yaml +++ b/content/en/examples/policy/restricted-psp.yaml @@ -3,6 +3,7 @@ kind: PodSecurityPolicy metadata: name: restricted annotations: + # docker/default identifies an seccomp profile, but it is not particularly tied to the Docker runtime seccomp.security.alpha.kubernetes.io/allowedProfileNames: 'docker/default,runtime/default' apparmor.security.beta.kubernetes.io/allowedProfileNames: 'runtime/default' apparmor.security.beta.kubernetes.io/defaultProfileName: 'runtime/default'