From 60006e91643735cf2499fa7bb65b60283c48a457 Mon Sep 17 00:00:00 2001 From: krmayankk Date: Thu, 16 May 2019 16:06:29 -0700 Subject: [PATCH] fix runasgroup psp policy (#14121) --- content/en/docs/concepts/policy/pod-security-policy.md | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-) diff --git a/content/en/docs/concepts/policy/pod-security-policy.md b/content/en/docs/concepts/policy/pod-security-policy.md index bbbad6eceb..17d9cf23b9 100644 --- a/content/en/docs/concepts/policy/pod-security-policy.md +++ b/content/en/docs/concepts/policy/pod-security-policy.md @@ -493,10 +493,8 @@ recommended with this strategy. - *MustRunAs* - Requires at least one `range` to be specified. Uses the minimum value of the first range as the default. Validates against all ranges. -- *MustRunAsNonRoot* - Requires that the pod be submitted with a non-zero -`runAsUser` or have the `USER` directive defined (using a numeric GID) in the -image. No default provided. Setting `allowPrivilegeEscalation=false` is strongly -recommended with this strategy. +- *MayRunAs* - Does not require that RunAsGroup be specified. However, when RunAsGroup +is specified, they have to fall in the defined range. - *RunAsAny* - No default provided. Allows any `runAsGroup` to be specified.