whentimeslows/website
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

PSP readOnly hostPath (#8898)

Browse Source
This commit is contained in:
Jordan Liggitt
2018-06-12 15:43:29 -04:00
committed by Misty Linville
parent 903d7142cf
commit 6bbed16e3e
1 changed files with 11 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
content/en/docs/concepts/policy/pod-security-policy.md
+11 -3
View File
@@ -421,7 +421,8 @@ minimum value of the first range as the default. Validates against all ranges.
to be used by hostPath volumes. An empty list means there is no restriction on to be used by hostPath volumes. An empty list means there is no restriction on
host paths used. This is defined as a list of objects with a single `pathPrefix` host paths used. This is defined as a list of objects with a single `pathPrefix`
field, which allows hostPath volumes to mount a path that begins with an field, which allows hostPath volumes to mount a path that begins with an
allowed prefix. For example: allowed prefix, and a `readOnly` field indicating it must be mounted read-only.
For example:
```yaml ```yaml
allowedHostPaths: allowedHostPaths:
@@ -429,11 +430,18 @@ allowedHostPaths:
# disallows "/fool", "/etc/foo" etc. # disallows "/fool", "/etc/foo" etc.
# "/foo/../" is never valid. # "/foo/../" is never valid.
- pathPrefix: "/foo" - pathPrefix: "/foo"
readOnly: true # only allow read-only mounts
``` ```
_Note: There are many ways a container with unrestricted access to the host {{< warning >}}**Warning:** There are many ways a container with unrestricted access to the host
filesystem can escalate privileges, including reading data from other filesystem can escalate privileges, including reading data from other
containers, and abusing the credentials of system services, such as Kubelet._ containers, and abusing the credentials of system services, such as Kubelet.
Writeable hostPath directory volumes allow containers to write
to the filesystem in ways that let them traverse the host filesystem outside the `pathPrefix`.
`readOnly: true`, available in Kubernetes 1.11+, must be used on **all** `allowedHostPaths`
to effectively limit access to the specified `pathPrefix`.
{{< /warning >}}
**ReadOnlyRootFilesystem** - Requires that containers must run with a read-only **ReadOnlyRootFilesystem** - Requires that containers must run with a read-only
root filesystem (i.e. no writable layer). root filesystem (i.e. no writable layer).