whentimeslows/website
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge branch 'master' of git://github.com/kubernetes/website into release-1.12

Browse Source 
* 'master' of git://github.com/kubernetes/website: (222 commits)
  Add temporary owners for 1.13 release (#11453)
  fix Minikube 404 error. (#11461)
  Resolve conflicts against dev-1.13 for /ko contents (#11439)
  replace `run` with `create deployment` (#11392)
  Updated list all pods with -o wide comment (#11394)
  fix broken link for KubeletConfiguration (#11423)
  Update on pod-priority-preemption.md (#11418)
  Add guidelines for working with localized content (#11415)
  Update what-is-kubernetes.md (#11399)
  Remove redundant close tags and little bit formatting (#11389)
  Add SysEleven MetaKube as hosted solution (#11393)
  Add rui to sig-docs-zh team (#11391)
  fix Improper translation (#11384)
  Add pigletfly(WangBing) as a sig-docs-zh-reviewer (#11370)
  update link to CloudProvider Interface (#11228)
  Fix the "my-scheduler-as-kube-scheduler" ClusterRoleBinding. (#11112)
  fix non-existing "CloudProvider Interface" link (#10953)
  Updated ingress.md (#11213)
  Further updates to TLS Bootstrapping (#11258)
  Updated 'exec' description (#11365)
  ...
This commit is contained in:
Rui Chen
2018-12-03 17:11:43 -05:00
parent 4fa6d715ec b1dde5578c
commit 6e094fa640
399 changed files with 3635 additions and 14434 deletions
Download Patch File Download Diff File Expand all files Collapse all files
content/en/docs/concepts/policy/pod-security-policy.md
+5 -5
View File
@@ -37,7 +37,7 @@ administrator to control the following:
| White list of Flexvolume drivers | [`allowedFlexVolumes`](#flexvolume-drivers) |
| Allocating an FSGroup that owns the pod's volumes | [`fsGroup`](#volumes-and-file-systems) |
| Requiring the use of a read only root file system | [`readOnlyRootFilesystem`](#volumes-and-file-systems) |
| The user and group IDs of the container | [`runAsUser`, `supplementalGroups`](#users-and-groups) |
| The user and group IDs of the container | [`runAsUser`, `runAsGroup`, `supplementalGroups`](#users-and-groups) |
| Restricting escalation to root privileges | [`allowPrivilegeEscalation`, `defaultAllowPrivilegeEscalation`](#privilege-escalation) |
| Linux capabilities | [`defaultAddCapabilities`, `requiredDropCapabilities`, `allowedCapabilities`](#capabilities) |
| The SELinux context of the container | [`seLinux`](#selinux) |
@@ -230,8 +230,8 @@ Create the rolebinding to grant `fake-user` the `use` verb on the example
policy:
{{< note >}}
**Note:** _This is not the recommended way! See the [next section](#run-another-pod)
for the preferred approach._
This is not the recommended way! See the [next section](#run-another-pod)
for the preferred approach.
{{< /note >}}
```shell
@@ -442,7 +442,7 @@ allowedHostPaths:
readOnly: true # only allow read-only mounts
```
{{< warning >}}**Warning:** There are many ways a container with unrestricted access to the host
{{< warning >}}There are many ways a container with unrestricted access to the host
filesystem can escalate privileges, including reading data from other
containers, and abusing the credentials of system services, such as Kubelet.
@@ -457,7 +457,7 @@ root filesystem (i.e. no writable layer).
### Flexvolume drivers
This specifies a whiltelist of Flexvolume drivers that are allowed to be used
This specifies a whitelist of Flexvolume drivers that are allowed to be used
by flexvolume. An empty list or nil means there is no restriction on the drivers.
Please make sure [`volumes`](#volumes-and-file-systems) field contains the
`flexVolume` volume type; no Flexvolume driver is allowed otherwise.