From 78391515dae93ce085e6df9b588bb6318aab5e34 Mon Sep 17 00:00:00 2001 From: WanLinghao Date: Wed, 7 Mar 2018 00:13:53 +0800 Subject: [PATCH] fix sysctl miss in podsecuritypolicy descriptions. (#7600) modified: docs/concepts/cluster-administration/sysctl-cluster.md modified: docs/concepts/policy/pod-security-policy.md --- .../cluster-administration/sysctl-cluster.md | 19 +++++++++++++++++++ docs/concepts/policy/pod-security-policy.md | 6 ++++++ 2 files changed, 25 insertions(+) diff --git a/docs/concepts/cluster-administration/sysctl-cluster.md b/docs/concepts/cluster-administration/sysctl-cluster.md index f7b715f6c3..6fa32786cb 100644 --- a/docs/concepts/cluster-administration/sysctl-cluster.md +++ b/docs/concepts/cluster-administration/sysctl-cluster.md @@ -127,3 +127,22 @@ any node which has not enabled those two _unsafe_ sysctls explicitly. As with _node-level_ sysctls it is recommended to use [_taints and toleration_ feature](/docs/user-guide/kubectl/{{page.version}}/#taint) or [taints on nodes](/docs/concepts/configuration/taint-and-toleration/) to schedule those pods onto the right nodes. + +## PodSecurityPolicy Annotations + +The use of sysctl in pods can be controlled via annotations on the PodSecurityPolicy. + +Here is an example, it authorizes binding user creating pod with corresponding +_safe_ and _unsafe_ sysctls. + +```yaml +apiVersion: extensions/v1beta1 +kind: PodSecurityPolicy +metadata: + name: sysctl-psp + annotations: + security.alpha.kubernetes.io/sysctls: 'kernel.shm_rmid_forced' + security.alpha.kubernetes.io/unsafe-sysctls: 'net.ipv4.route.*,kernel.msg*' +spec: + ... +``` diff --git a/docs/concepts/policy/pod-security-policy.md b/docs/concepts/policy/pod-security-policy.md index 3bd22cf3d1..2c607231f4 100644 --- a/docs/concepts/policy/pod-security-policy.md +++ b/docs/concepts/policy/pod-security-policy.md @@ -37,6 +37,7 @@ administrator to control the following: | The SELinux context of the container | [`seLinux`](#selinux) | | The AppArmor profile used by containers | [annotations](#apparmor) | | The seccomp profile used by containers | [annotations](#seccomp) | +| The sysctl profile used by containers | [annotations](#sysctl) | ## Enabling Pod Security Policies @@ -554,3 +555,8 @@ specifies which values are allowed for the pod seccomp annotations. Specified as a comma-delimited list of allowed values. Possible values are those listed above, plus `*` to allow all profiles. Absence of this annotation means that the default cannot be changed. + +### Sysctl + +Controlled via annotations on the PodSecurityPolicy. Refer to the [Sysctl documentation]( +/docs/concepts/cluster-administration/sysctl-cluster/#podsecuritypolicy-annotations).