From 7b7b8d2d5ca901a81e2ce4fb496745651ebf81be Mon Sep 17 00:00:00 2001
From: "xin.li" <xin.li@daocloud.io>
Date: Tue, 29 Mar 2022 19:51:51 +0800
Subject: [PATCH] [zh] Update restricted-psp.yaml

Signed-off-by: xin.li <xin.li@daocloud.io>
---
 .../zh/examples/policy/restricted-psp.yaml    | 19 +++++++++----------
 1 file changed, 9 insertions(+), 10 deletions(-)

diff --git a/content/zh/examples/policy/restricted-psp.yaml b/content/zh/examples/policy/restricted-psp.yaml
index 4db57688b1..99c836b9ff 100644
--- a/content/zh/examples/policy/restricted-psp.yaml
+++ b/content/zh/examples/policy/restricted-psp.yaml
@@ -5,44 +5,43 @@ metadata:
   annotations:
     seccomp.security.alpha.kubernetes.io/allowedProfileNames: 'docker/default,runtime/default'
     apparmor.security.beta.kubernetes.io/allowedProfileNames: 'runtime/default'
-    seccomp.security.alpha.kubernetes.io/defaultProfileName:  'runtime/default'
     apparmor.security.beta.kubernetes.io/defaultProfileName:  'runtime/default'
 spec:
   privileged: false
-  # Required to prevent escalations to root.
+  # 防止权限升级到 root
   allowPrivilegeEscalation: false
-  # This is redundant with non-root + disallow privilege escalation,
-  # but we can provide it for defense in depth.
   requiredDropCapabilities:
     - ALL
-  # Allow core volume types.
+  # 允许的核心卷类型.
   volumes:
     - 'configMap'
     - 'emptyDir'
     - 'projected'
     - 'secret'
     - 'downwardAPI'
-    # Assume that persistentVolumes set up by the cluster admin are safe to use.
+    # 假设集群管理员设置的临时 CSI 驱动程序和持久卷可以安全使用
+    - 'csi'
     - 'persistentVolumeClaim'
+    - 'ephemeral'
   hostNetwork: false
   hostIPC: false
   hostPID: false
   runAsUser:
-    # Require the container to run without root privileges.
+    # 要求容器在没有 root 权限的情况下运行
     rule: 'MustRunAsNonRoot'
   seLinux:
-    # This policy assumes the nodes are using AppArmor rather than SELinux.
+    # 此策略假定节点使用 AppArmor 而不是 SELinux
     rule: 'RunAsAny'
   supplementalGroups:
     rule: 'MustRunAs'
     ranges:
-      # Forbid adding the root group.
+      # 禁止添加 root 组
       - min: 1
         max: 65535
   fsGroup:
     rule: 'MustRunAs'
     ranges:
-      # Forbid adding the root group.
+      # 禁止添加 root 组
       - min: 1
         max: 65535
   readOnlyRootFilesystem: false