whentimeslows/website
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

docs/concepts/policy/pod-security-policy: list all available PSP fields.

Browse Source 
This also adds a couple of improvements:
- rename SELinuxContext to SELinux
- improve options displaying
This commit is contained in:
Slava Semushin
2017-03-27 20:11:22 +02:00
committed by Andrew Chen
parent df099406ed
commit 8d8409baeb
1 changed files with 26 additions and 19 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/concepts/policy/pod-security-policy.md
+26 -19
View File
@@ -21,15 +21,22 @@ actions that a pod can perform and what it has the ability to access. The
run with in order to be accepted into the system. They allow an run with in order to be accepted into the system. They allow an
administrator to control the following: administrator to control the following:
1. Running of privileged containers. | Control Aspect | Field Name |
1. Capabilities a container can request to be added. | ------------------------------------------------------------- | --------------------------------- |
1. The SELinux context of the container. | Running of privileged containers | `privileged` |
1. The user ID. | Default set of capabilities that will be added to a container | `defaultAddCapabilities` |
1. The use of host namespaces and networking. | Capabilities that will be dropped from a container | `requiredDropCapabilities` |
1. Allocating an FSGroup that owns the pod's volumes | Capabilities a container can request to be added | `allowedCapabilities` |
1. Configuring allowable supplemental groups | Controlling the usage of volume types | [`volumes`](#controlling-volumes) |
1. Requiring the use of a read only root file system | The use of host networking | [`hostNetwork`](#host-network) |
1. Controlling the usage of volume types | The use of host ports | `hostPorts` |
| The use of host's PID namespace | `hostPID` |
| The use of host's IPC namespace | `hostIPC` |
| The SELinux context of the container | [`seLinux`](#selinux) |
| The user ID | [`runAsUser`](#runasuser) |
| Configuring allowable supplemental groups | [`supplementalGroups`](#supplementalgroups) |
| Allocating an FSGroup that owns the pod's volumes | [`fsGroup`](#fsgroup) |
| Requiring the use of a read only root file system | `readOnlyRootFilesystem` |
_Pod Security Policies_ are comprised of settings and strategies that _Pod Security Policies_ are comprised of settings and strategies that
control the security features a pod has access to. These settings fall control the security features a pod has access to. These settings fall
@@ -48,26 +55,26 @@ specified value falls into the set of allowable values.
### RunAsUser ### RunAsUser
- *MustRunAs* - Requires a `*range*` to be configured. Uses the first value - *MustRunAs* - Requires a `range` to be configured. Uses the first value
of the range as the default. Validates against the configured range. of the range as the default. Validates against the configured range.
- *MustRunAsNonRoot* - Requires that the pod be submitted with a non-zero - *MustRunAsNonRoot* - Requires that the pod be submitted with a non-zero
`*runAsUser*` or have the `USER` directive defined in the image. No default `runAsUser` or have the `USER` directive defined in the image. No default
provided. provided.
- *RunAsAny* - No default provided. Allows any `*runAsUser*` to be specified. - *RunAsAny* - No default provided. Allows any `runAsUser` to be specified.
### SELinuxContext ### SELinux
- *MustRunAs* - Requires `*seLinuxOptions*` to be configured if not using - *MustRunAs* - Requires `seLinuxOptions` to be configured if not using
pre-allocated values. Uses `*seLinuxOptions*` as the default. Validates against pre-allocated values. Uses `seLinuxOptions` as the default. Validates against
`*seLinuxOptions*`. `seLinuxOptions`.
- *RunAsAny* - No default provided. Allows any `*seLinuxOptions*` to be - *RunAsAny* - No default provided. Allows any `seLinuxOptions` to be
specified. specified.
### SupplementalGroups ### SupplementalGroups
- *MustRunAs* - Requires at least one range to be specified. Uses the - *MustRunAs* - Requires at least one range to be specified. Uses the
minimum value of the first range as the default. Validates against all ranges. minimum value of the first range as the default. Validates against all ranges.
- *RunAsAny* - No default provided. Allows any `*supplementalGroups*` to be - *RunAsAny* - No default provided. Allows any `supplementalGroups` to be
specified. specified.
### FSGroup ### FSGroup
@@ -75,7 +82,7 @@ specified.
- *MustRunAs* - Requires at least one range to be specified. Uses the - *MustRunAs* - Requires at least one range to be specified. Uses the
minimum value of the first range as the default. Validates against the minimum value of the first range as the default. Validates against the
first ID in the first range. first ID in the first range.
- *RunAsAny* - No default provided. Allows any `*fsGroup*` ID to be specified. - *RunAsAny* - No default provided. Allows any `fsGroup` ID to be specified.
### Controlling Volumes ### Controlling Volumes