diff --git a/content/en/docs/concepts/policy/pod-security-policy.md b/content/en/docs/concepts/policy/pod-security-policy.md index 17d9cf23b9..17f2cef7db 100644 --- a/content/en/docs/concepts/policy/pod-security-policy.md +++ b/content/en/docs/concepts/policy/pod-security-policy.md @@ -593,7 +593,9 @@ are: - `unconfined` - Seccomp is not applied to the container processes (this is the default in Kubernetes), if no alternative is provided. -- `docker/default` - The Docker default seccomp profile is used. +- `runtime/default` - The default container runtime profile is used. +- `docker/default` - The Docker default seccomp profile is used. Deprecated as of + Kubernetes 1.11. Use `runtime/default` instead. - `localhost/` - Specify a profile as a file on the node located at `/`, where `` is defined via the `--seccomp-profile-root` flag on the Kubelet. diff --git a/content/en/examples/policy/restricted-psp.yaml b/content/en/examples/policy/restricted-psp.yaml index e677ba8e22..4db57688b1 100644 --- a/content/en/examples/policy/restricted-psp.yaml +++ b/content/en/examples/policy/restricted-psp.yaml @@ -3,9 +3,9 @@ kind: PodSecurityPolicy metadata: name: restricted annotations: - seccomp.security.alpha.kubernetes.io/allowedProfileNames: 'docker/default' + seccomp.security.alpha.kubernetes.io/allowedProfileNames: 'docker/default,runtime/default' apparmor.security.beta.kubernetes.io/allowedProfileNames: 'runtime/default' - seccomp.security.alpha.kubernetes.io/defaultProfileName: 'docker/default' + seccomp.security.alpha.kubernetes.io/defaultProfileName: 'runtime/default' apparmor.security.beta.kubernetes.io/defaultProfileName: 'runtime/default' spec: privileged: false diff --git a/content/ja/examples/policy/restricted-psp.yaml b/content/ja/examples/policy/restricted-psp.yaml index e677ba8e22..4db57688b1 100644 --- a/content/ja/examples/policy/restricted-psp.yaml +++ b/content/ja/examples/policy/restricted-psp.yaml @@ -3,9 +3,9 @@ kind: PodSecurityPolicy metadata: name: restricted annotations: - seccomp.security.alpha.kubernetes.io/allowedProfileNames: 'docker/default' + seccomp.security.alpha.kubernetes.io/allowedProfileNames: 'docker/default,runtime/default' apparmor.security.beta.kubernetes.io/allowedProfileNames: 'runtime/default' - seccomp.security.alpha.kubernetes.io/defaultProfileName: 'docker/default' + seccomp.security.alpha.kubernetes.io/defaultProfileName: 'runtime/default' apparmor.security.beta.kubernetes.io/defaultProfileName: 'runtime/default' spec: privileged: false