diff --git a/content/en/docs/tutorials/clusters/seccomp.md b/content/en/docs/tutorials/clusters/seccomp.md index af8cb9e2ef..e3705f5d38 100644 --- a/content/en/docs/tutorials/clusters/seccomp.md +++ b/content/en/docs/tutorials/clusters/seccomp.md @@ -344,7 +344,7 @@ only the privileges they need. Clean up that Pod and Service before moving to the next section: -``` +```shell kubectl delete service violation-pod --wait kubectl delete pod violation-pod --wait --now ``` @@ -431,13 +431,39 @@ kubectl delete pod fine-pod --wait --now ## Create Pod that uses the Container Runtime Default seccomp Profile Most container runtimes provide a sane set of default syscalls that are allowed -or not. The defaults can easily be applied in Kubernetes by using the -`runtime/default` annotation or setting the seccomp type in the security context -of a pod or container to `RuntimeDefault`. +or not. You can adopt these defaults for your workload by setting the seccomp +type in the security context of a pod or container to `RuntimeDefault`. + +{{< note >}} +If you have the `SeccompDefault` [feature gate](/docs/reference/command-line-tools-reference/feature-gates/) enabled, then Pods use the `RuntimeDefault` seccomp profile whenever +no other seccomp profile is specified. Otherwise, the default is `Unconfined`. +{{< /note >}} + +Here's a manifest for a Pod that requests the `RuntimeDefault` seccomp profile +for all its containers: {{< codenew file="pods/security/seccomp/ga/default-pod.yaml" >}} -The default seccomp profile should provide adequate access for most workloads. +Create that Pod: +```shell +kubectl apply -f https://k8s.io/examples/pods/security/seccomp/ga/default-pod.yaml +``` + +```shell +kubectl get pod default-pod +``` + +The Pod should be showing as having started successfully: +``` +NAME READY STATUS RESTARTS AGE +default-pod 1/1 Running 0 20s +``` + +Finally, now that you saw that work OK, clean up: + +```shell +kubectl delete pod default-pod --wait --now +``` ## {{% heading "whatsnext" %}} diff --git a/content/en/examples/pods/security/seccomp/ga/default-pod.yaml b/content/en/examples/pods/security/seccomp/ga/default-pod.yaml index fbeec4c167..b884ec5924 100644 --- a/content/en/examples/pods/security/seccomp/ga/default-pod.yaml +++ b/content/en/examples/pods/security/seccomp/ga/default-pod.yaml @@ -1,9 +1,9 @@ apiVersion: v1 kind: Pod metadata: - name: audit-pod + name: default-pod labels: - app: audit-pod + app: default-pod spec: securityContext: seccompProfile: @@ -12,6 +12,6 @@ spec: - name: test-container image: hashicorp/http-echo:0.2.3 args: - - "-text=just made some syscalls!" + - "-text=just made some more syscalls!" securityContext: allowPrivilegeEscalation: false \ No newline at end of file