whentimeslows/website
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge pull request #31953 from sftim/20220227_update_pod_security_admission_concept_v1.24

Browse Source 
Update Pod Security Admission concept for v1.24
This commit is contained in:
Kubernetes Prow Robot
2022-04-27 16:05:35 -07:00
committed by GitHub
parent 61095d4544 a5a94f0f5b
commit a1ef2afd7f
1 changed files with 12 additions and 14 deletions
Download Patch File Download Diff File Expand all files Collapse all files
content/en/docs/concepts/security/pod-security-admission.md
+12 -14
View File
@@ -19,7 +19,7 @@ The Kubernetes [Pod Security Standards](/docs/concepts/security/pod-security-sta
different isolation levels for Pods. These standards let you define how you want to restrict the different isolation levels for Pods. These standards let you define how you want to restrict the
behavior of pods in a clear, consistent fashion. behavior of pods in a clear, consistent fashion.
As a Beta feature, Kubernetes offers a built-in _Pod Security_ {{< glossary_tooltip As a beta feature, Kubernetes offers a built-in _Pod Security_ {{< glossary_tooltip
text="admission controller" term_id="admission-controller" >}}, the successor text="admission controller" term_id="admission-controller" >}}, the successor
to [PodSecurityPolicies](/docs/concepts/security/pod-security-policy/). Pod security restrictions to [PodSecurityPolicies](/docs/concepts/security/pod-security-policy/). Pod security restrictions
are applied at the {{< glossary_tooltip text="namespace" term_id="namespace" >}} level when pods are applied at the {{< glossary_tooltip text="namespace" term_id="namespace" >}} level when pods
@@ -30,25 +30,21 @@ The PodSecurityPolicy API is deprecated and will be
[removed](/docs/reference/using-api/deprecation-guide/#v1-25) from Kubernetes in v1.25. [removed](/docs/reference/using-api/deprecation-guide/#v1-25) from Kubernetes in v1.25.
{{< /note >}} {{< /note >}}
<!-- body -->
## Enabling the `PodSecurity` admission plugin ## {{% heading "prerequisites" %}}
In v1.23, the `PodSecurity` [feature gate](/docs/reference/command-line-tools-reference/feature-gates/) To use this mechanism, your cluster must enforce Pod Security admission.
is a Beta feature and is enabled by default.
In v1.22, the `PodSecurity` [feature gate](/docs/reference/command-line-tools-reference/feature-gates/) ### Built-in Pod Security admission enforcement
is an Alpha feature and must be enabled in `kube-apiserver` in order to use the built-in admission plugin.
```shell In Kubernetes v{{< skew currentVersion >}}, the `PodSecurity` [feature gate](/docs/reference/command-line-tools-reference/feature-gates/)
--feature-gates="...,PodSecurity=true" is a beta feature and is enabled by default. You must have this feature gate enabled.
``` If you are running a different version of Kubernetes, consult the documentation for that release.
## Alternative: installing the `PodSecurity` admission webhook {#webhook} ### Alternative: installing the `PodSecurity` admission webhook {#webhook}
For environments where the built-in `PodSecurity` admission plugin cannot be used, The `PodSecurity` admission logic is also available as a [validating admission webhook](https://git.k8s.io/pod-security-admission/webhook). This implementation is also beta.
either because the cluster is older than v1.22, or the `PodSecurity` feature cannot be enabled, For environments where the built-in `PodSecurity` admission plugin cannot be enabled, you can instead enable that logic via a validating admission webhook.
the `PodSecurity` admission logic is also available as a Beta [validating admission webhook](https://git.k8s.io/pod-security-admission/webhook).
A pre-built container image, certificate generation scripts, and example manifests A pre-built container image, certificate generation scripts, and example manifests
are available at [https://git.k8s.io/pod-security-admission/webhook](https://git.k8s.io/pod-security-admission/webhook). are available at [https://git.k8s.io/pod-security-admission/webhook](https://git.k8s.io/pod-security-admission/webhook).
@@ -66,6 +62,8 @@ The generated certificate is valid for 2 years. Before it expires,
regenerate the certificate or remove the webhook in favor of the built-in admission plugin. regenerate the certificate or remove the webhook in favor of the built-in admission plugin.
{{< /note >}} {{< /note >}}
<!-- body -->
## Pod Security levels ## Pod Security levels
Pod Security admission places requirements on a Pod's [Security Pod Security admission places requirements on a Pod's [Security