whentimeslows/website
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge pull request #33961 from harshitasao/issue-33696

Browse Source 
Modify RBAC good practice guide
This commit is contained in:
Kubernetes Prow Robot
2022-05-29 18:08:53 -07:00
committed by GitHub
parent 571ae1d43e 2517ad6c77
commit a49c7b1ba4
1 changed files with 7 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
content/en/docs/concepts/security/rbac-good-practices.md
+5 -1
View File
@@ -43,7 +43,8 @@ some general rules that can be applied are :
### Minimize distribution of privileged tokens ### Minimize distribution of privileged tokens
Ideally, pods shouldn't be assigned service accounts granted powerful permissions (listed [here](#Kubernetes-RBAC---Privilege-Escalation-Risks)). Ideally, pods shouldn't be assigned service accounts that have been granted powerful permissions (for example, any of the rights listed under
[privilege escalation risks](#privilege-escalation-risks)).
In cases where a workload requires powerful permissions, consider the following practices: In cases where a workload requires powerful permissions, consider the following practices:
- Limit the number of nodes running powerful pods. Ensure that any DaemonSets you run - Limit the number of nodes running powerful pods. Ensure that any DaemonSets you run
@@ -173,3 +174,6 @@ are allowed limited access to a system.
One option for mitigation of this issue would be to use [resource quotas](/docs/concepts/policy/resource-quotas/#object-count-quota) One option for mitigation of this issue would be to use [resource quotas](/docs/concepts/policy/resource-quotas/#object-count-quota)
to limit the quantity of objects which can be created. to limit the quantity of objects which can be created.
## {{% heading "whatsnext" %}}
* To learn more about RBAC, see the [RBAC documentation](/docs/reference/access-authn-authz/rbac/).