From ae83bb49385835bbf1ce5c0750597fc72e208b20 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Stanislav=20L=C3=A1zni=C4=8Dka?= Date: Thu, 13 Sep 2018 07:05:02 +0200 Subject: [PATCH] Add "MayRunAs" value among other GroupStrategies (#9888) --- content/en/docs/concepts/policy/pod-security-policy.md | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/content/en/docs/concepts/policy/pod-security-policy.md b/content/en/docs/concepts/policy/pod-security-policy.md index 432d7c1662..4f528a8d8f 100644 --- a/content/en/docs/concepts/policy/pod-security-policy.md +++ b/content/en/docs/concepts/policy/pod-security-policy.md @@ -421,6 +421,9 @@ The **recommended minimum set** of allowed volumes for new PSPs are: - *MustRunAs* - Requires at least one `range` to be specified. Uses the minimum value of the first range as the default. Validates against all ranges. +- *MayRunAs* - Requires at least one `range` to be specified. Allows +`FSGroups` to be left unset without providing a default. Validates against +all ranges if `FSGroups` is set. - *RunAsAny* - No default provided. Allows any `fsGroup` ID to be specified. **AllowedHostPaths** - This specifies a whitelist of host paths that are allowed @@ -491,6 +494,9 @@ recommended with this strategy. - *MustRunAs* - Requires at least one `range` to be specified. Uses the minimum value of the first range as the default. Validates against all ranges. +- *MayRunAs* - Requires at least one `range` to be specified. Allows +`supplementalGroups` to be left unset without providing a default. +Validates against all ranges if `supplementalGroups` is set. - *RunAsAny* - No default provided. Allows any `supplementalGroups` to be specified.