whentimeslows/website
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Add "MayRunAs" value among other GroupStrategies (#9888)

Browse Source
This commit is contained in:
Stanislav Láznička
2018-09-13 07:05:02 +02:00
committed by k8s-ci-robot
parent 8ba585e8f7
commit ae83bb4938
1 changed files with 6 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
content/en/docs/concepts/policy/pod-security-policy.md
+6
View File
@@ -421,6 +421,9 @@ The **recommended minimum set** of allowed volumes for new PSPs are:
- *MustRunAs* - Requires at least one `range` to be specified. Uses the - *MustRunAs* - Requires at least one `range` to be specified. Uses the
minimum value of the first range as the default. Validates against all ranges. minimum value of the first range as the default. Validates against all ranges.
- *MayRunAs* - Requires at least one `range` to be specified. Allows
`FSGroups` to be left unset without providing a default. Validates against
all ranges if `FSGroups` is set.
- *RunAsAny* - No default provided. Allows any `fsGroup` ID to be specified. - *RunAsAny* - No default provided. Allows any `fsGroup` ID to be specified.
**AllowedHostPaths** - This specifies a whitelist of host paths that are allowed **AllowedHostPaths** - This specifies a whitelist of host paths that are allowed
@@ -491,6 +494,9 @@ recommended with this strategy.
- *MustRunAs* - Requires at least one `range` to be specified. Uses the - *MustRunAs* - Requires at least one `range` to be specified. Uses the
minimum value of the first range as the default. Validates against all ranges. minimum value of the first range as the default. Validates against all ranges.
- *MayRunAs* - Requires at least one `range` to be specified. Allows
`supplementalGroups` to be left unset without providing a default.
Validates against all ranges if `supplementalGroups` is set.
- *RunAsAny* - No default provided. Allows any `supplementalGroups` to be - *RunAsAny* - No default provided. Allows any `supplementalGroups` to be
specified. specified.