From df099406edbd84b5329b3ac58f8e34b31d24f353 Mon Sep 17 00:00:00 2001 From: Eric Chiang Date: Mon, 27 Mar 2017 10:39:27 -0700 Subject: [PATCH] docs/admin: clarify SecurityContextDeny and when it should be used --- docs/admin/admission-controllers.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/admin/admission-controllers.md b/docs/admin/admission-controllers.md index 02cb8c1e5e..a03cc78b7a 100644 --- a/docs/admin/admission-controllers.md +++ b/docs/admin/admission-controllers.md @@ -197,7 +197,7 @@ We strongly recommend using this plug-in if you intend to make use of Kubernetes ### SecurityContextDeny -This plug-in will deny any pod with a [SecurityContext](/docs/user-guide/security-context) that defines options that were not available on the `Container`. +This plug-in will deny any pod that attempts to set certain escalating [SecurityContext](/docs/user-guide/security-context) fields. This should be enabled if a cluster doesn't utilize [pod security policies](/docs/user-guide/pod-security-policy) to restrict the set of values a security context can take. ### ResourceQuota