whentimeslows/website
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix space problems which ide results in

Browse Source 
Signed-off-by: tim-zju <21651152@zju.edu.cn>
This commit is contained in:
tim-zju
2016-12-22 20:01:22 +08:00
parent 1f7b3148f2
commit df7eb8128d
5 changed files with 42 additions and 42 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/user-guide/pod-security-policy/index.md
+18 -18
View File
@@ -4,8 +4,8 @@ assignees:
title: Pod Security Policies
---
Objects of type `podsecuritypolicy` govern the ability
to make requests on a pod that affect the `SecurityContext` that will be
Objects of type `podsecuritypolicy` govern the ability
to make requests on a pod that affect the `SecurityContext` that will be
applied to a pod and container.
See [PodSecurityPolicy proposal](https://github.com/kubernetes/kubernetes/blob/{{page.githubbranch}}/docs/proposals/security-context-constraints.md) for more information.
@@ -15,10 +15,10 @@ See [PodSecurityPolicy proposal](https://github.com/kubernetes/kubernetes/blob/{
## What is a Pod Security Policy?
A _Pod Security Policy_ is a cluster-level resource that controls the
A _Pod Security Policy_ is a cluster-level resource that controls the
actions that a pod can perform and what it has the ability to access. The
`PodSecurityPolicy` objects define a set of conditions that a pod must
run with in order to be accepted into the system. They allow an
`PodSecurityPolicy` objects define a set of conditions that a pod must
run with in order to be accepted into the system. They allow an
administrator to control the following:
1. Running of privileged containers.
@@ -31,16 +31,16 @@ administrator to control the following:
1. Requiring the use of a read only root file system
1. Controlling the usage of volume types
_Pod Security Policies_ are comprised of settings and strategies that
control the security features a pod has access to. These settings fall
_Pod Security Policies_ are comprised of settings and strategies that
control the security features a pod has access to. These settings fall
into three categories:
- *Controlled by a boolean*: Fields of this type default to the most
restrictive value.
- *Controlled by an allowable set*: Fields of this type are checked
- *Controlled by a boolean*: Fields of this type default to the most
restrictive value.
- *Controlled by an allowable set*: Fields of this type are checked
against the set to ensure their value is allowed.
- *Controlled by a strategy*: Items that have a strategy to generate a value provide
a mechanism to generate the value and a mechanism to ensure that a
a mechanism to generate the value and a mechanism to ensure that a
specified value falls into the set of allowable values.
@@ -65,22 +65,22 @@ specified.
### SupplementalGroups
- *MustRunAs* - Requires at least one range to be specified. Uses the
- *MustRunAs* - Requires at least one range to be specified. Uses the
minimum value of the first range as the default. Validates against all ranges.
- *RunAsAny* - No default provided. Allows any `*supplementalGroups*` to be
specified.
### FSGroup
- *MustRunAs* - Requires at least one range to be specified. Uses the
minimum value of the first range as the default. Validates against the
- *MustRunAs* - Requires at least one range to be specified. Uses the
minimum value of the first range as the default. Validates against the
first ID in the first range.
- *RunAsAny* - No default provided. Allows any `*fsGroup*` ID to be specified.
### Controlling Volumes
The usage of specific volume types can be controlled by setting the
volumes field of the PSP. The allowable values of this field correspond
The usage of specific volume types can be controlled by setting the
volumes field of the PSP. The allowable values of this field correspond
to the volume sources that are defined when creating a volume:
1. azureFile
@@ -104,7 +104,7 @@ to the volume sources that are defined when creating a volume:
1. configMap
1. \* (allow all volumes)
The recommended minimum set of allowed volumes for new PSPs are
The recommended minimum set of allowed volumes for new PSPs are
configMap, downwardAPI, emptyDir, persistentVolumeClaim, and secret.
## Admission
@@ -150,7 +150,7 @@ podsecuritypolicy "permissive" deleted
## Enabling Pod Security Policies
In order to use Pod Security Policies in your cluster you must ensure the
In order to use Pod Security Policies in your cluster you must ensure the
following
1. You have enabled the api type `extensions/v1beta1/podsecuritypolicy`