From 03f0d23228304d6dfa58123d9e01d0c2c6c8cffe Mon Sep 17 00:00:00 2001 From: Jordan Liggitt Date: Thu, 19 May 2022 14:51:51 -0400 Subject: [PATCH 1/2] Clarify privileged Pod Security Standard description --- content/en/docs/concepts/security/pod-security-standards.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/en/docs/concepts/security/pod-security-standards.md b/content/en/docs/concepts/security/pod-security-standards.md index 393468ac74..55ec37f5f7 100644 --- a/content/en/docs/concepts/security/pod-security-standards.md +++ b/content/en/docs/concepts/security/pod-security-standards.md @@ -32,7 +32,7 @@ typically aimed at system- and infrastructure-level workloads managed by privile The Privileged policy is defined by an absence of restrictions. For allow-by-default enforcement mechanisms (such as gatekeeper), the Privileged policy may be an absence of applied constraints rather than an instantiated profile. In contrast, for a deny-by-default mechanism (such as Pod -Security Policy) the Privileged policy should enable all controls (disable all restrictions). +Security Policy) the Privileged policy should disable all restrictions. ### Baseline From 79c01ff06dbff43d56d2c7463be88706e5552945 Mon Sep 17 00:00:00 2001 From: Jordan Liggitt Date: Thu, 19 May 2022 17:03:39 -0400 Subject: [PATCH 2/2] Update content/en/docs/concepts/security/pod-security-standards.md Co-authored-by: Tim Allclair --- content/en/docs/concepts/security/pod-security-standards.md | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/content/en/docs/concepts/security/pod-security-standards.md b/content/en/docs/concepts/security/pod-security-standards.md index 55ec37f5f7..c95ded28cd 100644 --- a/content/en/docs/concepts/security/pod-security-standards.md +++ b/content/en/docs/concepts/security/pod-security-standards.md @@ -29,9 +29,8 @@ This guide outlines the requirements of each policy. **The _Privileged_ policy is purposely-open, and entirely unrestricted.** This type of policy is typically aimed at system- and infrastructure-level workloads managed by privileged, trusted users. -The Privileged policy is defined by an absence of restrictions. For allow-by-default enforcement -mechanisms (such as gatekeeper), the Privileged policy may be an absence of applied constraints -rather than an instantiated profile. In contrast, for a deny-by-default mechanism (such as Pod +The Privileged policy is defined by an absence of restrictions. Allow-by-default +mechanisms (such as gatekeeper) may be Privileged by default. In contrast, for a deny-by-default mechanism (such as Pod Security Policy) the Privileged policy should disable all restrictions. ### Baseline