Remove deprecated PSP from docs
closes-bug: 2106726 Change-Id: Ibc7942cd20a7ccc9f2a48a078c87d7b79dae389d Signed-off-by: Suzana Fernandes <Suzana.Fernandes@windriver.com>
This commit is contained in:
parent
1cd958e718
commit
d345db3c7b
@ -71,48 +71,6 @@ isolation with virtualization VT extensions.
|
||||
|
||||
For more information, see :ref:`kata_container`.
|
||||
|
||||
---------------------
|
||||
Pod Security Policies
|
||||
---------------------
|
||||
|
||||
Pod security policies provide a cluster-level resource that controls the use
|
||||
of security-sensitive aspects of Pod security. PodSecurityPolicies (PSP) define
|
||||
different levels of access to security-sensitive aspects of the pod. RBAC
|
||||
[Cluster]Roles can then be created for these PSPs, with RBAC
|
||||
[Cluster]RoleBindings of these roles to a ‘subject’ (i.e. users, groups,
|
||||
serviceaccounts, etc.).
|
||||
|
||||
The following considerations apply to PodSecurityPolicies (PSPs):
|
||||
|
||||
- includes enabling or disabling options such as running as root, access to
|
||||
host filesystem, access to host networking, etc.
|
||||
|
||||
- are disabled by default
|
||||
|
||||
- can be enable by the System Administrator via **system service-parameter-add
|
||||
kubernetes kube_apiserver admission_plugins=PodSecurityPolicy**
|
||||
|
||||
|prod| provides default PSP and RBAC definitions to simplify initial
|
||||
usage:
|
||||
|
||||
- Define a ‘restrictive’ and ‘privileged’ PSP, and corresponding
|
||||
representative RBAC Roles
|
||||
|
||||
- Define initial RBAC RoleBindings for these roles such that:
|
||||
|
||||
- cluster-admin can still perform anything / anywhere
|
||||
|
||||
- authenticated users can only perform a restricted set of
|
||||
security-sensitive options on Pods and only in namespaces the user
|
||||
is allowed to access
|
||||
|
||||
Administrator can then:
|
||||
|
||||
- create other custom PodSecurityPolicies and associated RBAC Roles
|
||||
|
||||
- create [Cluster]RoleBindings to the appropriate ‘subjects’.
|
||||
|
||||
|
||||
------------------------------------
|
||||
Container Image Signature Validation
|
||||
------------------------------------
|
||||
|
Loading…
x
Reference in New Issue
Block a user