Remove deprecated PSP from docs

closes-bug: 2106726

Change-Id: Ibc7942cd20a7ccc9f2a48a078c87d7b79dae389d
Signed-off-by: Suzana Fernandes <Suzana.Fernandes@windriver.com>
This commit is contained in:
Suzana Fernandes 2025-04-10 11:02:05 +00:00
parent 1cd958e718
commit d345db3c7b

View File

@ -71,48 +71,6 @@ isolation with virtualization VT extensions.
For more information, see :ref:`kata_container`.
---------------------
Pod Security Policies
---------------------
Pod security policies provide a cluster-level resource that controls the use
of security-sensitive aspects of Pod security. PodSecurityPolicies (PSP) define
different levels of access to security-sensitive aspects of the pod. RBAC
[Cluster]Roles can then be created for these PSPs, with RBAC
[Cluster]RoleBindings of these roles to a subject (i.e. users, groups,
serviceaccounts, etc.).
The following considerations apply to PodSecurityPolicies (PSPs):
- includes enabling or disabling options such as running as root, access to
host filesystem, access to host networking, etc.
- are disabled by default
- can be enable by the System Administrator via **system service-parameter-add
kubernetes kube_apiserver admission_plugins=PodSecurityPolicy**
|prod| provides default PSP and RBAC definitions to simplify initial
usage:
- Define a restrictive and privileged PSP, and corresponding
representative RBAC Roles
- Define initial RBAC RoleBindings for these roles such that:
- cluster-admin can still perform anything / anywhere
- authenticated users can only perform a restricted set of
security-sensitive options on Pods and only in namespaces the user
is allowed to access
Administrator can then:
- create other custom PodSecurityPolicies and associated RBAC Roles
- create [Cluster]RoleBindings to the appropriate subjects.
------------------------------------
Container Image Signature Validation
------------------------------------