From d345db3c7b8dcf414871bab46c348a0d7d57f445 Mon Sep 17 00:00:00 2001 From: Suzana Fernandes Date: Thu, 10 Apr 2025 11:02:05 +0000 Subject: [PATCH] Remove deprecated PSP from docs closes-bug: 2106726 Change-Id: Ibc7942cd20a7ccc9f2a48a078c87d7b79dae389d Signed-off-by: Suzana Fernandes --- .../container-security-df8a251ec03f.rst | 42 ------------------- 1 file changed, 42 deletions(-) diff --git a/doc/source/planning/kubernetes/container-security-df8a251ec03f.rst b/doc/source/planning/kubernetes/container-security-df8a251ec03f.rst index 815b69180..244d80668 100644 --- a/doc/source/planning/kubernetes/container-security-df8a251ec03f.rst +++ b/doc/source/planning/kubernetes/container-security-df8a251ec03f.rst @@ -71,48 +71,6 @@ isolation with virtualization VT extensions. For more information, see :ref:`kata_container`. ---------------------- -Pod Security Policies ---------------------- - -Pod security policies provide a cluster-level resource that controls the use -of security-sensitive aspects of Pod security. PodSecurityPolicies (PSP) define -different levels of access to security-sensitive aspects of the pod. RBAC -[Cluster]Roles can then be created for these PSPs, with RBAC -[Cluster]RoleBindings of these roles to a ‘subject’ (i.e. users, groups, -serviceaccounts, etc.). - -The following considerations apply to PodSecurityPolicies (PSPs): - -- includes enabling or disabling options such as running as root, access to - host filesystem, access to host networking, etc. - -- are disabled by default - -- can be enable by the System Administrator via **system service-parameter-add - kubernetes kube_apiserver admission_plugins=PodSecurityPolicy** - -|prod| provides default PSP and RBAC definitions to simplify initial -usage: - -- Define a ‘restrictive’ and ‘privileged’ PSP, and corresponding - representative RBAC Roles - -- Define initial RBAC RoleBindings for these roles such that: - - - cluster-admin can still perform anything / anywhere - - - authenticated users can only perform a restricted set of - security-sensitive options on Pods and only in namespaces the user - is allowed to access - -Administrator can then: - -- create other custom PodSecurityPolicies and associated RBAC Roles - -- create [Cluster]RoleBindings to the appropriate ‘subjects’. - - ------------------------------------ Container Image Signature Validation ------------------------------------