External-Mirrors/kubespray
2
0
Fork 0
mirror of https://github.com/kubernetes-sigs/kubespray.git synced 2026-01-31 17:19:17 -03:30
Code Issues Packages Projects Releases Wiki Activity

Add the option to enable default Pod Security Configuration (#9017)

Browse Source 
* Add the option to enable default Pod Security Configuration

Enable Pod Security in all namespaces by default with the option to
exempt some namespaces. Without the change only namespaces explicitly
configured will receive the admission plugin treatment.

* Fix the PR according to code review comments

* Revert the latest changes

- leave the empty file when kube_pod_security_use_default, but add comment explaining the empty file
- don't attempt magic at conditionally adding PodSecurity to kube_apiserver_admission_plugins_needs_configuration
This commit is contained in:
Tomas Zvala
2022-08-18 10:16:36 +02:00
committed by GitHub
parent 175cdba9b1
commit 30c77ea4c1
4 changed files with 35 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
docs/hardening.md
View File

@@ -89,6 +89,11 @@ kubelet_seccomp_default: true
# additional configurations
kube_owner: root
kube_cert_group: root
# create a default Pod Security Configuration and deny running of insecure pods
# kube_system namespace is exempted by default
kube_pod_security_use_default: true
kube_pod_security_default_enforce: restricted
```
Let's take a deep look to the resultant **kubernetes** configuration: