From f22d70abfb1dc0a67712f445188dcc806cf550f4 Mon Sep 17 00:00:00 2001
From: ston1th <ston1th@giftfish.de>
Date: Sat, 14 Dec 2019 19:41:50 +0100
Subject: [PATCH] updated psp

---
 config/{00-namespace.yaml => 100-namespace.yaml}   |  0
 config/{01-podsecuritypolicy.yaml => 200-psp.yaml} | 11 ++++++++---
 config/{02-sa.yaml => 300-rbac.yaml}               |  0
 3 files changed, 8 insertions(+), 3 deletions(-)
 rename config/{00-namespace.yaml => 100-namespace.yaml} (100%)
 rename config/{01-podsecuritypolicy.yaml => 200-psp.yaml} (51%)
 rename config/{02-sa.yaml => 300-rbac.yaml} (100%)

diff --git a/config/00-namespace.yaml b/config/100-namespace.yaml
similarity index 100%
rename from config/00-namespace.yaml
rename to config/100-namespace.yaml
diff --git a/config/01-podsecuritypolicy.yaml b/config/200-psp.yaml
similarity index 51%
rename from config/01-podsecuritypolicy.yaml
rename to config/200-psp.yaml
index 722161a..2a1be4d 100644
--- a/config/01-podsecuritypolicy.yaml
+++ b/config/200-psp.yaml
@@ -3,17 +3,22 @@ apiVersion: policy/v1beta1
 kind: PodSecurityPolicy
 metadata:
   name: pvc-reaper
+  annotations:
+    apparmor.security.beta.kubernetes.io/allowedProfileNames: 'runtime/default'
+    apparmor.security.beta.kubernetes.io/defaultProfileName: 'runtime/default'
+    seccomp.security.alpha.kubernetes.io/allowedProfileNames: 'docker/default'
+    seccomp.security.alpha.kubernetes.io/defaultProfileName: 'docker/default'
 spec:
   privileged: false
   allowPrivilegeEscalation: false
-  requiredDropCapabilities:
-  - ALL
+  requiredDropCapabilities: ["ALL"]
   readOnlyRootFilesystem: true
+  volumes: ["secret"]
   hostNetwork: false
   hostIPC: false
   hostPID: false
   runAsUser:
-    rule: 'RunAsAny'
+    rule: 'MustRunAsNonRoot'
   seLinux:
     rule: 'RunAsAny'
   supplementalGroups:
diff --git a/config/02-sa.yaml b/config/300-rbac.yaml
similarity index 100%
rename from config/02-sa.yaml
rename to config/300-rbac.yaml