From 69c02fd1cb629b1cd32b0075e95cdf297fbca738 Mon Sep 17 00:00:00 2001
From: ston1th <ston1th@giftfish.de>
Date: Sat, 14 Dec 2019 19:42:50 +0100
Subject: [PATCH] updated psp

---
 config/{200-podsecuritypolicy.yaml => 200-psp.yaml} | 11 ++++++++---
 1 file changed, 8 insertions(+), 3 deletions(-)
 rename config/{200-podsecuritypolicy.yaml => 200-psp.yaml} (51%)

diff --git a/config/200-podsecuritypolicy.yaml b/config/200-psp.yaml
similarity index 51%
rename from config/200-podsecuritypolicy.yaml
rename to config/200-psp.yaml
index baf2d31..e541662 100644
--- a/config/200-podsecuritypolicy.yaml
+++ b/config/200-psp.yaml
@@ -3,17 +3,22 @@ apiVersion: policy/v1beta1
 kind: PodSecurityPolicy
 metadata:
   name: status-reporter
+  annotations:
+    apparmor.security.beta.kubernetes.io/allowedProfileNames: 'runtime/default'
+    apparmor.security.beta.kubernetes.io/defaultProfileName: 'runtime/default'
+    seccomp.security.alpha.kubernetes.io/allowedProfileNames: 'docker/default'
+    seccomp.security.alpha.kubernetes.io/defaultProfileName: 'docker/default'
 spec:
   privileged: false
   allowPrivilegeEscalation: false
-  requiredDropCapabilities:
-  - ALL
+  requiredDropCapabilities: ["ALL"]
   readOnlyRootFilesystem: true
+  volumes: ["secret"]
   hostNetwork: false
   hostIPC: false
   hostPID: false
   runAsUser:
-    rule: 'RunAsAny'
+    rule: 'MustRunAsNonRoot'
   seLinux:
     rule: 'RunAsAny'
   supplementalGroups: