ston1th/webhook-interceptor
0
0
Fork 0
Code Issues Pull requests Releases Activity

updated psp

Browse source
This commit is contained in:
ston1th 2019-12-14 19:40:55 +01:00
commit 38061de9da
1 changed files with 8 additions and 5 deletions
Download patch file Download diff file Expand all files Collapse all files

13
config/200-podsecuritypolicy.yaml → config/200-psp.yaml
View file

@ -2,19 +2,22 @@ apiVersion: policy/v1beta1
kind: PodSecurityPolicy
metadata:
name: webhook-interceptor
annotations:
apparmor.security.beta.kubernetes.io/allowedProfileNames: 'runtime/default'
apparmor.security.beta.kubernetes.io/defaultProfileName: 'runtime/default'
seccomp.security.alpha.kubernetes.io/allowedProfileNames: 'docker/default'
seccomp.security.alpha.kubernetes.io/defaultProfileName: 'docker/default'
spec:
privileged: false
allowPrivilegeEscalation: false
requiredDropCapabilities:
- ALL
requiredDropCapabilities: ["ALL"]
readOnlyRootFilesystem: true
volumes:
- 'secret'
volumes: ["secret"]
hostNetwork: false
hostIPC: false
hostPID: false
runAsUser:
rule: 'RunAsAny'
rule: 'MustRunAsNonRoot'
seLinux:
rule: 'RunAsAny'
supplementalGroups: