From 38061de9daa82c64cea9881b304679730ccec8d7 Mon Sep 17 00:00:00 2001
From: ston1th <ston1th@giftfish.de>
Date: Sat, 14 Dec 2019 19:40:55 +0100
Subject: [PATCH] updated psp

---
 config/{200-podsecuritypolicy.yaml => 200-psp.yaml} | 13 ++++++++-----
 1 file changed, 8 insertions(+), 5 deletions(-)
 rename config/{200-podsecuritypolicy.yaml => 200-psp.yaml} (51%)

diff --git a/config/200-podsecuritypolicy.yaml b/config/200-psp.yaml
similarity index 51%
rename from config/200-podsecuritypolicy.yaml
rename to config/200-psp.yaml
index ab64ada..1c82b1b 100644
--- a/config/200-podsecuritypolicy.yaml
+++ b/config/200-psp.yaml
@@ -2,19 +2,22 @@ apiVersion: policy/v1beta1
 kind: PodSecurityPolicy
 metadata:
   name: webhook-interceptor
+  annotations:
+    apparmor.security.beta.kubernetes.io/allowedProfileNames: 'runtime/default'
+    apparmor.security.beta.kubernetes.io/defaultProfileName: 'runtime/default'
+    seccomp.security.alpha.kubernetes.io/allowedProfileNames: 'docker/default'
+    seccomp.security.alpha.kubernetes.io/defaultProfileName: 'docker/default'
 spec:
   privileged: false
   allowPrivilegeEscalation: false
-  requiredDropCapabilities:
-  - ALL
+  requiredDropCapabilities: ["ALL"]
   readOnlyRootFilesystem: true
-  volumes:
-  - 'secret'
+  volumes: ["secret"]
   hostNetwork: false
   hostIPC: false
   hostPID: false
   runAsUser:
-    rule: 'RunAsAny'
+    rule: 'MustRunAsNonRoot'
   seLinux:
     rule: 'RunAsAny'
   supplementalGroups: