ston1th/webhook-interceptor
0
0
Fork 0
Code Issues Pull requests Releases Activity

updated psp

Browse source
This commit is contained in:
ston1th 2019-12-14 19:40:55 +01:00
commit 38061de9da
1 changed files with 8 additions and 5 deletions
Download patch file Download diff file Expand all files Collapse all files

32
config/200-psp.yaml Normal file
View file

@ -0,0 +1,32 @@
apiVersion: policy/v1beta1
kind: PodSecurityPolicy
metadata:
name: webhook-interceptor
annotations:
apparmor.security.beta.kubernetes.io/allowedProfileNames: 'runtime/default'
apparmor.security.beta.kubernetes.io/defaultProfileName: 'runtime/default'
seccomp.security.alpha.kubernetes.io/allowedProfileNames: 'docker/default'
seccomp.security.alpha.kubernetes.io/defaultProfileName: 'docker/default'
spec:
privileged: false
allowPrivilegeEscalation: false
requiredDropCapabilities: ["ALL"]
readOnlyRootFilesystem: true
volumes: ["secret"]
hostNetwork: false
hostIPC: false
hostPID: false
runAsUser:
rule: 'MustRunAsNonRoot'
seLinux:
rule: 'RunAsAny'
supplementalGroups:
rule: 'MustRunAs'
ranges:
- min: 1
max: 65535
fsGroup:
rule: 'MustRunAs'
ranges:
- min: 1
max: 65535