ston1th/webhook-interceptor
0
0
Fork 0
Code Issues Pull requests Releases Activity

updated psp

Browse source
This commit is contained in:
ston1th 2019-12-14 19:40:55 +01:00
commit 38061de9da
1 changed files with 8 additions and 5 deletions
Download patch file Download diff file Expand all files Collapse all files

13
config/200-podsecuritypolicy.yaml → config/200-psp.yaml
View file

@ -2,19 +2,22 @@ apiVersion: policy/v1beta1
kind: PodSecurityPolicy kind: PodSecurityPolicy
metadata: metadata:
name: webhook-interceptor name: webhook-interceptor
annotations:
apparmor.security.beta.kubernetes.io/allowedProfileNames: 'runtime/default'
apparmor.security.beta.kubernetes.io/defaultProfileName: 'runtime/default'
seccomp.security.alpha.kubernetes.io/allowedProfileNames: 'docker/default'
seccomp.security.alpha.kubernetes.io/defaultProfileName: 'docker/default'
spec: spec:
privileged: false privileged: false
allowPrivilegeEscalation: false allowPrivilegeEscalation: false
requiredDropCapabilities: requiredDropCapabilities: ["ALL"]
- ALL
readOnlyRootFilesystem: true readOnlyRootFilesystem: true
volumes: volumes: ["secret"]
- 'secret'
hostNetwork: false hostNetwork: false
hostIPC: false hostIPC: false
hostPID: false hostPID: false
runAsUser: runAsUser:
rule: 'RunAsAny' rule: 'MustRunAsNonRoot'
seLinux: seLinux:
rule: 'RunAsAny' rule: 'RunAsAny'
supplementalGroups: supplementalGroups: