Permalink
Switch branches/tags
Nothing to show
Find file Copy path
Fetching contributors…
Cannot retrieve contributors at this time
83 lines (82 sloc) 1.85 KB
---
apiVersion: policy/v1beta1
kind: PodSecurityPolicy
metadata:
name: kube-system-psp
annotations:
seccomp.security.alpha.kubernetes.io/allowedProfileNames: 'docker/default'
apparmor.security.beta.kubernetes.io/allowedProfileNames: 'runtime/default'
seccomp.security.alpha.kubernetes.io/defaultProfileName: 'docker/default'
apparmor.security.beta.kubernetes.io/defaultProfileName: 'runtime/default'
spec:
privileged: false
# Required to prevent escalations to root.
allowPrivilegeEscalation: false
allowedCapabilities:
- '*'
# Allow core volume types.
hostNetwork: true
hostPorts:
- min: 0
max: 65535
hostIPC: true
hostPID: true
volumes:
- 'configMap'
- 'emptyDir'
- 'projected'
- 'secret'
- 'downwardAPI'
runAsUser:
# Require the container to run without root privileges.
rule: 'RunAsAny'
seLinux:
# This policy assumes the nodes are using AppArmor rather than SELinux.
rule: 'RunAsAny'
supplementalGroups:
rule: 'RunAsAny'
fsGroup:
rule: 'RunAsAny'
# rule: 'MustRunAs'
# ranges:
# # Forbid adding the root group.
# - min: 1
# max: 65535
---
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
name: psp:kube-system-psp
namespace: kube-system
rules:
- apiGroups:
- extensions
resourceNames:
- kube-system-psp
resources:
- podsecuritypolicies
verbs:
- use
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
name: psp:kube-system-psp
namespace: kube-system
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: Role
name: psp:kube-system-psp
subjects:
- kind: ServiceAccount
name: coredns
- kind: ServiceAccount
name: heapster
- kind: ServiceAccount
name: metrics-server
- kind: ServiceAccount
name: influxdb
- kind: ServiceAccount
name: kube-dns
- kind: ServiceAccount
name: kubernetes-dashboard