Skip to content
Permalink
Branch: master
Find file Copy path
Find file Copy path
Fetching contributors…
Cannot retrieve contributors at this time
74 lines (73 sloc) 1.59 KB
apiVersion: policy/v1beta1
kind: PodSecurityPolicy
metadata:
name: cb-restricted
annotations:
seccomp.security.alpha.kubernetes.io/allowedProfileNames: 'runtime/default'
apparmor.security.beta.kubernetes.io/allowedProfileNames: 'runtime/default'
seccomp.security.alpha.kubernetes.io/defaultProfileName: 'runtime/default'
apparmor.security.beta.kubernetes.io/defaultProfileName: 'runtime/default'
spec:
privileged: false
fsGroup:
rule: 'MustRunAs'
ranges:
- min: 1
max: 65535
runAsUser:
rule: 'MustRunAs'
ranges:
- min: 1
max: 65535
seLinux:
rule: RunAsAny
supplementalGroups:
rule: RunAsAny
volumes:
- 'emptyDir'
- 'secret'
- 'downwardAPI'
- 'configMap'
- 'persistentVolumeClaim'
- 'projected'
hostPID: false
hostIPC: false
hostNetwork: false
allowPrivilegeEscalation: false
---
# restricted psp to be use accross cluster.
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
name: restricted-psp-cluster-role
rules:
- apiGroups:
- policy
resources:
- podsecuritypolicies
resourceNames:
- cb-restricted
verbs:
- use
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
name: restricted-psp-role
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: ClusterRole
name: restricted-psp-cluster-role
subjects:
- kind: ServiceAccount
name: cjoc
namespace: cb-core
- kind: ServiceAccount
name: jenkins
namespace: cb-core
- kind: ServiceAccount
name: default
namespace: cb-core
- kind: ServiceAccount
name: managed-master-hibernation-monitor
namespace: cb-core
You can’t perform that action at this time.