github/kubernetes
1
0
Fork 0
mirror of https://github.com/k3s-io/kubernetes.git synced 2025-07-27 05:27:21 +00:00
Code Issues Projects Releases Wiki Activity

Allow adding default capabilities to unprivileged addons

Browse Source
This commit is contained in:
Tim Allclair 2018-08-20 17:28:09 -07:00
parent 6d76e35b39
commit 13adb97714
1 changed files with 16 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

16
cluster/gce/addons/podsecuritypolicies/unprivileged-addon.yaml
View File

@ -19,6 +19,22 @@ metadata:
spec: spec:
privileged: false privileged: false
allowPrivilegeEscalation: false allowPrivilegeEscalation: false
# The docker default set of capabilities
allowedCapabilities:
- SETPCAP
- MKNOD
- AUDIT_WRITE
- CHOWN
- NET_RAW
- DAC_OVERRIDE
- FOWNER
- FSETID
- KILL
- SETGID
- SETUID
- NET_BIND_SERVICE
- SYS_CHROOT
- SETFCAP
volumes: volumes:
- 'emptyDir' - 'emptyDir'
- 'configMap' - 'configMap'