mirror of
https://github.com/k3s-io/kubernetes.git
synced 2025-07-24 20:24:09 +00:00
Use runtime/default as default seccomp profile for unprivileged PodSecurityPolicy
This commit is contained in:
parent
bd0d093701
commit
6351e25203
@ -4,8 +4,8 @@ metadata:
|
||||
name: gce.event-exporter
|
||||
annotations:
|
||||
kubernetes.io/description: 'Policy used by the event-exporter addon.'
|
||||
# TODO: event-exporter should run with the default seccomp profile
|
||||
seccomp.security.alpha.kubernetes.io/allowedProfileNames: '*'
|
||||
seccomp.security.alpha.kubernetes.io/defaultProfileName: 'docker/default'
|
||||
seccomp.security.alpha.kubernetes.io/allowedProfileNames: 'runtime/default,docker/default'
|
||||
# 'runtime/default' is already the default, but must be filled in on the
|
||||
# pod to pass admission.
|
||||
apparmor.security.beta.kubernetes.io/defaultProfileName: 'runtime/default'
|
||||
|
@ -4,8 +4,8 @@ metadata:
|
||||
name: gce.fluentd-gcp
|
||||
annotations:
|
||||
kubernetes.io/description: 'Policy used by the fluentd-gcp addon.'
|
||||
# TODO: fluentd-gcp should run with the default seccomp profile
|
||||
seccomp.security.alpha.kubernetes.io/allowedProfileNames: '*'
|
||||
seccomp.security.alpha.kubernetes.io/defaultProfileName: 'docker/default'
|
||||
seccomp.security.alpha.kubernetes.io/allowedProfileNames: 'runtime/default,docker/default'
|
||||
# 'runtime/default' is already the default, but must be filled in on the
|
||||
# pod to pass admission.
|
||||
apparmor.security.beta.kubernetes.io/defaultProfileName: 'runtime/default'
|
||||
|
@ -5,8 +5,8 @@ metadata:
|
||||
annotations:
|
||||
kubernetes.io/description: 'Policy used by the persistent-volume-binder
|
||||
(a.k.a. persistentvolume-controller) to run recycler pods.'
|
||||
# TODO: This should use the default seccomp profile.
|
||||
seccomp.security.alpha.kubernetes.io/allowedProfileNames: '*'
|
||||
seccomp.security.alpha.kubernetes.io/defaultProfileName: 'docker/default'
|
||||
seccomp.security.alpha.kubernetes.io/allowedProfileNames: 'runtime/default,docker/default'
|
||||
labels:
|
||||
kubernetes.io/cluster-service: 'true'
|
||||
addonmanager.kubernetes.io/mode: Reconcile
|
||||
|
@ -7,8 +7,8 @@ metadata:
|
||||
privilege necessary to run non-privileged kube-system pods. This policy is
|
||||
not intended for use outside of kube-system, and may include further
|
||||
restrictions in the future.'
|
||||
# TODO: Addons should use the default seccomp profile.
|
||||
seccomp.security.alpha.kubernetes.io/allowedProfileNames: '*'
|
||||
seccomp.security.alpha.kubernetes.io/defaultProfileName: 'docker/default'
|
||||
seccomp.security.alpha.kubernetes.io/allowedProfileNames: 'runtime/default,docker/default'
|
||||
# 'runtime/default' is already the default, but must be filled in on the
|
||||
# pod to pass admission.
|
||||
apparmor.security.beta.kubernetes.io/defaultProfileName: 'runtime/default'
|
||||
|
Loading…
Reference in New Issue
Block a user