mirror of
https://github.com/k3s-io/kubernetes.git
synced 2025-07-29 06:27:05 +00:00
Merge pull request #67624 from tallclair/psp-addons
Automatic merge from submit-queue. If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>. Allow adding default capabilities to unprivileged addons **What this PR does / why we need it**: Allow adding the default set of capabilities back to unprivileged addons, when using the the default GCE PodSecurityPolicies. This is useful when paired with `drop: [ 'all' ]` This is not a relaxation of permissions, as a pod that didn't touch capabilities (implicitly has the default set) is already allowed. **Which issue(s) this PR fixes**: Fixes https://github.com/kubernetes/dns/issues/254 **Release note**: ```release-note NONE ```
This commit is contained in:
commit
b72e61edaa
@ -19,6 +19,22 @@ metadata:
|
|||||||
spec:
|
spec:
|
||||||
privileged: false
|
privileged: false
|
||||||
allowPrivilegeEscalation: false
|
allowPrivilegeEscalation: false
|
||||||
|
# The docker default set of capabilities
|
||||||
|
allowedCapabilities:
|
||||||
|
- SETPCAP
|
||||||
|
- MKNOD
|
||||||
|
- AUDIT_WRITE
|
||||||
|
- CHOWN
|
||||||
|
- NET_RAW
|
||||||
|
- DAC_OVERRIDE
|
||||||
|
- FOWNER
|
||||||
|
- FSETID
|
||||||
|
- KILL
|
||||||
|
- SETGID
|
||||||
|
- SETUID
|
||||||
|
- NET_BIND_SERVICE
|
||||||
|
- SYS_CHROOT
|
||||||
|
- SETFCAP
|
||||||
volumes:
|
volumes:
|
||||||
- 'emptyDir'
|
- 'emptyDir'
|
||||||
- 'configMap'
|
- 'configMap'
|
||||||
|
Loading…
Reference in New Issue
Block a user