diff --git a/user/kubernetes/cluster/security.md b/user/kubernetes/cluster/security.md index f5175f84..ad4f617a 100644 --- a/user/kubernetes/cluster/security.md +++ b/user/kubernetes/cluster/security.md @@ -13,9 +13,9 @@ This is advanced functionality and should be applied with caution. If a deployme Toggle on **Enable pod security constraints** to enable the functionality, then toggle on the features you require and configure them as needed. {% hint style="info" %} -Policies are based on the [Kubernetes security policy reference](https://v1-21.docs.kubernetes.io/docs/concepts/policy/pod-security-policy/#policy-reference) - for more detail on each option check the Kubernetes documentation. +Policies are based on [Kubernetes Pod Security Policy](https://kubernetes.io/docs/concepts/security/pod-security-policy/) but are implemented as [Constraints and Constraint Templates with Gatekeeper](https://open-policy-agent.github.io/gatekeeper-library/website/pspintro) - for more detail on each option, see the OPA Gatekeeper documentation. {% endhint %} -
Field/OptionOverview
Restrict running privileged containersSet whether any container in a pod can enable privileged mode.
Restrict host namespaceControls whether the pod containers can share the process ID namespace and host IPC namespace.
Restrict host networking portsDefine a range of ports that can be used by pods, on a per-network basis.
Restrict volume typesDefine the types of volumes that may be used. Examples of volume types are configMap, downwardAPI, emptyDir, persistentVolumeClaim, secret, projected, hostPath, flexVolume.
Restrict host filesystem pathsDefine the host paths that are allowed when using hostPath volumes.
Restrict driversDefine the FlexVolume drivers that can be used.
Require read-only root filesystemSpecify that containers must run with a read-only root filesystem.
Restrict User and group idsControls which user ID or group ID the containers are run with or which group IDs get added. For users, specify MustRunAs to define specific user ID ranges, MustRunAsNonRoot to require non-root users, or RunAsAny to permit running as any user. For groups, specify MustRunAs, MayRunAs or RunAsAny.
Restrict escalation to root privilegesControls the user privileges and prevents files from enabling extra capabilities.
Restrict Linux capabilitiesDefine the capabilities available to the pod. Set allowed capabilities to specify those capabilities that a container can use, and set Required drop capabilities to specify which privileges must be dropped from containers.
Restrict SELinux security contextControls the SELinux context of the container. You can specify the level, role, type and user.
Restrict Proc Mount typesDefines the type of /proc mount to use for containers. Select either Default or Unmasked.
Restrict AppArmor profilesControls the AppArmor profile used by containers. Refer to the AppArmor documentation for more details.
Restrict seccomp profilesControls the seccomp profile used by containers or pods.
Restrict sysctl profilesControls the sysctl profile used by containers. Specify the sysctls to forbid from use by pods.
+
Field/OptionOverview
Restrict running privileged containersSet whether any container in a pod can enable privileged mode.
Restrict host namespaceControls whether the pod containers can share the process ID namespace and host IPC namespace.
Restrict host networking portsDefine a range of ports that can be used by pods, on a per-network basis.
Restrict volume typesDefine the types of volumes that may be used. Examples of volume types are configMap, downwardAPI, emptyDir, persistentVolumeClaim, secret, projected, hostPath, flexVolume.
Restrict host filesystem pathsDefine the host paths that are allowed when using hostPath volumes.
Restrict driversDefine the FlexVolume drivers that can be used.
Require read-only root filesystemSpecify that containers must run with a read-only root filesystem.
Restrict User and group idsControls which user ID or group ID the containers are run with or which group IDs get added. For users, specify MustRunAs to define specific user ID ranges, MustRunAsNonRoot to require non-root users, or RunAsAny to permit running as any user. For groups, specify MustRunAs, MayRunAs or RunAsAny.
Restrict escalation to root privilegesControls the user privileges and prevents files from enabling extra capabilities.
Restrict Linux capabilitiesDefine the capabilities available to the pod. Set allowed capabilities to specify those capabilities that a container can use, and set Required drop capabilities to specify which privileges must be dropped from containers.
Restrict SELinux security contextControls the SELinux context of the container. You can specify the level, role, type and user.
Restrict Proc Mount typesDefines the type of /proc mount to use for containers. Select either Default or Unmasked.
Restrict AppArmor profilesControls the AppArmor profile used by containers. Refer to the AppArmor documentation for more details.
Restrict seccomp profilesControls the seccomp profile used by containers or pods.
Restrict sysctl profilesControls the sysctl profile used by containers. Specify the sysctls to forbid from use by pods.
Once you have completed your configuration, click **Save settings** to apply your changes.