remove-psp-in-flannel (#9365)
This commit is contained in:
parent
131bd933a6
commit
859df84b45
2 changed files with 9 additions and 54 deletions
|
@ -5,64 +5,11 @@ metadata:
|
||||||
name: flannel
|
name: flannel
|
||||||
namespace: kube-system
|
namespace: kube-system
|
||||||
---
|
---
|
||||||
apiVersion: policy/v1beta1
|
|
||||||
kind: PodSecurityPolicy
|
|
||||||
metadata:
|
|
||||||
name: psp.flannel.unprivileged
|
|
||||||
annotations:
|
|
||||||
seccomp.security.alpha.kubernetes.io/allowedProfileNames: runtime/default
|
|
||||||
seccomp.security.alpha.kubernetes.io/defaultProfileName: runtime/default
|
|
||||||
{% if podsecuritypolicy_enabled and apparmor_enabled %}
|
|
||||||
apparmor.security.beta.kubernetes.io/allowedProfileNames: runtime/default
|
|
||||||
apparmor.security.beta.kubernetes.io/defaultProfileName: runtime/default
|
|
||||||
{% endif %}
|
|
||||||
spec:
|
|
||||||
privileged: false
|
|
||||||
volumes:
|
|
||||||
- configMap
|
|
||||||
- secret
|
|
||||||
- emptyDir
|
|
||||||
- hostPath
|
|
||||||
allowedHostPaths:
|
|
||||||
- pathPrefix: "/etc/cni/net.d"
|
|
||||||
- pathPrefix: "/etc/kube-flannel"
|
|
||||||
- pathPrefix: "/run/flannel"
|
|
||||||
readOnlyRootFilesystem: false
|
|
||||||
# Users and groups
|
|
||||||
runAsUser:
|
|
||||||
rule: RunAsAny
|
|
||||||
supplementalGroups:
|
|
||||||
rule: RunAsAny
|
|
||||||
fsGroup:
|
|
||||||
rule: RunAsAny
|
|
||||||
# Privilege Escalation
|
|
||||||
allowPrivilegeEscalation: false
|
|
||||||
defaultAllowPrivilegeEscalation: false
|
|
||||||
# Capabilities
|
|
||||||
allowedCapabilities: ['NET_ADMIN']
|
|
||||||
defaultAddCapabilities: []
|
|
||||||
requiredDropCapabilities: []
|
|
||||||
# Host namespaces
|
|
||||||
hostPID: false
|
|
||||||
hostIPC: false
|
|
||||||
hostNetwork: true
|
|
||||||
hostPorts:
|
|
||||||
- min: 0
|
|
||||||
max: 65535
|
|
||||||
# SELinux
|
|
||||||
seLinux:
|
|
||||||
# SELinux is unused in CaaSP
|
|
||||||
rule: 'RunAsAny'
|
|
||||||
---
|
|
||||||
kind: ClusterRole
|
kind: ClusterRole
|
||||||
apiVersion: rbac.authorization.k8s.io/v1
|
apiVersion: rbac.authorization.k8s.io/v1
|
||||||
metadata:
|
metadata:
|
||||||
name: flannel
|
name: flannel
|
||||||
rules:
|
rules:
|
||||||
- apiGroups: ['extensions']
|
|
||||||
resources: ['podsecuritypolicies']
|
|
||||||
verbs: ['use']
|
|
||||||
resourceNames: ['psp.flannel.unprivileged']
|
|
||||||
- apiGroups:
|
- apiGroups:
|
||||||
- ""
|
- ""
|
||||||
resources:
|
resources:
|
||||||
|
|
|
@ -79,7 +79,7 @@ spec:
|
||||||
securityContext:
|
securityContext:
|
||||||
privileged: false
|
privileged: false
|
||||||
capabilities:
|
capabilities:
|
||||||
add: ["NET_ADMIN"]
|
add: ["NET_ADMIN", "NET_RAW"]
|
||||||
env:
|
env:
|
||||||
- name: POD_NAME
|
- name: POD_NAME
|
||||||
valueFrom:
|
valueFrom:
|
||||||
|
@ -89,11 +89,15 @@ spec:
|
||||||
valueFrom:
|
valueFrom:
|
||||||
fieldRef:
|
fieldRef:
|
||||||
fieldPath: metadata.namespace
|
fieldPath: metadata.namespace
|
||||||
|
- name: EVENT_QUEUE_DEPTH
|
||||||
|
value: "5000"
|
||||||
volumeMounts:
|
volumeMounts:
|
||||||
- name: run
|
- name: run
|
||||||
mountPath: /run/flannel
|
mountPath: /run/flannel
|
||||||
- name: flannel-cfg
|
- name: flannel-cfg
|
||||||
mountPath: /etc/kube-flannel/
|
mountPath: /etc/kube-flannel/
|
||||||
|
- name: xtables-lock
|
||||||
|
mountPath: /run/xtables.lock
|
||||||
affinity:
|
affinity:
|
||||||
nodeAffinity:
|
nodeAffinity:
|
||||||
requiredDuringSchedulingIgnoredDuringExecution:
|
requiredDuringSchedulingIgnoredDuringExecution:
|
||||||
|
@ -146,6 +150,10 @@ spec:
|
||||||
- name: flannel-cfg
|
- name: flannel-cfg
|
||||||
configMap:
|
configMap:
|
||||||
name: kube-flannel-cfg
|
name: kube-flannel-cfg
|
||||||
|
- name: xtables-lock
|
||||||
|
hostPath:
|
||||||
|
path: /run/xtables.lock
|
||||||
|
type: FileOrCreate
|
||||||
- name: cni-plugin
|
- name: cni-plugin
|
||||||
hostPath:
|
hostPath:
|
||||||
path: /opt/cni/bin
|
path: /opt/cni/bin
|
||||||
|
|
Loading…
Reference in a new issue