remove-psp-in-flannel (#9365)

This commit is contained in:
Kay Yan 2022-10-14 15:16:47 +08:00 committed by GitHub
parent 131bd933a6
commit 859df84b45
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
2 changed files with 9 additions and 54 deletions

View file

@ -5,64 +5,11 @@ metadata:
name: flannel name: flannel
namespace: kube-system namespace: kube-system
--- ---
apiVersion: policy/v1beta1
kind: PodSecurityPolicy
metadata:
name: psp.flannel.unprivileged
annotations:
seccomp.security.alpha.kubernetes.io/allowedProfileNames: runtime/default
seccomp.security.alpha.kubernetes.io/defaultProfileName: runtime/default
{% if podsecuritypolicy_enabled and apparmor_enabled %}
apparmor.security.beta.kubernetes.io/allowedProfileNames: runtime/default
apparmor.security.beta.kubernetes.io/defaultProfileName: runtime/default
{% endif %}
spec:
privileged: false
volumes:
- configMap
- secret
- emptyDir
- hostPath
allowedHostPaths:
- pathPrefix: "/etc/cni/net.d"
- pathPrefix: "/etc/kube-flannel"
- pathPrefix: "/run/flannel"
readOnlyRootFilesystem: false
# Users and groups
runAsUser:
rule: RunAsAny
supplementalGroups:
rule: RunAsAny
fsGroup:
rule: RunAsAny
# Privilege Escalation
allowPrivilegeEscalation: false
defaultAllowPrivilegeEscalation: false
# Capabilities
allowedCapabilities: ['NET_ADMIN']
defaultAddCapabilities: []
requiredDropCapabilities: []
# Host namespaces
hostPID: false
hostIPC: false
hostNetwork: true
hostPorts:
- min: 0
max: 65535
# SELinux
seLinux:
# SELinux is unused in CaaSP
rule: 'RunAsAny'
---
kind: ClusterRole kind: ClusterRole
apiVersion: rbac.authorization.k8s.io/v1 apiVersion: rbac.authorization.k8s.io/v1
metadata: metadata:
name: flannel name: flannel
rules: rules:
- apiGroups: ['extensions']
resources: ['podsecuritypolicies']
verbs: ['use']
resourceNames: ['psp.flannel.unprivileged']
- apiGroups: - apiGroups:
- "" - ""
resources: resources:

View file

@ -79,7 +79,7 @@ spec:
securityContext: securityContext:
privileged: false privileged: false
capabilities: capabilities:
add: ["NET_ADMIN"] add: ["NET_ADMIN", "NET_RAW"]
env: env:
- name: POD_NAME - name: POD_NAME
valueFrom: valueFrom:
@ -89,11 +89,15 @@ spec:
valueFrom: valueFrom:
fieldRef: fieldRef:
fieldPath: metadata.namespace fieldPath: metadata.namespace
- name: EVENT_QUEUE_DEPTH
value: "5000"
volumeMounts: volumeMounts:
- name: run - name: run
mountPath: /run/flannel mountPath: /run/flannel
- name: flannel-cfg - name: flannel-cfg
mountPath: /etc/kube-flannel/ mountPath: /etc/kube-flannel/
- name: xtables-lock
mountPath: /run/xtables.lock
affinity: affinity:
nodeAffinity: nodeAffinity:
requiredDuringSchedulingIgnoredDuringExecution: requiredDuringSchedulingIgnoredDuringExecution:
@ -146,6 +150,10 @@ spec:
- name: flannel-cfg - name: flannel-cfg
configMap: configMap:
name: kube-flannel-cfg name: kube-flannel-cfg
- name: xtables-lock
hostPath:
path: /run/xtables.lock
type: FileOrCreate
- name: cni-plugin - name: cni-plugin
hostPath: hostPath:
path: /opt/cni/bin path: /opt/cni/bin