From 04175801a34829f4dc48b86b6b744c1fbe89c666 Mon Sep 17 00:00:00 2001 From: Mark Bishop Date: Thu, 12 Jul 2018 11:58:02 -0700 Subject: [PATCH] moved pod security policies task and concept to new folder, added aliases to index.md, deleted old folders --- .../pod-security-policies/_index-concept.md | 19 +++++++++ .../pod-security-policies/_index-task.md | 41 +++++++++++++++++++ .../pod-security-policies/_index.md | 3 +- 3 files changed, 62 insertions(+), 1 deletion(-) create mode 100644 content/rancher/v2.x/en/admin-settings/pod-security-policies/_index-concept.md create mode 100644 content/rancher/v2.x/en/admin-settings/pod-security-policies/_index-task.md diff --git a/content/rancher/v2.x/en/admin-settings/pod-security-policies/_index-concept.md b/content/rancher/v2.x/en/admin-settings/pod-security-policies/_index-concept.md new file mode 100644 index 00000000000..7e635fa3235 --- /dev/null +++ b/content/rancher/v2.x/en/admin-settings/pod-security-policies/_index-concept.md @@ -0,0 +1,19 @@ +--- +title: Pod Security Policies +weight: 75 +--- + +_Pod Security Policies_ (or PSPs) are objects that control security-sensitive aspects of pod specification (like root privileges). If a pod does not meet the conditions specified in the PSP, Kubernetes will not allow it to start, and Rancher will display an error message of `Pod is forbidden: unable to validate...`. + +- You can assign PSPs at the cluster or project level. +- PSPs work through inheritance. + + - By default, PSPs assigned to a cluster are inherited by its projects, as well as any namespaces added to those projects. + - **Exception:** Namespaces that are not assigned to projects do not inherit PSPs, regardless of whether the PSP is assigned to a cluster or project. Because these namespaces have no PSPs, workload deployments to these namespaces will fail, which is the default Kubernetes behavior. + - You can override the default PSP by assigning a different PSP directly to the project. +- Any workloads that are already running in a cluster or project before a PSP is assigned will not be checked if it complies with the PSP. Workloads would need to be cloned or upgraded to see if they pass the PSP. + +Read more about Pod Security Policies in the [Kubernetes Documentation](https://kubernetes.io/docs/concepts/policy/pod-security-policy/). + +>**Best Practice:** +>Set Pod Security at the cluster level. diff --git a/content/rancher/v2.x/en/admin-settings/pod-security-policies/_index-task.md b/content/rancher/v2.x/en/admin-settings/pod-security-policies/_index-task.md new file mode 100644 index 00000000000..e9eb69200a6 --- /dev/null +++ b/content/rancher/v2.x/en/admin-settings/pod-security-policies/_index-task.md @@ -0,0 +1,41 @@ +--- +title: Pod Security Policies +weight: 125 +--- +Using Rancher, you can create a Pod Security Policy using our GUI rather than creating a YAML file. + +## Creating Pod Security Policies + +1. From the **Global** view, select **Security** > **Pod Security Policies** from the main menu. Then click **Add Policy**. + + **Step Result:** The **Add Policy** form opens. + +2. Name the policy. + +3. Complete each section of the form. Refer to the Kubernetes documentation linked below for more information on what each policy does. + + - Basic Policies: + + - [Privilege Escalation](https://kubernetes.io/docs/concepts/policy/pod-security-policy/#privilege-escalation) + - [Host Namespaces][2] + - [Read Only Root Filesystems][1] + + - [Capability Policies](https://kubernetes.io/docs/concepts/policy/pod-security-policy/#capabilities) + - [Volume Policy][1] + - [Allowed Host Paths Policy][1] + - [FS Group Policy][1] + - [Run As User Policy][1] + - [Host Ports Policy][2] + - [Run As User Policy][3] + - [SELinux Policy](https://kubernetes.io/docs/concepts/policy/pod-security-policy/#selinux) + - [Supplemental Groups Policy][3] + +### What's Next? + +Now that you've created a Pod Security Policy, you can apply it to clusters and projects. For more information, see [Adding a Pod Security Policy to a Cluster]({{< baseurl >}}/rancher/v2.x/en/tasks/clusters/adding-a-pod-security-policy). + + + +[1]: https://kubernetes.io/docs/concepts/policy/pod-security-policy/#volumes-and-file-systems +[2]: https://kubernetes.io/docs/concepts/policy/pod-security-policy/#host-namespaces +[3]: https://kubernetes.io/docs/concepts/policy/pod-security-policy/#users-and-groups diff --git a/content/rancher/v2.x/en/admin-settings/pod-security-policies/_index.md b/content/rancher/v2.x/en/admin-settings/pod-security-policies/_index.md index 1a460255621..a9b2cb40901 100644 --- a/content/rancher/v2.x/en/admin-settings/pod-security-policies/_index.md +++ b/content/rancher/v2.x/en/admin-settings/pod-security-policies/_index.md @@ -2,5 +2,6 @@ title: Pod Security Policies weight: 25 aliases: - + -/rancher/v2.x/en/concepts/global-configuration/pod-security-policies + -/rancher/v2.x/en/tasks/global-configuration/pod-security-policies --- \ No newline at end of file