public/rancher-docs
1
0
Fork 0
mirror of https://github.com/rancher/rancher-docs.git synced 2026-09-11 19:55:50 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #251 from MBishop17/psp

Browse Source 
Psp
This commit is contained in:
Denise
2018-06-07 20:36:19 -07:00
committed by GitHub
parent cff30bbe6c b1a505b466
commit 109e2a16d3
3 changed files with 102 additions and 41 deletions
Download Patch File Download Diff File Expand all files Collapse all files
content/rancher/v2.x/en/concepts/global-configuration/_index.md
+16 -7
View File
@@ -106,11 +106,11 @@ Assignment of global permissions to a user depends on their authentication sourc
#### Custom Global Permissions
Rather than assigning users the default global permissions of `Administrator` or `Standard User`, you can assign them _custom permissions_. Custom permissions are sets of global permissions composed of individual _permissions_ that you select.
Rather than assigning users the default global permissions of `Administrator` or `Standard User`, you can assign them a custom set of permissions.
_Permissions_ are individual access rights that you can assign to a custom global permissions.
_Permissions_ are individual access rights that you can assign when selecting a custom permission for a user.
Custom permissions are convenient for providing users with narrow or specialized access to Rancher. See the [table](#global-permissions-reference) below for a list of individual permissions available.
Using custom permissions is convenient for providing users with narrow or specialized access to Rancher. See the [table below](#global-permissions-reference) for a list of individual permissions available.
#### Global Permissions Reference
@@ -134,8 +134,9 @@ The following table lists each custom global permission available and whether it
Cluster and project roles define user authorization inside a cluster or project. You can manage these roles from the **Global > Security > Roles** page. From this page you can:
- Lock/unlock roles so that they may not be used in any new role assignments (existing assignments will still be enforce).
- Create and manage new roles for use across all clusters and projects.
- Create and manage new roles for use across all clusters and projects
- [Lock/unlock roles](#locked-roles) so that they may not be used in any new role assignments (existing assignments will still be enforce)
#### Membership and Role Assignment
@@ -183,7 +184,7 @@ _Project roles_ are roles that can be used to grant users access to a project. T
- **Owner:**
These users have full control over the projet and all resources in it.
These users have full control over the project and all resources in it.
- **Member:**
@@ -251,7 +252,15 @@ This is the URL of your Rancher Server. All nodes in your cluster must resolve t
## Pod Security Policies
_Pod Security Policies_ are objects that control security-sensitive aspects of pod specification. Pods only run within Kubernetes if they meet the conditions specified in their assigned Pod Security Policy.
_Pod Security Policies_ (or PSPs) are objects that control security-sensitive aspects of pod specification (like root privileges). If a pod does not meet the conditions specified in the PSP, Kubernetes will not allow it to start, and Rancher will display an error message of `Pod <NAME> is forbidden: unable to validate...`.
- You can assign PSPs at the cluster or project level.
- PSPs work through inheritance.
- By default, PSPs assigned to a cluster are inherited by its projects, as well as any namespaces added to those projects.
- **Exception:** Namespaces that are not assigned to projects do not inherit PSPs, regardless of whether the PSP is assigned to a cluster or project. Because these namespaces have no PSPs, workload deployments to these namespaces will fail, which is the default Kubernetes behavior.
- You can override the default PSP by assigning a different PSP directly to the project.
- Any workloads that are already running in a cluster or project before a PSP is assigned will not be checked if it complies with the PSP. Workloads would need to be cloned or upgraded to see if they pass the PSP.
Read more about Pod Security Policies in the [Kubernetes Documentation](https://kubernetes.io/docs/concepts/policy/pod-security-policy/).
content/rancher/v2.x/en/tasks/clusters/adding-a-pod-security-policy/_index.md
+85 -33
View File
@@ -4,41 +4,93 @@ weight: 3475
draft: true
---
You can add a [Pod Security Policy]({{< baseurl >}}/rancher/v2.x/en/concepts/global-configuration/#pod-security-policies) to either a _Cluster_ or a _Project_. _Pod Security Policies_ set on a _Cluster_ act as a default and are applied to all _Namespaces_ assigned to _Projects_ within that _Cluster_. Default _Pod Security Policies_ can be overridden by setting a _Pod Security Policy_ on a project. _Namespaces_ that are not assigned to a _Project_ within a _Cluster_ are not given a _Pod Security Policy_. As a result, all new _Workload_ deployments within those _Namespaces_ will fail (this is the default Kubernetes behavior).
_Pod Security Policies_ are objects that control security-sensitive aspects of pod specification (like root privileges).
## Pod Security Policies and Clusters
### Create a Cluster with a default Pod Security Policy
1. Ensure a _Pod Security Policy_ exists. Refer to the [Adding Pod Security Policies]({{< baseurl >}}/rancher/v2.x/en/tasks/global-configuration/pod-security-policies/) task for details.
1. On the __Add Cluster__ screen under the __Cluster Options__ accordion select __Enabled__ for __Pod Security Policy Support__.
You can add a Pod Security Policy (PSPs hereafter) in the following contexts:
>Note that not all cloud providers support _Pod Security Policies_ and this option may not be shown. Also if no _Pod Security Policy_ are defined in Rancher then this option will be greyed out.
1. Select a _Pod Security Policy_ from the dropdown.
1. Fill out the rest of the _Cluster_ information and create it as normal.
1. When the _Cluster_ has finished provisioning the _Pod Security Policy_ that you selected will be applied to all the projects within that cluster.
- [When creating a cluster](#cluster-creation--adding-a-default-pod-security-policy)
- [When editing an existing cluster](#existing-cluster--adding-a-pod-security-policy)
- [When creating a project](#project-creation--adding-a-pod-security-policy)
- [When editing an existing project](#existing-project--adding-a-pod-security-policy)
### Add a Pod Security Policy to an existing Cluster
1. Ensure a _Pod Security Policy_ exists. Refer to the [Adding Pod Security Policies]({{< baseurl >}}/rancher/v2.x/en/tasks/global-configuration/pod-security-policies/) task for details.
1. Click the vertical ellipsis next to the _Cluster_ you want to enable _Pod Security Policies_ for.
1. Select __Edit__.
1. On the __Edit Cluster__ screen under the __Cluster Options__ accordion select __Enabled__ for __Pod Security Policy Support__. Note that not all cloud providers support _Pod Security Policies_ and this option may not be shown. Also if no _Pod Security Policy_ are defined in Rancher then this option will be greyed out.
1. Select a _Pod Security Policy_ from the dropdown.
1. __Save__ the _Cluster_.
1. When the _Cluster_ has finished updating the _Pod Security Policy_ that you selected will be applied to all the projects within that cluster.
> **Note:** We recommend adding PSPs during cluster and project creation instead of adding it to an existing one.
## Pod Security Policies and Projects
### Create a Project with a Pod Security Policy.
1. Ensure a _Pod Security Policy_ exists. Refer to the [Adding Pod Security Policies]({{< baseurl >}}/rancher/v2.x/en/tasks/global-configuration/pod-security-policies/) task for details.
1. Navigate to a _Cluster_ with _Pod Security Policy Support_ enabled.
1. On the __Projects/Namespaces__ screen click __Add Project__.
1. On the __Add Project__ screen select a _Pod Security Policy_ from the dropdown.
1. Fill out the rest of the information as usual.
1. Click __Create__.
1. The _Project_ will create with the selected _Pod Security Policy_ applied.
For more information about PSPs, refer to [Pod Security Policy]({{< baseurl >}}/rancher/v2.x/en/concepts/global-configuration/#pod-security-policies).
### Add a Pod Security Policy to an existing Project
1. Ensure a _Pod Security Policy_ exists. Refer to the [Adding Pod Security Policies]({{< baseurl >}}/rancher/v2.x/en/tasks/global-configuration/pod-security-policies/) task for details.
1. Navigate to a _Cluster_ with _Pod Security Policy Support_ enabled.
1. __Edit__ a _Project_.
1. Select a _Pod Security Policy_ from the dropdown.
1. Click __Save__.
1. The _Project_ will have the selected _Pod Security Policy_ applied.
## Cluster Creation: Adding a Default Pod Security Policy
When you create a new cluster, you can configure it to apply a PSP immediately. As you create the cluster, use the **Cluster Options** to enable a PSP. The PSP assigned to the cluster will be the default PSP for projects within the cluster.
>**Prerequisite:**
>Create a Pod Security Policy within Rancher. Before you can assign a default PSP to a new cluster, you must have a PSP available for assignment. For instruction, see [Creating Pod Security Policies]({{< baseurl >}}/rancher/v2.x/en/tasks/global-configuration/pod-security-policies/).
>**Note:**
>For security purposes, we recommend assiging a PSP as you create your clusters.
To enable a default Pod Security Policy, set the **Pod Security Policy Support** option to **Enabled**, and then make a selection from the **Default Pod Security Policy** drop-down.
When the cluster finishes provisioning, the PSP you selected is applied to all projects within the cluster.
For detailed instruction about assigning a PSP to a new cluster, see [Creating a Cluster]({{< baseurl >}}/rancher/v2.x/en/tasks/clusters/creating-a-cluster/).
## Existing Cluster: Adding a Pod Security Policy
If you don't apply a PSP as you create your cluster, you can always add one later.
>**Prerequisite:**
>Create a Pod Security Policy within Rancher. Before you can assign a default PSP to an existing cluster, you must have a PSP available for assignment. For instruction, see [Creating Pod Security Policies]({{< baseurl >}}/rancher/v2.x/en/tasks/global-configuration/pod-security-policies/).
1. From the from the **Global** view, find the cluster that you want apply your PSP to. Select **Vertical Ellipsis (...) > Edit** for the cluster you want to enable PSPs for.
2. Expand the **Cluster Options** accordion.
3. From **Pod Security Policy Support**, select **Enabled**.
>**Note:** Not all cluster providers support PSPs, so this option may not be available.
**Step Result:** The **Default Pod Security Policy** drop-down activates.
4. From **Default Pod Security Policy**, select the PSP you want to apply to the cluster.
5. Click **Save**.
**Result:** The PSP is applied to the cluster and any projects within the cluster.
>**Note:** Any workloads that are already running in a cluster or project before a PSP is assigned will not be checked if it complies with the PSP. Workloads would need to be cloned or upgraded to see if they pass the PSP.
## Project Creation: Adding a Pod Security Policy
When you create a new project, you can assign a PSP directly to the project. Assigning a PSP to a project will:
- Override the cluster's default PSP.
- Apply the PSP to project.
- Apply the PSP to any namespaces you add to the project later.
>**Prerequisites:**
>- Create a Pod Security Policy within Rancher. Before you can assign a default PSP to a new project, you must have a PSP available for assignment. For instruction, see [Creating Pod Security Policies]({{< baseurl >}}/rancher/v2.x/en/tasks/global-configuration/pod-security-policies/).
>- Assign a default Pod Security Policy to the project's cluster. You can't assign a PSP to a project until one is already applied to the cluster. For more information, see [Existing Cluster: Adding a Pod Security Policy](#existing-cluster--adding-a-pod-security-policy).
As you create the project, make a selection from the **Pod Security Policy** drop-down to assign a PSP.
<!--For more information, see [Creating a Project]({{< baseurl >}}/rancher/v2.x/en/tasks/projects/#creating-a-project/-->
## Existing Project: Adding a Pod Security Policy
You can always assign a PSP to an existing project if you didn't assign one during creation.
>**Prerequisite:**
>Create a Pod Security Policy within Rancher. Before you can assign a default PSP to an existing project, you must have a PSP available for assignment. For instruction, see [Creating Pod Security Policies]({{< baseurl >}}/rancher/v2.x/en/tasks/global-configuration/pod-security-policies/).
>- Assign a default Pod Security Policy to the project's cluster. You can't assign a PSP to a project until one is already applied to the cluster. For more information, see [Existing Cluster: Adding a Pod Security Policy](#existing-cluster--adding-a-pod-security-policy).
1. From the navigation menu, browse to the cluster containing the project you want to apply a PSP to.
2. From the navigation menu, select **Projects/Namespaces**.
3. Find the project that you want to add a PSP to. From that project, select **Vertical Ellipsis (...) > Edit**.
4. From the **Pod Security Policy** drop-down, select the PSP you want to apply to the project.
5. Click **Save**.
**Result:** The PSP is applied to the project and any namespaces added to the project.
>**Note:** Any workloads that are already running in a cluster or project before a PSP is assigned will not be checked if it complies with the PSP. Workloads would need to be cloned or upgraded to see if they pass the PSP.
content/rancher/v2.x/en/tasks/global-configuration/pod-security-policies/_index.md
+1 -1
View File
@@ -3,7 +3,7 @@ title: Pod Security Policies
weight: 3150
---
## Adding Pod Security Policies
## Creating Pod Security Policies
Using {{< product >}}, you can create a Pod Security Policy using our GUI rather than creating a YAML file.