public/rancher-docs
1
0
Fork 0
mirror of https://github.com/rancher/rancher-docs.git synced 2026-09-24 20:18:18 +00:00
Code Issues Packages Projects Releases Wiki Activity

psp updates

Browse Source
This commit is contained in:
Mark Bishop
2018-06-07 17:52:39 -07:00
parent ad4cbc0db3
commit 85604a02d4
2 changed files with 69 additions and 29 deletions
Download Patch File Download Diff File Expand all files Collapse all files
content/rancher/v2.x/en/concepts/global-configuration/_index.md
+14 -1
View File
@@ -134,8 +134,14 @@ The following table lists each custom global permission available and whether it
Cluster and project roles define user authorization inside a cluster or project. You can manage these roles from the **Global > Security > Roles** page. From this page you can:
<<<<<<< HEAD
- Lock/unlock roles so that they may not be used in any new role assignments (existing assignments will still be enforce).
- Create and manage new roles for use across all clusters and projects.
=======
- Create and manage new roles for use across all clusters and projects
- [Lock/unlock roles](#locked-roles) so that they may not be used in any new role assignments (existing assignments will still be enforce)
>>>>>>> psp updates
#### Membership and Role Assignment
@@ -251,7 +257,14 @@ This is the URL of your Rancher Server. All nodes in your cluster must resolve t
## Pod Security Policies
_Pod Security Policies_ are objects that control security-sensitive aspects of pod specification. Pods only run within Kubernetes if they meet the conditions specified in their assigned Pod Security Policy.
_Pod Security Policies_ (or PSPs) are objects that control security-sensitive aspects of pod specification (like secrets). Pods only run within Kubernetes if they meet their assigned PSP.
- You can apply PSPs at the cluster or project level.
- PSPs work through inheritance.
- By default, PSPs applied to a cluster are inherited by its projects, as well as any namespaces applied to those projects.
- **Exception:** Namespaces un-applied to projects do not inherit PSPs. Because these namespaces have no PSPs, workload deployments to these namespaces will fail, which is the default Kubernetes behavior.
- You can override the PSPs that a project inherits by applying a different PSP directly to the project.
Read more about Pod Security Policies in the [Kubernetes Documentation](https://kubernetes.io/docs/concepts/policy/pod-security-policy/).
content/rancher/v2.x/en/tasks/clusters/adding-a-pod-security-policy/_index.md
+55 -28
View File
@@ -4,41 +4,68 @@ weight: 3475
draft: true
---
You can add a [Pod Security Policy]({{< baseurl >}}/rancher/v2.x/en/concepts/global-configuration/#pod-security-policies) to either a _Cluster_ or a _Project_. _Pod Security Policies_ set on a _Cluster_ act as a default and are applied to all _Namespaces_ assigned to _Projects_ within that _Cluster_. Default _Pod Security Policies_ can be overridden by setting a _Pod Security Policy_ on a project. _Namespaces_ that are not assigned to a _Project_ within a _Cluster_ are not given a _Pod Security Policy_. As a result, all new _Workload_ deployments within those _Namespaces_ will fail (this is the default Kubernetes behavior).
_Pod Security Policies_ are objects that control security-sensitive aspects of pod specification. You can add a Pod Security Policy (PSPs hereafter) to either a cluster or project. For more information about PSPs, refer to [Pod Security Policy]({{< baseurl >}}/rancher/v2.x/en/concepts/global-configuration/#pod-security-policies).
## Pod Security Policies and Clusters
### Create a Cluster with a default Pod Security Policy
1. Ensure a _Pod Security Policy_ exists. Refer to the [Adding Pod Security Policies]({{< baseurl >}}/rancher/v2.x/en/tasks/global-configuration/pod-security-policies/) task for details.
1. On the __Add Cluster__ screen under the __Cluster Options__ accordion select __Enabled__ for __Pod Security Policy Support__.
>Note that not all cloud providers support _Pod Security Policies_ and this option may not be shown. Also if no _Pod Security Policy_ are defined in Rancher then this option will be greyed out.
1. Select a _Pod Security Policy_ from the dropdown.
1. Fill out the rest of the _Cluster_ information and create it as normal.
1. When the _Cluster_ has finished provisioning the _Pod Security Policy_ that you selected will be applied to all the projects within that cluster.
### Create a Cluster with a default Pod Security Policy
1. Ensure a PSP exists. Refer to the [Adding Pod Security Policies]({{< baseurl >}}/rancher/v2.x/en/tasks/global-configuration/pod-security-policies/) task for details.
2. On the __Add Cluster__ screen under the __Cluster Options__ accordion select __Enabled__ for __Pod Security Policy Support__.
>Note that not all cloud providers support PSPs and this option may not be shown. Also if no PSP are defined in Rancher then this option will be greyed out.
3. Select a PSP from the dropdown.
4. Fill out the rest of the _Cluster_ information and create it as normal.
5. When the _Cluster_ has finished provisioning the PSP that you selected will be applied to all the projects within that cluster.
### Add a Pod Security Policy to an existing Cluster
1. Ensure a _Pod Security Policy_ exists. Refer to the [Adding Pod Security Policies]({{< baseurl >}}/rancher/v2.x/en/tasks/global-configuration/pod-security-policies/) task for details.
1. Click the vertical ellipsis next to the _Cluster_ you want to enable _Pod Security Policies_ for.
1. Select __Edit__.
1. On the __Edit Cluster__ screen under the __Cluster Options__ accordion select __Enabled__ for __Pod Security Policy Support__. Note that not all cloud providers support _Pod Security Policies_ and this option may not be shown. Also if no _Pod Security Policy_ are defined in Rancher then this option will be greyed out.
1. Select a _Pod Security Policy_ from the dropdown.
1. __Save__ the _Cluster_.
1. When the _Cluster_ has finished updating the _Pod Security Policy_ that you selected will be applied to all the projects within that cluster.
1. Ensure a PSP exists. Refer to the [Adding Pod Security Policies]({{< baseurl >}}/rancher/v2.x/en/tasks/global-configuration/pod-security-policies/) task for details.
2. Click the vertical ellipsis next to the _Cluster_ you want to enable PSPs for.
3. Select __Edit__.
4. On the __Edit Cluster__ screen under the __Cluster Options__ accordion select __Enabled__ for __Pod Security Policy Support__. Note that not all cloud providers support PSPs and this option may not be shown. Also if no PSP are defined in Rancher then this option will be greyed out.
5. Select a PSP from the dropdown.
6. __Save__ the _Cluster_.
7. When the _Cluster_ has finished updating the PSP that you selected will be applied to all the projects within that cluster.
## Pod Security Policies and Projects
### Create a Project with a Pod Security Policy.
1. Ensure a _Pod Security Policy_ exists. Refer to the [Adding Pod Security Policies]({{< baseurl >}}/rancher/v2.x/en/tasks/global-configuration/pod-security-policies/) task for details.
1. Navigate to a _Cluster_ with _Pod Security Policy Support_ enabled.
1. On the __Projects/Namespaces__ screen click __Add Project__.
1. On the __Add Project__ screen select a _Pod Security Policy_ from the dropdown.
1. Fill out the rest of the information as usual.
1. Click __Create__.
1. The _Project_ will create with the selected _Pod Security Policy_ applied.
1. Ensure a PSP exists. Refer to the [Adding Pod Security Policies]({{< baseurl >}}/rancher/v2.x/en/tasks/global-configuration/pod-security-policies/) task for details.
2. Navigate to a _Cluster_ with _Pod Security Policy Support_ enabled.
3. On the __Projects/Namespaces__ screen click __Add Project__.
4. On the __Add Project__ screen select a PSP from the dropdown.
5. Fill out the rest of the information as usual.
6. Click __Create__.
7. The _Project_ will create with the selected PSP applied.
### Add a Pod Security Policy to an existing Project
1. Ensure a _Pod Security Policy_ exists. Refer to the [Adding Pod Security Policies]({{< baseurl >}}/rancher/v2.x/en/tasks/global-configuration/pod-security-policies/) task for details.
1. Navigate to a _Cluster_ with _Pod Security Policy Support_ enabled.
1. __Edit__ a _Project_.
1. Select a _Pod Security Policy_ from the dropdown.
1. Click __Save__.
1. The _Project_ will have the selected _Pod Security Policy_ applied.
1. Ensure a PSP exists. Refer to the [Adding Pod Security Policies]({{< baseurl >}}/rancher/v2.x/en/tasks/global-configuration/pod-security-policies/) task for details.
2. Navigate to a _Cluster_ with _Pod Security Policy Support_ enabled.
3. __Edit__ a _Project_.
4. Select a PSP from the dropdown.
5. Click __Save__.
6. The _Project_ will have the selected PSP applied.