public/rancher-docs
1
0
Fork 0
mirror of https://github.com/rancher/rancher-docs.git synced 2026-09-28 22:18:52 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #2224 from sunilarjun/update-ns

Browse Source 
Updating ns exemptions
This commit is contained in:
Sunil Singh
2026-03-12 14:12:46 -07:00
committed by GitHub
parent fc747f457a dd90555a64
commit a91e98aeed
18 changed files with 543 additions and 330 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/getting-started/installation-and-upgrade/install-upgrade-on-a-kubernetes-cluster/rancher-psact.yaml
+38 -16
View File
@@ -12,28 +12,50 @@ plugins:
warn-version: latest warn-version: latest
exemptions: exemptions:
namespaces: namespaces:
- ingress-nginx - calico-apiserver
- kube-system - calico-system
- cattle-system - cattle-alerting
- cattle-epinio-system - cattle-capi-system
- cattle-fleet-system
- cattle-fleet-local-system
- longhorn-system
- cattle-neuvector-system
- cattle-monitoring-system
- rancher-alerting-drivers
- cis-operator-system
- cattle-csp-adapter-system - cattle-csp-adapter-system
- cattle-elemental-system
- cattle-epinio-system
- cattle-externalip-system - cattle-externalip-system
- cattle-fleet-local-system
- cattle-fleet-system
- cattle-gatekeeper-system - cattle-gatekeeper-system
- istio-system - cattle-global-data
- cattle-global-nt
- cattle-impersonation-system
- cattle-istio
- cattle-istio-system - cattle-istio-system
- cattle-logging
- cattle-logging-system - cattle-logging-system
- cattle-windows-gmsa-system - cattle-monitoring-system
- cattle-sriov-system - cattle-neuvector-system
- cattle-ui-plugin-system - cattle-prometheus
- tigera-operator
- cattle-provisioning-capi-system - cattle-provisioning-capi-system
- cattle-resources-system
- cattle-sriov-system
- cattle-system
- cattle-turtles-system
- cattle-ui-plugin-system
- cattle-windows-gmsa-system
- cert-manager
- cis-operator-system
- compliance-operator-system
- fleet-default
- fleet-local
- istio-system
- kube-node-lease
- kube-public
- kube-system
- longhorn-system
- rancher-alerting-drivers
- rancher-compliance-system
- security-scan
- sr-operator-system
- tigera-operator
- traefik
kind: PodSecurityConfiguration kind: PodSecurityConfiguration
name: PodSecurity name: PodSecurity
path: "" path: ""
docs/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/psa-config-templates.md
+5 -1
View File
@@ -91,6 +91,7 @@ When you run Rancher on a Kubernetes cluster that enforces a restrictive securit
- `calico-apiserver` - `calico-apiserver`
- `calico-system` - `calico-system`
- `cattle-alerting` - `cattle-alerting`
- `cattle-capi-system`
- `cattle-csp-adapter-system` - `cattle-csp-adapter-system`
- `cattle-elemental-system` - `cattle-elemental-system`
- `cattle-epinio-system` - `cattle-epinio-system`
@@ -112,22 +113,25 @@ When you run Rancher on a Kubernetes cluster that enforces a restrictive securit
- `cattle-resources-system` - `cattle-resources-system`
- `cattle-sriov-system` - `cattle-sriov-system`
- `cattle-system` - `cattle-system`
- `cattle-turtles-system`
- `cattle-ui-plugin-system` - `cattle-ui-plugin-system`
- `cattle-windows-gmsa-system` - `cattle-windows-gmsa-system`
- `cert-manager` - `cert-manager`
- `cis-operator-system` - `cis-operator-system`
- `compliance-operator-system`
- `fleet-default` - `fleet-default`
- `fleet-local` - `fleet-local`
- `ingress-nginx`
- `istio-system` - `istio-system`
- `kube-node-lease` - `kube-node-lease`
- `kube-public` - `kube-public`
- `kube-system` - `kube-system`
- `longhorn-system` - `longhorn-system`
- `rancher-alerting-drivers` - `rancher-alerting-drivers`
- `rancher-compliance-system`
- `security-scan` - `security-scan`
- `sr-operator-system` - `sr-operator-system`
- `tigera-operator` - `tigera-operator`
- `traefik`
Rancher, some Rancher owned charts, and RKE2 and K3s distributions all use these namespaces. A subset of the listed namespaces are already exempt in the built-in Rancher `rancher-restricted` policy, for use in downstream clusters. For a complete template which has all the exemptions you need to run Rancher, please refer to this [sample Admission Configuration](../../../reference-guides/rancher-security/psa-restricted-exemptions.md). Rancher, some Rancher owned charts, and RKE2 and K3s distributions all use these namespaces. A subset of the listed namespaces are already exempt in the built-in Rancher `rancher-restricted` policy, for use in downstream clusters. For a complete template which has all the exemptions you need to run Rancher, please refer to this [sample Admission Configuration](../../../reference-guides/rancher-security/psa-restricted-exemptions.md).
docs/reference-guides/rancher-security/psa-restricted-exemptions.md
+46 -41
View File
@@ -24,46 +24,51 @@ plugins:
warn: "restricted" warn: "restricted"
warn-version: "latest" warn-version: "latest"
exemptions: exemptions:
usernames: [] namespaces:
- calico-apiserver
- calico-system
- cattle-alerting
- cattle-capi-system
- cattle-csp-adapter-system
- cattle-elemental-system
- cattle-epinio-system
- cattle-externalip-system
- cattle-fleet-local-system
- cattle-fleet-system
- cattle-gatekeeper-system
- cattle-global-data
- cattle-global-nt
- cattle-impersonation-system
- cattle-istio
- cattle-istio-system
- cattle-logging
- cattle-logging-system
- cattle-monitoring-system
- cattle-neuvector-system
- cattle-prometheus
- cattle-provisioning-capi-system
- cattle-resources-system
- cattle-sriov-system
- cattle-system
- cattle-turtles-system
- cattle-ui-plugin-system
- cattle-windows-gmsa-system
- cert-manager
- cis-operator-system
- compliance-operator-system
- fleet-default
- fleet-local
- istio-system
- kube-node-lease
- kube-public
- kube-system
- longhorn-system
- rancher-alerting-drivers
- rancher-compliance-system
- security-scan
- sr-operator-system
- tigera-operator
- traefik
runtimeClasses: [] runtimeClasses: []
namespaces: [calico-apiserver, usernames: []
calico-system,
cattle-alerting,
cattle-csp-adapter-system,
cattle-elemental-system,
cattle-epinio-system,
cattle-externalip-system,
cattle-fleet-local-system,
cattle-fleet-system,
cattle-gatekeeper-system,
cattle-global-data,
cattle-global-nt,
cattle-impersonation-system,
cattle-istio,
cattle-istio-system,
cattle-logging,
cattle-logging-system,
cattle-monitoring-system,
cattle-neuvector-system,
cattle-prometheus,
cattle-provisioning-capi-system,
cattle-resources-system,
cattle-sriov-system,
cattle-system,
cattle-ui-plugin-system,
cattle-windows-gmsa-system,
cert-manager,
cis-operator-system,
fleet-default,
fleet-local,
ingress-nginx,
istio-system,
kube-node-lease,
kube-public,
kube-system,
longhorn-system,
rancher-alerting-drivers,
security-scan,
sr-operator-system,
tigera-operator]
``` ```
i18n/zh/docusaurus-plugin-content-docs/current/getting-started/installation-and-upgrade/install-upgrade-on-a-kubernetes-cluster/rancher-psact.yaml
+37 -13
View File
@@ -12,26 +12,50 @@ plugins:
warn-version: latest warn-version: latest
exemptions: exemptions:
namespaces: namespaces:
- ingress-nginx - calico-apiserver
- kube-system - calico-system
- cattle-system - cattle-alerting
- cattle-epinio-system - cattle-capi-system
- cattle-fleet-system
- longhorn-system
- cattle-neuvector-system
- cattle-monitoring-system
- rancher-alerting-drivers
- cis-operator-system
- cattle-csp-adapter-system - cattle-csp-adapter-system
- cattle-elemental-system
- cattle-epinio-system
- cattle-externalip-system - cattle-externalip-system
- cattle-fleet-local-system
- cattle-fleet-system
- cattle-gatekeeper-system - cattle-gatekeeper-system
- istio-system - cattle-global-data
- cattle-global-nt
- cattle-impersonation-system
- cattle-istio
- cattle-istio-system - cattle-istio-system
- cattle-logging
- cattle-logging-system - cattle-logging-system
- cattle-windows-gmsa-system - cattle-monitoring-system
- cattle-neuvector-system
- cattle-prometheus
- cattle-provisioning-capi-system
- cattle-resources-system
- cattle-sriov-system - cattle-sriov-system
- cattle-system
- cattle-turtles-system
- cattle-ui-plugin-system - cattle-ui-plugin-system
- cattle-windows-gmsa-system
- cert-manager
- cis-operator-system
- compliance-operator-system
- fleet-default
- fleet-local
- istio-system
- kube-node-lease
- kube-public
- kube-system
- longhorn-system
- rancher-alerting-drivers
- rancher-compliance-system
- security-scan
- sr-operator-system
- tigera-operator - tigera-operator
- traefik
kind: PodSecurityConfiguration kind: PodSecurityConfiguration
name: PodSecurity name: PodSecurity
path: "" path: ""
i18n/zh/docusaurus-plugin-content-docs/current/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/psa-config-templates.md
+9 -1
View File
@@ -90,7 +90,9 @@ The policies shipped by default in Rancher aim to provide a trade-off between se
- `calico-apiserver` - `calico-apiserver`
- `calico-system` - `calico-system`
- `cattle-alerting` - `cattle-alerting`
- `cattle-capi-system`
- `cattle-csp-adapter-system` - `cattle-csp-adapter-system`
- `cattle-elemental-system`
- `cattle-epinio-system` - `cattle-epinio-system`
- `cattle-externalip-system` - `cattle-externalip-system`
- `cattle-fleet-local-system` - `cattle-fleet-local-system`
@@ -106,23 +108,29 @@ The policies shipped by default in Rancher aim to provide a trade-off between se
- `cattle-monitoring-system` - `cattle-monitoring-system`
- `cattle-neuvector-system` - `cattle-neuvector-system`
- `cattle-prometheus` - `cattle-prometheus`
- `cattle-provisioning-capi-system`
- `cattle-resources-system`
- `cattle-sriov-system` - `cattle-sriov-system`
- `cattle-system` - `cattle-system`
- `cattle-turtles-system`
- `cattle-ui-plugin-system` - `cattle-ui-plugin-system`
- `cattle-windows-gmsa-system` - `cattle-windows-gmsa-system`
- `cert-manager` - `cert-manager`
- `cis-operator-system` - `cis-operator-system`
- `compliance-operator-system`
- `fleet-default` - `fleet-default`
- `fleet-local` - `fleet-local`
- `ingress-nginx`
- `istio-system` - `istio-system`
- `kube-node-lease` - `kube-node-lease`
- `kube-public` - `kube-public`
- `kube-system` - `kube-system`
- `longhorn-system` - `longhorn-system`
- `rancher-alerting-drivers` - `rancher-alerting-drivers`
- `rancher-compliance-system`
- `security-scan` - `security-scan`
- `sr-operator-system`
- `tigera-operator` - `tigera-operator`
- `traefik`
Rancher、Rancher 拥有的一些 Chart 以及 RKE2 和 K3s 发行版都使用这些命名空间。列出的命名空间的一个子集已经在内置的 Rancher `rancher-restricted` 策略中被豁免，用于下游集群。有关运行 Rancher 所需的所有豁免的完整模板，请参阅此[准入配置示例](../../../reference-guides/rancher-security/psa-restricted-exemptions.md)。 Rancher、Rancher 拥有的一些 Chart 以及 RKE2 和 K3s 发行版都使用这些命名空间。列出的命名空间的一个子集已经在内置的 Rancher `rancher-restricted` 策略中被豁免，用于下游集群。有关运行 Rancher 所需的所有豁免的完整模板，请参阅此[准入配置示例](../../../reference-guides/rancher-security/psa-restricted-exemptions.md)。
i18n/zh/docusaurus-plugin-content-docs/current/reference-guides/rancher-security/psa-restricted-exemptions.md
+46 -38
View File
@@ -20,43 +20,51 @@ plugins:
warn: "restricted" warn: "restricted"
warn-version: "latest" warn-version: "latest"
exemptions: exemptions:
usernames: [] namespaces:
- calico-apiserver
- calico-system
- cattle-alerting
- cattle-capi-system
- cattle-csp-adapter-system
- cattle-elemental-system
- cattle-epinio-system
- cattle-externalip-system
- cattle-fleet-local-system
- cattle-fleet-system
- cattle-gatekeeper-system
- cattle-global-data
- cattle-global-nt
- cattle-impersonation-system
- cattle-istio
- cattle-istio-system
- cattle-logging
- cattle-logging-system
- cattle-monitoring-system
- cattle-neuvector-system
- cattle-prometheus
- cattle-provisioning-capi-system
- cattle-resources-system
- cattle-sriov-system
- cattle-system
- cattle-turtles-system
- cattle-ui-plugin-system
- cattle-windows-gmsa-system
- cert-manager
- cis-operator-system
- compliance-operator-system
- fleet-default
- fleet-local
- istio-system
- kube-node-lease
- kube-public
- kube-system
- longhorn-system
- rancher-alerting-drivers
- rancher-compliance-system
- security-scan
- sr-operator-system
- tigera-operator
- traefik
runtimeClasses: [] runtimeClasses: []
namespaces: [calico-apiserver, usernames: []
calico-system,
cattle-alerting,
cattle-csp-adapter-system,
cattle-elemental-system,
cattle-epinio-system,
cattle-externalip-system,
cattle-fleet-local-system,
cattle-fleet-system,
cattle-gatekeeper-system,
cattle-global-data,
cattle-global-nt,
cattle-impersonation-system,
cattle-istio,
cattle-istio-system,
cattle-logging,
cattle-logging-system,
cattle-monitoring-system,
cattle-neuvector-system,
cattle-prometheus,
cattle-resources-system,
cattle-sriov-system,
cattle-system,
cattle-ui-plugin-system,
cattle-windows-gmsa-system,
cert-manager,
cis-operator-system,
fleet-default,
ingress-nginx,
istio-system,
kube-node-lease,
kube-public,
kube-system,
longhorn-system,
rancher-alerting-drivers,
security-scan,
tigera-operator]
``` ```
i18n/zh/docusaurus-plugin-content-docs/version-2.13/getting-started/installation-and-upgrade/install-upgrade-on-a-kubernetes-cluster/rancher-psact.yaml
+37 -13
View File
@@ -12,26 +12,50 @@ plugins:
warn-version: latest warn-version: latest
exemptions: exemptions:
namespaces: namespaces:
- ingress-nginx - calico-apiserver
- kube-system - calico-system
- cattle-system - cattle-alerting
- cattle-epinio-system - cattle-capi-system
- cattle-fleet-system
- longhorn-system
- cattle-neuvector-system
- cattle-monitoring-system
- rancher-alerting-drivers
- cis-operator-system
- cattle-csp-adapter-system - cattle-csp-adapter-system
- cattle-elemental-system
- cattle-epinio-system
- cattle-externalip-system - cattle-externalip-system
- cattle-fleet-local-system
- cattle-fleet-system
- cattle-gatekeeper-system - cattle-gatekeeper-system
- istio-system - cattle-global-data
- cattle-global-nt
- cattle-impersonation-system
- cattle-istio
- cattle-istio-system - cattle-istio-system
- cattle-logging
- cattle-logging-system - cattle-logging-system
- cattle-windows-gmsa-system - cattle-monitoring-system
- cattle-neuvector-system
- cattle-prometheus
- cattle-provisioning-capi-system
- cattle-resources-system
- cattle-sriov-system - cattle-sriov-system
- cattle-system
- cattle-turtles-system
- cattle-ui-plugin-system - cattle-ui-plugin-system
- cattle-windows-gmsa-system
- cert-manager
- cis-operator-system
- compliance-operator-system
- fleet-default
- fleet-local
- istio-system
- kube-node-lease
- kube-public
- kube-system
- longhorn-system
- rancher-alerting-drivers
- rancher-compliance-system
- security-scan
- sr-operator-system
- tigera-operator - tigera-operator
- traefik
kind: PodSecurityConfiguration kind: PodSecurityConfiguration
name: PodSecurity name: PodSecurity
path: "" path: ""
i18n/zh/docusaurus-plugin-content-docs/version-2.13/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/psa-config-templates.md
+9 -1
View File
@@ -90,7 +90,9 @@ The policies shipped by default in Rancher aim to provide a trade-off between se
- `calico-apiserver` - `calico-apiserver`
- `calico-system` - `calico-system`
- `cattle-alerting` - `cattle-alerting`
- `cattle-capi-system`
- `cattle-csp-adapter-system` - `cattle-csp-adapter-system`
- `cattle-elemental-system`
- `cattle-epinio-system` - `cattle-epinio-system`
- `cattle-externalip-system` - `cattle-externalip-system`
- `cattle-fleet-local-system` - `cattle-fleet-local-system`
@@ -106,23 +108,29 @@ The policies shipped by default in Rancher aim to provide a trade-off between se
- `cattle-monitoring-system` - `cattle-monitoring-system`
- `cattle-neuvector-system` - `cattle-neuvector-system`
- `cattle-prometheus` - `cattle-prometheus`
- `cattle-provisioning-capi-system`
- `cattle-resources-system`
- `cattle-sriov-system` - `cattle-sriov-system`
- `cattle-system` - `cattle-system`
- `cattle-turtles-system`
- `cattle-ui-plugin-system` - `cattle-ui-plugin-system`
- `cattle-windows-gmsa-system` - `cattle-windows-gmsa-system`
- `cert-manager` - `cert-manager`
- `cis-operator-system` - `cis-operator-system`
- `compliance-operator-system`
- `fleet-default` - `fleet-default`
- `fleet-local` - `fleet-local`
- `ingress-nginx`
- `istio-system` - `istio-system`
- `kube-node-lease` - `kube-node-lease`
- `kube-public` - `kube-public`
- `kube-system` - `kube-system`
- `longhorn-system` - `longhorn-system`
- `rancher-alerting-drivers` - `rancher-alerting-drivers`
- `rancher-compliance-system`
- `security-scan` - `security-scan`
- `sr-operator-system`
- `tigera-operator` - `tigera-operator`
- `traefik`
Rancher、Rancher 拥有的一些 Chart 以及 RKE2 和 K3s 发行版都使用这些命名空间。列出的命名空间的一个子集已经在内置的 Rancher `rancher-restricted` 策略中被豁免，用于下游集群。有关运行 Rancher 所需的所有豁免的完整模板，请参阅此[准入配置示例](../../../reference-guides/rancher-security/psa-restricted-exemptions.md)。 Rancher、Rancher 拥有的一些 Chart 以及 RKE2 和 K3s 发行版都使用这些命名空间。列出的命名空间的一个子集已经在内置的 Rancher `rancher-restricted` 策略中被豁免，用于下游集群。有关运行 Rancher 所需的所有豁免的完整模板，请参阅此[准入配置示例](../../../reference-guides/rancher-security/psa-restricted-exemptions.md)。
i18n/zh/docusaurus-plugin-content-docs/version-2.13/reference-guides/rancher-security/psa-restricted-exemptions.md
+46 -38
View File
@@ -20,43 +20,51 @@ plugins:
warn: "restricted" warn: "restricted"
warn-version: "latest" warn-version: "latest"
exemptions: exemptions:
usernames: [] namespaces:
- calico-apiserver
- calico-system
- cattle-alerting
- cattle-capi-system
- cattle-csp-adapter-system
- cattle-elemental-system
- cattle-epinio-system
- cattle-externalip-system
- cattle-fleet-local-system
- cattle-fleet-system
- cattle-gatekeeper-system
- cattle-global-data
- cattle-global-nt
- cattle-impersonation-system
- cattle-istio
- cattle-istio-system
- cattle-logging
- cattle-logging-system
- cattle-monitoring-system
- cattle-neuvector-system
- cattle-prometheus
- cattle-provisioning-capi-system
- cattle-resources-system
- cattle-sriov-system
- cattle-system
- cattle-turtles-system
- cattle-ui-plugin-system
- cattle-windows-gmsa-system
- cert-manager
- cis-operator-system
- compliance-operator-system
- fleet-default
- fleet-local
- istio-system
- kube-node-lease
- kube-public
- kube-system
- longhorn-system
- rancher-alerting-drivers
- rancher-compliance-system
- security-scan
- sr-operator-system
- tigera-operator
- traefik
runtimeClasses: [] runtimeClasses: []
namespaces: [calico-apiserver, usernames: []
calico-system,
cattle-alerting,
cattle-csp-adapter-system,
cattle-elemental-system,
cattle-epinio-system,
cattle-externalip-system,
cattle-fleet-local-system,
cattle-fleet-system,
cattle-gatekeeper-system,
cattle-global-data,
cattle-global-nt,
cattle-impersonation-system,
cattle-istio,
cattle-istio-system,
cattle-logging,
cattle-logging-system,
cattle-monitoring-system,
cattle-neuvector-system,
cattle-prometheus,
cattle-resources-system,
cattle-sriov-system,
cattle-system,
cattle-ui-plugin-system,
cattle-windows-gmsa-system,
cert-manager,
cis-operator-system,
fleet-default,
ingress-nginx,
istio-system,
kube-node-lease,
kube-public,
kube-system,
longhorn-system,
rancher-alerting-drivers,
security-scan,
tigera-operator]
``` ```
i18n/zh/docusaurus-plugin-content-docs/version-2.14/getting-started/installation-and-upgrade/install-upgrade-on-a-kubernetes-cluster/rancher-psact.yaml
+37 -13
View File
@@ -12,26 +12,50 @@ plugins:
warn-version: latest warn-version: latest
exemptions: exemptions:
namespaces: namespaces:
- ingress-nginx - calico-apiserver
- kube-system - calico-system
- cattle-system - cattle-alerting
- cattle-epinio-system - cattle-capi-system
- cattle-fleet-system
- longhorn-system
- cattle-neuvector-system
- cattle-monitoring-system
- rancher-alerting-drivers
- cis-operator-system
- cattle-csp-adapter-system - cattle-csp-adapter-system
- cattle-elemental-system
- cattle-epinio-system
- cattle-externalip-system - cattle-externalip-system
- cattle-fleet-local-system
- cattle-fleet-system
- cattle-gatekeeper-system - cattle-gatekeeper-system
- istio-system - cattle-global-data
- cattle-global-nt
- cattle-impersonation-system
- cattle-istio
- cattle-istio-system - cattle-istio-system
- cattle-logging
- cattle-logging-system - cattle-logging-system
- cattle-windows-gmsa-system - cattle-monitoring-system
- cattle-neuvector-system
- cattle-prometheus
- cattle-provisioning-capi-system
- cattle-resources-system
- cattle-sriov-system - cattle-sriov-system
- cattle-system
- cattle-turtles-system
- cattle-ui-plugin-system - cattle-ui-plugin-system
- cattle-windows-gmsa-system
- cert-manager
- cis-operator-system
- compliance-operator-system
- fleet-default
- fleet-local
- istio-system
- kube-node-lease
- kube-public
- kube-system
- longhorn-system
- rancher-alerting-drivers
- rancher-compliance-system
- security-scan
- sr-operator-system
- tigera-operator - tigera-operator
- traefik
kind: PodSecurityConfiguration kind: PodSecurityConfiguration
name: PodSecurity name: PodSecurity
path: "" path: ""
i18n/zh/docusaurus-plugin-content-docs/version-2.14/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/psa-config-templates.md
+9 -1
View File
@@ -90,7 +90,9 @@ The policies shipped by default in Rancher aim to provide a trade-off between se
- `calico-apiserver` - `calico-apiserver`
- `calico-system` - `calico-system`
- `cattle-alerting` - `cattle-alerting`
- `cattle-capi-system`
- `cattle-csp-adapter-system` - `cattle-csp-adapter-system`
- `cattle-elemental-system`
- `cattle-epinio-system` - `cattle-epinio-system`
- `cattle-externalip-system` - `cattle-externalip-system`
- `cattle-fleet-local-system` - `cattle-fleet-local-system`
@@ -106,23 +108,29 @@ The policies shipped by default in Rancher aim to provide a trade-off between se
- `cattle-monitoring-system` - `cattle-monitoring-system`
- `cattle-neuvector-system` - `cattle-neuvector-system`
- `cattle-prometheus` - `cattle-prometheus`
- `cattle-provisioning-capi-system`
- `cattle-resources-system`
- `cattle-sriov-system` - `cattle-sriov-system`
- `cattle-system` - `cattle-system`
- `cattle-turtles-system`
- `cattle-ui-plugin-system` - `cattle-ui-plugin-system`
- `cattle-windows-gmsa-system` - `cattle-windows-gmsa-system`
- `cert-manager` - `cert-manager`
- `cis-operator-system` - `cis-operator-system`
- `compliance-operator-system`
- `fleet-default` - `fleet-default`
- `fleet-local` - `fleet-local`
- `ingress-nginx`
- `istio-system` - `istio-system`
- `kube-node-lease` - `kube-node-lease`
- `kube-public` - `kube-public`
- `kube-system` - `kube-system`
- `longhorn-system` - `longhorn-system`
- `rancher-alerting-drivers` - `rancher-alerting-drivers`
- `rancher-compliance-system`
- `security-scan` - `security-scan`
- `sr-operator-system`
- `tigera-operator` - `tigera-operator`
- `traefik`
Rancher、Rancher 拥有的一些 Chart 以及 RKE2 和 K3s 发行版都使用这些命名空间。列出的命名空间的一个子集已经在内置的 Rancher `rancher-restricted` 策略中被豁免，用于下游集群。有关运行 Rancher 所需的所有豁免的完整模板，请参阅此[准入配置示例](../../../reference-guides/rancher-security/psa-restricted-exemptions.md)。 Rancher、Rancher 拥有的一些 Chart 以及 RKE2 和 K3s 发行版都使用这些命名空间。列出的命名空间的一个子集已经在内置的 Rancher `rancher-restricted` 策略中被豁免，用于下游集群。有关运行 Rancher 所需的所有豁免的完整模板，请参阅此[准入配置示例](../../../reference-guides/rancher-security/psa-restricted-exemptions.md)。
i18n/zh/docusaurus-plugin-content-docs/version-2.14/reference-guides/rancher-security/psa-restricted-exemptions.md
+46 -38
View File
@@ -20,43 +20,51 @@ plugins:
warn: "restricted" warn: "restricted"
warn-version: "latest" warn-version: "latest"
exemptions: exemptions:
usernames: [] namespaces:
- calico-apiserver
- calico-system
- cattle-alerting
- cattle-capi-system
- cattle-csp-adapter-system
- cattle-elemental-system
- cattle-epinio-system
- cattle-externalip-system
- cattle-fleet-local-system
- cattle-fleet-system
- cattle-gatekeeper-system
- cattle-global-data
- cattle-global-nt
- cattle-impersonation-system
- cattle-istio
- cattle-istio-system
- cattle-logging
- cattle-logging-system
- cattle-monitoring-system
- cattle-neuvector-system
- cattle-prometheus
- cattle-provisioning-capi-system
- cattle-resources-system
- cattle-sriov-system
- cattle-system
- cattle-turtles-system
- cattle-ui-plugin-system
- cattle-windows-gmsa-system
- cert-manager
- cis-operator-system
- compliance-operator-system
- fleet-default
- fleet-local
- istio-system
- kube-node-lease
- kube-public
- kube-system
- longhorn-system
- rancher-alerting-drivers
- rancher-compliance-system
- security-scan
- sr-operator-system
- tigera-operator
- traefik
runtimeClasses: [] runtimeClasses: []
namespaces: [calico-apiserver, usernames: []
calico-system,
cattle-alerting,
cattle-csp-adapter-system,
cattle-elemental-system,
cattle-epinio-system,
cattle-externalip-system,
cattle-fleet-local-system,
cattle-fleet-system,
cattle-gatekeeper-system,
cattle-global-data,
cattle-global-nt,
cattle-impersonation-system,
cattle-istio,
cattle-istio-system,
cattle-logging,
cattle-logging-system,
cattle-monitoring-system,
cattle-neuvector-system,
cattle-prometheus,
cattle-resources-system,
cattle-sriov-system,
cattle-system,
cattle-ui-plugin-system,
cattle-windows-gmsa-system,
cert-manager,
cis-operator-system,
fleet-default,
ingress-nginx,
istio-system,
kube-node-lease,
kube-public,
kube-system,
longhorn-system,
rancher-alerting-drivers,
security-scan,
tigera-operator]
``` ```
versioned_docs/version-2.13/getting-started/installation-and-upgrade/install-upgrade-on-a-kubernetes-cluster/rancher-psact.yaml
+38 -16
View File
@@ -12,28 +12,50 @@ plugins:
warn-version: latest warn-version: latest
exemptions: exemptions:
namespaces: namespaces:
- ingress-nginx - calico-apiserver
- kube-system - calico-system
- cattle-system - cattle-alerting
- cattle-epinio-system - cattle-capi-system
- cattle-fleet-system
- cattle-fleet-local-system
- longhorn-system
- cattle-neuvector-system
- cattle-monitoring-system
- rancher-alerting-drivers
- cis-operator-system
- cattle-csp-adapter-system - cattle-csp-adapter-system
- cattle-elemental-system
- cattle-epinio-system
- cattle-externalip-system - cattle-externalip-system
- cattle-fleet-local-system
- cattle-fleet-system
- cattle-gatekeeper-system - cattle-gatekeeper-system
- istio-system - cattle-global-data
- cattle-global-nt
- cattle-impersonation-system
- cattle-istio
- cattle-istio-system - cattle-istio-system
- cattle-logging
- cattle-logging-system - cattle-logging-system
- cattle-windows-gmsa-system - cattle-monitoring-system
- cattle-sriov-system - cattle-neuvector-system
- cattle-ui-plugin-system - cattle-prometheus
- tigera-operator
- cattle-provisioning-capi-system - cattle-provisioning-capi-system
- cattle-resources-system
- cattle-sriov-system
- cattle-system
- cattle-turtles-system
- cattle-ui-plugin-system
- cattle-windows-gmsa-system
- cert-manager
- cis-operator-system
- compliance-operator-system
- fleet-default
- fleet-local
- istio-system
- kube-node-lease
- kube-public
- kube-system
- longhorn-system
- rancher-alerting-drivers
- rancher-compliance-system
- security-scan
- sr-operator-system
- tigera-operator
- traefik
kind: PodSecurityConfiguration kind: PodSecurityConfiguration
name: PodSecurity name: PodSecurity
path: "" path: ""
versioned_docs/version-2.13/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/psa-config-templates.md
+5 -1
View File
@@ -91,6 +91,7 @@ When you run Rancher on a Kubernetes cluster that enforces a restrictive securit
- `calico-apiserver` - `calico-apiserver`
- `calico-system` - `calico-system`
- `cattle-alerting` - `cattle-alerting`
- `cattle-capi-system`
- `cattle-csp-adapter-system` - `cattle-csp-adapter-system`
- `cattle-elemental-system` - `cattle-elemental-system`
- `cattle-epinio-system` - `cattle-epinio-system`
@@ -112,22 +113,25 @@ When you run Rancher on a Kubernetes cluster that enforces a restrictive securit
- `cattle-resources-system` - `cattle-resources-system`
- `cattle-sriov-system` - `cattle-sriov-system`
- `cattle-system` - `cattle-system`
- `cattle-turtles-system`
- `cattle-ui-plugin-system` - `cattle-ui-plugin-system`
- `cattle-windows-gmsa-system` - `cattle-windows-gmsa-system`
- `cert-manager` - `cert-manager`
- `cis-operator-system` - `cis-operator-system`
- `compliance-operator-system`
- `fleet-default` - `fleet-default`
- `fleet-local` - `fleet-local`
- `ingress-nginx`
- `istio-system` - `istio-system`
- `kube-node-lease` - `kube-node-lease`
- `kube-public` - `kube-public`
- `kube-system` - `kube-system`
- `longhorn-system` - `longhorn-system`
- `rancher-alerting-drivers` - `rancher-alerting-drivers`
- `rancher-compliance-system`
- `security-scan` - `security-scan`
- `sr-operator-system` - `sr-operator-system`
- `tigera-operator` - `tigera-operator`
- `traefik`
Rancher, some Rancher owned charts, and RKE2 and K3s distributions all use these namespaces. A subset of the listed namespaces are already exempt in the built-in Rancher `rancher-restricted` policy, for use in downstream clusters. For a complete template which has all the exemptions you need to run Rancher, please refer to this [sample Admission Configuration](../../../reference-guides/rancher-security/psa-restricted-exemptions.md). Rancher, some Rancher owned charts, and RKE2 and K3s distributions all use these namespaces. A subset of the listed namespaces are already exempt in the built-in Rancher `rancher-restricted` policy, for use in downstream clusters. For a complete template which has all the exemptions you need to run Rancher, please refer to this [sample Admission Configuration](../../../reference-guides/rancher-security/psa-restricted-exemptions.md).
versioned_docs/version-2.13/reference-guides/rancher-security/psa-restricted-exemptions.md
+46 -41
View File
@@ -24,46 +24,51 @@ plugins:
warn: "restricted" warn: "restricted"
warn-version: "latest" warn-version: "latest"
exemptions: exemptions:
usernames: [] namespaces:
- calico-apiserver
- calico-system
- cattle-alerting
- cattle-capi-system
- cattle-csp-adapter-system
- cattle-elemental-system
- cattle-epinio-system
- cattle-externalip-system
- cattle-fleet-local-system
- cattle-fleet-system
- cattle-gatekeeper-system
- cattle-global-data
- cattle-global-nt
- cattle-impersonation-system
- cattle-istio
- cattle-istio-system
- cattle-logging
- cattle-logging-system
- cattle-monitoring-system
- cattle-neuvector-system
- cattle-prometheus
- cattle-provisioning-capi-system
- cattle-resources-system
- cattle-sriov-system
- cattle-system
- cattle-turtles-system
- cattle-ui-plugin-system
- cattle-windows-gmsa-system
- cert-manager
- cis-operator-system
- compliance-operator-system
- fleet-default
- fleet-local
- istio-system
- kube-node-lease
- kube-public
- kube-system
- longhorn-system
- rancher-alerting-drivers
- rancher-compliance-system
- security-scan
- sr-operator-system
- tigera-operator
- traefik
runtimeClasses: [] runtimeClasses: []
namespaces: [calico-apiserver, usernames: []
calico-system,
cattle-alerting,
cattle-csp-adapter-system,
cattle-elemental-system,
cattle-epinio-system,
cattle-externalip-system,
cattle-fleet-local-system,
cattle-fleet-system,
cattle-gatekeeper-system,
cattle-global-data,
cattle-global-nt,
cattle-impersonation-system,
cattle-istio,
cattle-istio-system,
cattle-logging,
cattle-logging-system,
cattle-monitoring-system,
cattle-neuvector-system,
cattle-prometheus,
cattle-provisioning-capi-system,
cattle-resources-system,
cattle-sriov-system,
cattle-system,
cattle-ui-plugin-system,
cattle-windows-gmsa-system,
cert-manager,
cis-operator-system,
fleet-default,
fleet-local,
ingress-nginx,
istio-system,
kube-node-lease,
kube-public,
kube-system,
longhorn-system,
rancher-alerting-drivers,
security-scan,
sr-operator-system,
tigera-operator]
``` ```
versioned_docs/version-2.14/getting-started/installation-and-upgrade/install-upgrade-on-a-kubernetes-cluster/rancher-psact.yaml
+38 -16
View File
@@ -12,28 +12,50 @@ plugins:
warn-version: latest warn-version: latest
exemptions: exemptions:
namespaces: namespaces:
- ingress-nginx - calico-apiserver
- kube-system - calico-system
- cattle-system - cattle-alerting
- cattle-epinio-system - cattle-capi-system
- cattle-fleet-system
- cattle-fleet-local-system
- longhorn-system
- cattle-neuvector-system
- cattle-monitoring-system
- rancher-alerting-drivers
- cis-operator-system
- cattle-csp-adapter-system - cattle-csp-adapter-system
- cattle-elemental-system
- cattle-epinio-system
- cattle-externalip-system - cattle-externalip-system
- cattle-fleet-local-system
- cattle-fleet-system
- cattle-gatekeeper-system - cattle-gatekeeper-system
- istio-system - cattle-global-data
- cattle-global-nt
- cattle-impersonation-system
- cattle-istio
- cattle-istio-system - cattle-istio-system
- cattle-logging
- cattle-logging-system - cattle-logging-system
- cattle-windows-gmsa-system - cattle-monitoring-system
- cattle-sriov-system - cattle-neuvector-system
- cattle-ui-plugin-system - cattle-prometheus
- tigera-operator
- cattle-provisioning-capi-system - cattle-provisioning-capi-system
- cattle-resources-system
- cattle-sriov-system
- cattle-system
- cattle-turtles-system
- cattle-ui-plugin-system
- cattle-windows-gmsa-system
- cert-manager
- cis-operator-system
- compliance-operator-system
- fleet-default
- fleet-local
- istio-system
- kube-node-lease
- kube-public
- kube-system
- longhorn-system
- rancher-alerting-drivers
- rancher-compliance-system
- security-scan
- sr-operator-system
- tigera-operator
- traefik
kind: PodSecurityConfiguration kind: PodSecurityConfiguration
name: PodSecurity name: PodSecurity
path: "" path: ""
versioned_docs/version-2.14/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/psa-config-templates.md
+5 -1
View File
@@ -91,6 +91,7 @@ When you run Rancher on a Kubernetes cluster that enforces a restrictive securit
- `calico-apiserver` - `calico-apiserver`
- `calico-system` - `calico-system`
- `cattle-alerting` - `cattle-alerting`
- `cattle-capi-system`
- `cattle-csp-adapter-system` - `cattle-csp-adapter-system`
- `cattle-elemental-system` - `cattle-elemental-system`
- `cattle-epinio-system` - `cattle-epinio-system`
@@ -112,22 +113,25 @@ When you run Rancher on a Kubernetes cluster that enforces a restrictive securit
- `cattle-resources-system` - `cattle-resources-system`
- `cattle-sriov-system` - `cattle-sriov-system`
- `cattle-system` - `cattle-system`
- `cattle-turtles-system`
- `cattle-ui-plugin-system` - `cattle-ui-plugin-system`
- `cattle-windows-gmsa-system` - `cattle-windows-gmsa-system`
- `cert-manager` - `cert-manager`
- `cis-operator-system` - `cis-operator-system`
- `compliance-operator-system`
- `fleet-default` - `fleet-default`
- `fleet-local` - `fleet-local`
- `ingress-nginx`
- `istio-system` - `istio-system`
- `kube-node-lease` - `kube-node-lease`
- `kube-public` - `kube-public`
- `kube-system` - `kube-system`
- `longhorn-system` - `longhorn-system`
- `rancher-alerting-drivers` - `rancher-alerting-drivers`
- `rancher-compliance-system`
- `security-scan` - `security-scan`
- `sr-operator-system` - `sr-operator-system`
- `tigera-operator` - `tigera-operator`
- `traefik`
Rancher, some Rancher owned charts, and RKE2 and K3s distributions all use these namespaces. A subset of the listed namespaces are already exempt in the built-in Rancher `rancher-restricted` policy, for use in downstream clusters. For a complete template which has all the exemptions you need to run Rancher, please refer to this [sample Admission Configuration](../../../reference-guides/rancher-security/psa-restricted-exemptions.md). Rancher, some Rancher owned charts, and RKE2 and K3s distributions all use these namespaces. A subset of the listed namespaces are already exempt in the built-in Rancher `rancher-restricted` policy, for use in downstream clusters. For a complete template which has all the exemptions you need to run Rancher, please refer to this [sample Admission Configuration](../../../reference-guides/rancher-security/psa-restricted-exemptions.md).
versioned_docs/version-2.14/reference-guides/rancher-security/psa-restricted-exemptions.md
+46 -41
View File
@@ -24,46 +24,51 @@ plugins:
warn: "restricted" warn: "restricted"
warn-version: "latest" warn-version: "latest"
exemptions: exemptions:
usernames: [] namespaces:
- calico-apiserver
- calico-system
- cattle-alerting
- cattle-capi-system
- cattle-csp-adapter-system
- cattle-elemental-system
- cattle-epinio-system
- cattle-externalip-system
- cattle-fleet-local-system
- cattle-fleet-system
- cattle-gatekeeper-system
- cattle-global-data
- cattle-global-nt
- cattle-impersonation-system
- cattle-istio
- cattle-istio-system
- cattle-logging
- cattle-logging-system
- cattle-monitoring-system
- cattle-neuvector-system
- cattle-prometheus
- cattle-provisioning-capi-system
- cattle-resources-system
- cattle-sriov-system
- cattle-system
- cattle-turtles-system
- cattle-ui-plugin-system
- cattle-windows-gmsa-system
- cert-manager
- cis-operator-system
- compliance-operator-system
- fleet-default
- fleet-local
- istio-system
- kube-node-lease
- kube-public
- kube-system
- longhorn-system
- rancher-alerting-drivers
- rancher-compliance-system
- security-scan
- sr-operator-system
- tigera-operator
- traefik
runtimeClasses: [] runtimeClasses: []
namespaces: [calico-apiserver, usernames: []
calico-system,
cattle-alerting,
cattle-csp-adapter-system,
cattle-elemental-system,
cattle-epinio-system,
cattle-externalip-system,
cattle-fleet-local-system,
cattle-fleet-system,
cattle-gatekeeper-system,
cattle-global-data,
cattle-global-nt,
cattle-impersonation-system,
cattle-istio,
cattle-istio-system,
cattle-logging,
cattle-logging-system,
cattle-monitoring-system,
cattle-neuvector-system,
cattle-prometheus,
cattle-provisioning-capi-system,
cattle-resources-system,
cattle-sriov-system,
cattle-system,
cattle-ui-plugin-system,
cattle-windows-gmsa-system,
cert-manager,
cis-operator-system,
fleet-default,
fleet-local,
ingress-nginx,
istio-system,
kube-node-lease,
kube-public,
kube-system,
longhorn-system,
rancher-alerting-drivers,
security-scan,
sr-operator-system,
tigera-operator]
``` ```