diff --git a/content/rancher/v2.x/en/admin-settings/pod-security-policies/_index.md b/content/rancher/v2.x/en/admin-settings/pod-security-policies/_index.md index 103dfd9db32..6efc905d10a 100644 --- a/content/rancher/v2.x/en/admin-settings/pod-security-policies/_index.md +++ b/content/rancher/v2.x/en/admin-settings/pod-security-policies/_index.md @@ -19,11 +19,29 @@ _Pod Security Policies_ (or PSPs) are objects that control security-sensitive as Read more about Pod Security Policies in the [Kubernetes Documentation](https://kubernetes.io/docs/concepts/policy/pod-security-policy/). ->**Best Practice:** ->Set Pod Security at the cluster level. +>**Best Practice:** Set pod security at the cluster level. Using Rancher, you can create a Pod Security Policy using our GUI rather than creating a YAML file. +## Default Pod Security Policies + +_Available as of v2.0.7_ + +Rancher ships with two default Pod Security Policies (PSPs): the `restricted` and `unrestricted` policies. + +- `restricted` + + This policy is equivilent to running Kubernetes with the PSP controller disabled. It has no restrictions on what pods can be deployed into a cluster or project. + +- `unrestricted` + + This policy is based on the Kubernetes [example restricted policy](https://kubernetes.io/docs/concepts/policy/pod-security-policy/#example-policies). This policy: + + - Prevents pods from running as an unprivileged user or from root. + - Validates that server-required security mechanisms are in place (such as restricting what volumes can be mounted to only the core volume types and preventing root supplemental groups from being added). + - Significantly restricts what types of pods can be deployed to a cluster or project. + + ## Creating Pod Security Policies 1. From the **Global** view, select **Security** > **Pod Security Policies** from the main menu. Then click **Add Policy**.