public/rancher-docs
1
0
Fork 0
mirror of https://github.com/rancher/rancher-docs.git synced 2026-09-28 22:18:52 +00:00
Code Issues Packages Projects Releases Wiki Activity

drafting content about default psps

Browse Source
This commit is contained in:
MBishop17
2018-08-07 11:50:01 -07:00
committed by Mark Bishop
parent d0b8769d6a
commit b445389a0b
1 changed files with 20 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
content/rancher/v2.x/en/admin-settings/pod-security-policies/_index.md
+20 -2
View File
@@ -19,11 +19,29 @@ _Pod Security Policies_ (or PSPs) are objects that control security-sensitive as
Read more about Pod Security Policies in the [Kubernetes Documentation](https://kubernetes.io/docs/concepts/policy/pod-security-policy/). Read more about Pod Security Policies in the [Kubernetes Documentation](https://kubernetes.io/docs/concepts/policy/pod-security-policy/).
>**Best Practice:** >**Best Practice:** Set pod security at the cluster level.
>Set Pod Security at the cluster level.
Using Rancher, you can create a Pod Security Policy using our GUI rather than creating a YAML file. Using Rancher, you can create a Pod Security Policy using our GUI rather than creating a YAML file.
## Default Pod Security Policies
_Available as of v2.0.7_
Rancher ships with two default Pod Security Policies (PSPs): the `restricted` and `unrestricted` policies.
- `restricted`
This policy is equivilent to running Kubernetes with the PSP controller disabled. It has no restrictions on what pods can be deployed into a cluster or project.
- `unrestricted`
This policy is based on the Kubernetes [example restricted policy](https://kubernetes.io/docs/concepts/policy/pod-security-policy/#example-policies). This policy:
- Prevents pods from running as an unprivileged user or from root.
- Validates that server-required security mechanisms are in place (such as restricting what volumes can be mounted to only the core volume types and preventing root supplemental groups from being added).
- Significantly restricts what types of pods can be deployed to a cluster or project.
## Creating Pod Security Policies ## Creating Pod Security Policies
1. From the **Global** view, select **Security** > **Pod Security Policies** from the main menu. Then click **Add Policy**. 1. From the **Global** view, select **Security** > **Pod Security Policies** from the main menu. Then click **Add Policy**.