public/rancher-docs
1
0
Fork 0
mirror of https://github.com/rancher/rancher-docs.git synced 2026-09-25 12:38:05 +00:00
Code Issues Packages Projects Releases Wiki Activity

Remove pod security policy (PSP) references for 2.9+

Browse Source
This commit is contained in:
Billy Tat
2025-07-18 14:05:21 -07:00
parent 399d9683d0
commit b95f9105dd
271 changed files with 100 additions and 3814 deletions
Download Patch File Download Diff File Expand all files Collapse all files
versioned_docs/version-2.11/reference-guides/cluster-configuration/rancher-server-configuration/rke1-cluster-configuration.md
-4
View File
@@ -151,10 +151,6 @@ Option to enable or disable [Metrics Server](https://rancher.com/docs/rke/latest
Each cloud provider capable of launching a cluster using RKE can collect metrics and monitor for your cluster nodes. Enable this option to view your node metrics from your cloud provider's portal.
### Pod Security Policy Support
Enables [pod security policies](../../../how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/create-pod-security-policies.md) for the cluster. After enabling this option, choose a policy using the **Default Pod Security Policy** drop-down.
You must have an existing Pod Security Policy configured before you can use this option.
### Docker Version on Nodes
versioned_docs/version-2.11/reference-guides/cluster-configuration/rancher-server-configuration/rke2-cluster-configuration.md
-4
View File
@@ -129,10 +129,6 @@ If the cloud provider you want to use is not listed as an option, you will need
:::
##### Default Pod Security Policy
The default [pod security policy](../../../how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/create-pod-security-policies.md) for the cluster. Please refer to the [RKE2 documentation](https://docs.rke2.io/security/pod_security_policies) on the specifications of each available policy.
##### Pod Security Admission Configuration Template
The default [pod security admission configuration template](../../../how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/psa-config-templates.md) for the cluster.
versioned_docs/version-2.11/reference-guides/rancher-security/hardening-guides/k3s-hardening-guide/k3s-hardening-guide.md
+1 -1
View File
@@ -79,7 +79,7 @@ This configuration needs to be done before setting the kubelet flag, otherwise K
## Kubernetes Runtime Requirements
The CIS Benchmark runtime requirements center around pod security (via PSP or PSA), network policies and API Server auditing logs.
The CIS Benchmark runtime requirements center around pod security (via PSA), network policies and API Server auditing logs.
By default, K3s does not include any pod security or network policies. However, K3s ships with a controller that enforces any network policies you create. By default, K3s enables both the `PodSecurity` and `NodeRestriction` admission controllers, among others.
versioned_docs/version-2.11/reference-guides/rancher-security/hardening-guides/rke1-hardening-guide/rke1-hardening-guide.md
-1
View File
@@ -153,7 +153,6 @@ Execute this script to apply the `default-allow-all.yaml` configuration with the
## Known Limitations
- Rancher **exec shell** and **view logs** for pods are **not** functional in a hardened setup when only a public IP is provided when registering custom nodes. This functionality requires a private IP to be provided when registering the custom nodes.
- When setting `default_pod_security_policy_template_id:` to `restricted` or `restricted-noroot`, based on the pod security policies (PSP) [provided](../../../../how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/create-pod-security-policies.md) by Rancher, Rancher creates `RoleBindings` and `ClusterRoleBindings` on the `default` service accounts. The CIS check 5.1.5 requires that the `default` service accounts have no roles or cluster roles bound to it apart from the defaults. In addition, the `default` service accounts should be configured such that it does not provide a service account token and does not have any explicit rights assignments.
## Reference Hardened RKE `cluster.yml` Configuration