public/rancher-docs
1
0
Fork 0
mirror of https://github.com/rancher/rancher-docs.git synced 2026-09-25 20:48:11 +00:00
Code Issues Packages Projects Releases Wiki Activity

Remove pod security policy (PSP) references for 2.9+

Browse Source
This commit is contained in:
Billy Tat
2025-07-18 14:05:21 -07:00
parent 399d9683d0
commit b95f9105dd
271 changed files with 100 additions and 3814 deletions
Download Patch File Download Diff File Expand all files Collapse all files
versioned_docs/version-2.9/reference-guides/rancher-security/hardening-guides/k3s-hardening-guide/k3s-hardening-guide.md
+1 -1
View File
@@ -79,7 +79,7 @@ This configuration needs to be done before setting the kubelet flag, otherwise K
## Kubernetes Runtime Requirements
The CIS Benchmark runtime requirements center around pod security (via PSP or PSA), network policies and API Server auditing logs.
The CIS Benchmark runtime requirements center around pod security (via PSA), network policies and API Server auditing logs.
By default, K3s does not include any pod security or network policies. However, K3s ships with a controller that enforces any network policies you create. By default, K3s enables both the `PodSecurity` and `NodeRestriction` admission controllers, among others.
versioned_docs/version-2.9/reference-guides/rancher-security/hardening-guides/rke1-hardening-guide/rke1-hardening-guide.md
-1
View File
@@ -153,7 +153,6 @@ Execute this script to apply the `default-allow-all.yaml` configuration with the
## Known Limitations
- Rancher **exec shell** and **view logs** for pods are **not** functional in a hardened setup when only a public IP is provided when registering custom nodes. This functionality requires a private IP to be provided when registering the custom nodes.
- When setting `default_pod_security_policy_template_id:` to `restricted` or `restricted-noroot`, based on the pod security policies (PSP) [provided](../../../../how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/create-pod-security-policies.md) by Rancher, Rancher creates `RoleBindings` and `ClusterRoleBindings` on the `default` service accounts. The CIS check 5.1.5 requires that the `default` service accounts have no roles or cluster roles bound to it apart from the defaults. In addition, the `default` service accounts should be configured such that it does not provide a service account token and does not have any explicit rights assignments.
## Reference Hardened RKE `cluster.yml` Configuration