From c6891889768b0e3a68c381d6ed4e587b017b346a Mon Sep 17 00:00:00 2001
From: Daishan <daishan@rancher.com>
Date: Fri, 28 May 2021 12:51:16 -0700
Subject: [PATCH] Add clusterRole and binding to use restricted psp

---
 .../rancher-2.5/1.6-hardening-2.5/_index.md   | 30 +++++++++++++++++++
 1 file changed, 30 insertions(+)

diff --git a/content/rancher/v2.x/en/security/rancher-2.5/1.6-hardening-2.5/_index.md b/content/rancher/v2.x/en/security/rancher-2.5/1.6-hardening-2.5/_index.md
index c49eb6a1d40..82970d87e17 100644
--- a/content/rancher/v2.x/en/security/rancher-2.5/1.6-hardening-2.5/_index.md
+++ b/content/rancher/v2.x/en/security/rancher-2.5/1.6-hardening-2.5/_index.md
@@ -287,6 +287,36 @@ addons: |
     - configMap
     - projected
   ---
+  apiVersion: rbac.authorization.k8s.io/v1
+  kind: ClusterRole
+  metadata:
+    name: psp:restricted
+  rules:
+  - apiGroups:
+    - extensions
+    resourceNames:
+    - restricted
+    resources:
+    - podsecuritypolicies
+    verbs:
+    - use
+  ---
+  apiVersion: rbac.authorization.k8s.io/v1
+  kind: ClusterRoleBinding
+  metadata:
+    name: psp:restricted
+  roleRef:
+    apiGroup: rbac.authorization.k8s.io
+    kind: ClusterRole
+    name: psp:restricted
+  subjects:
+  - apiGroup: rbac.authorization.k8s.io
+    kind: Group
+    name: system:serviceaccounts
+  - apiGroup: rbac.authorization.k8s.io
+    kind: Group
+    name: system:authenticated
+  ---
   apiVersion: networking.k8s.io/v1
   kind: NetworkPolicy
   metadata: