rancher-docs/assets/js/45997526.7884ce45.js

"use strict";(self.webpackChunkrancher_docs=self.webpackChunkrancher_docs||[]).push([[6167],{3905:(e,t,r)=>{r.d(t,{Zo:()=>u,kt:()=>y});var n=r(67294);function o(e,t,r){return t in e?Object.defineProperty(e,t,{value:r,enumerable:!0,configurable:!0,writable:!0}):e[t]=r,e}function i(e,t){var r=Object.keys(e);if(Object.getOwnPropertySymbols){var n=Object.getOwnPropertySymbols(e);t&&(n=n.filter((function(t){return Object.getOwnPropertyDescriptor(e,t).enumerable}))),r.push.apply(r,n)}return r}function a(e){for(var t=1;t<arguments.length;t++){var r=null!=arguments[t]?arguments[t]:{};t%2?i(Object(r),!0).forEach((function(t){o(e,t,r[t])})):Object.getOwnPropertyDescriptors?Object.defineProperties(e,Object.getOwnPropertyDescriptors(r)):i(Object(r)).forEach((function(t){Object.defineProperty(e,t,Object.getOwnPropertyDescriptor(r,t))}))}return e}function s(e,t){if(null==e)return{};var r,n,o=function(e,t){if(null==e)return{};var r,n,o={},i=Object.keys(e);for(n=0;n<i.length;n++)r=i[n],t.indexOf(r)>=0||(o[r]=e[r]);return o}(e,t);if(Object.getOwnPropertySymbols){var i=Object.getOwnPropertySymbols(e);for(n=0;n<i.length;n++)r=i[n],t.indexOf(r)>=0||Object.prototype.propertyIsEnumerable.call(e,r)&&(o[r]=e[r])}return o}var c=n.createContext({}),p=function(e){var t=n.useContext(c),r=t;return e&&(r="function"==typeof e?e(t):a(a({},t),e)),r},u=function(e){var t=p(e.components);return n.createElement(c.Provider,{value:t},e.children)},l={inlineCode:"code",wrapper:function(e){var t=e.children;return n.createElement(n.Fragment,{},t)}},d=n.forwardRef((function(e,t){var r=e.components,o=e.mdxType,i=e.originalType,c=e.parentName,u=s(e,["components","mdxType","originalType","parentName"]),d=p(r),y=o,m=d["".concat(c,".").concat(y)]||d[y]||l[y]||i;return r?n.createElement(m,a(a({ref:t},u),{},{components:r})):n.createElement(m,a({ref:t},u))}));function y(e,t){var r=arguments,o=t&&t.mdxType;if("string"==typeof e||o){var i=r.length,a=new Array(i);a[0]=d;var s={};for(var c in t)hasOwnProperty.call(t,c)&&(s[c]=t[c]);s.originalType=e,s.mdxType="string"==typeof e?e:o,a[1]=s;for(var p=2;p<i;p++)a[p]=r[p];return n.createElement.apply(null,a)}return n.createElement.apply(null,r)}d.displayName="MDXCreateElement"},3118:(e,t,r)=>{r.r(t),r.d(t,{assets:()=>c,contentTitle:()=>a,default:()=>l,frontMatter:()=>i,metadata:()=>s,toc:()=>p});var n=r(87462),o=(r(67294),r(3905));const i={title:"Adding a Pod Security Policy"},a=void 0,s={unversionedId:"how-to-guides/new-user-guides/manage-clusters/add-a-pod-security-policy",id:"version-2.6/how-to-guides/new-user-guides/manage-clusters/add-a-pod-security-policy",title:"Adding a Pod Security Policy",description:"The options below are available only for clusters that are launched using RKE.",source:"@site/versioned_docs/version-2.6/how-to-guides/new-user-guides/manage-clusters/add-a-pod-security-policy.md",sourceDirName:"how-to-guides/new-user-guides/manage-clusters",slug:"/how-to-guides/new-user-guides/manage-clusters/add-a-pod-security-policy",permalink:"/v2.6/how-to-guides/new-user-guides/manage-clusters/add-a-pod-security-policy",draft:!1,editUrl:"https://github.com/rancher/rancher-docs/edit/main/versioned_docs/version-2.6/how-to-guides/new-user-guides/manage-clusters/add-a-pod-security-policy.md",tags:[],version:"2.6",lastUpdatedAt:1668452187,formattedLastUpdatedAt:"Nov 14, 2022",frontMatter:{title:"Adding a Pod Security Policy"},sidebar:"tutorialSidebar",previous:{title:"Removing Kubernetes Components from Nodes",permalink:"/v2.6/how-to-guides/new-user-guides/manage-clusters/clean-cluster-nodes"},next:{title:"Assigning Pod Security Policies",permalink:"/v2.6/how-to-guides/new-user-guides/manage-clusters/assign-pod-security-policies"}},c={},p=[],u={toc:p};function l(e){let{components:t,...r}=e;return(0,o.kt)("wrapper",(0,n.Z)({},u,r,{components:t,mdxType:"MDXLayout"}),(0,o.kt)("admonition",{title:"Prerequisite:",type:"note"},(0,o.kt)("p",{parentName:"admonition"},"The options below are available only for clusters that are ",(0,o.kt)("a",{parentName:"p",href:"/v2.6/pages-for-subheaders/launch-kubernetes-with-rancher"},"launched using RKE."))),(0,o.kt)("p",null,"When your cluster is running pods with security-sensitive configurations, assign it a ",(0,o.kt)("a",{parentName:"p",href:"/v2.6/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/create-pod-security-policies"},"pod security policy"),", which is a set of rules that monitors the conditions and settings in your pods. If a pod doesn't meet the rules specified in your policy, the policy stops it from running."),(0,o.kt)("p",null,"You can assign a pod security policy when you provision a cluster. However, if you need to relax or restrict security for your pods later, you can update the policy while editing your cluster."),(0,o.kt)("ol",null,(0,o.kt)("li",{parentName:"ol"},(0,o.kt)("p",{parentName:"li"},"Click ",(0,o.kt)("strong",{parentName:"p"},"\u2630 > Cluster Management"),".")),(0,o.kt)("li",{parentName:"ol"},(0,o.kt)("p",{parentName:"li"},"Go to the cluster to which you want to apply a pod security policy and click ",(0,o.kt)("strong",{parentName:"p"},"\u22ee > Edit Config"),".")),(0,o.kt)("li",{parentName:"ol"},(0,o.kt)("p",{parentName:"li"},"From ",(0,o.kt)("strong",{parentName:"p"},"Pod Security Policy Support"),", select ",(0,o.kt)("strong",{parentName:"p"},"Enabled"),"."),(0,o.kt)("admonition",{parentName:"li",type:"note"},(0,o.kt)("p",{parentName:"admonition"},"This option is only available for clusters ",(0,o.kt)("a",{parentName:"p",href:"/v2.6/pages-for-subheaders/launch-kubernetes-with-rancher"},"provisioned by RKE"),"."))),(0,o.kt)("li",{parentName:"ol"},(0,o.kt)("p",{parentName:"li"},"From the ",(0,o.kt)("strong",{parentName:"p"},"Default Pod Security Policy")," drop-down, select the policy you want to apply to the cluster."),(0,o.kt)("p",{parentName:"li"},"Rancher ships with ",(0,o.kt)("a",{parentName:"p",href:"/v2.6/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/create-pod-security-policies#default-pod-security-policies"},"policies")," of ",(0,o.kt)("inlineCode",{parentName:"p"},"restricted")," and ",(0,o.kt)("inlineCode",{parentName:"p"},"unrestricted"),", although you can ",(0,o.kt)("a",{parentName:"p",href:"/v2.6/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/create-pod-security-policies#default-pod-security-policies"},"create custom policies")," as well.")),(0,o.kt)("li",{parentName:"ol"},(0,o.kt)("p",{parentName:"li"},"Click ",(0,o.kt)("strong",{parentName:"p"},"Save"),"."))),(0,o.kt)("p",null,(0,o.kt)("strong",{parentName:"p"},"Result:")," The pod security policy is applied to the cluster and any projects within the cluster."),(0,o.kt)("admonition",{type:"note"},(0,o.kt)("p",{parentName:"admonition"},"Workloads already running before assignment of a pod security policy are grandfathered in. Even if they don't meet your pod security policy, workloads running before assignment of the policy continue to run."),(0,o.kt)("p",{parentName:"admonition"},"To check if a running workload passes your pod security policy, clone or upgrade it.")))}l.isMDXComponent=!0}}]);