rancher-docs/versioned_docs/version-2.7/reference-guides/rancher-security/psa-restricted-exemptions.md at ad1469c19b485cfe1f3fd49721294de780bc5678

mirror of https://github.com/rancher/rancher-docs.git synced 2026-04-15 19:05:41 +00:00

Files

Marty Hernandez Avedon cead220aaf #420 Canonical links for Rancher-security (#895 )

* canonicized k3s-self-assessment-guide

* canonicized rke1-hardening-guide

* canonicized rke2-self-assessment-guide

* canonicized selinux-rpm

* canonicized rancher-security

2023-10-02 10:47:31 -04:00

2.3 KiB

Raw Blame History

title

title
Sample PodSecurityConfiguration

The following PodSecurityConfiguration contains the required Rancher namespace exemptions for a rancher-restricted cluster to run properly.

apiVersion: apiserver.config.k8s.io/v1
kind: AdmissionConfiguration
plugins:
  - name: PodSecurity
    configuration:
      apiVersion: pod-security.admission.config.k8s.io/v1
      kind: PodSecurityConfiguration
      defaults:
        enforce: "restricted"
        enforce-version: "latest"
        audit: "restricted"
        audit-version: "latest"
        warn: "restricted"
        warn-version: "latest"
      exemptions:
        usernames: []
        runtimeClasses: []
        namespaces: [calico-apiserver,
                     calico-system,
                     cattle-alerting,
                     cattle-csp-adapter-system,
                     cattle-elemental-system,
                     cattle-epinio-system,
                     cattle-externalip-system,
                     cattle-fleet-local-system,
                     cattle-fleet-system,
                     cattle-gatekeeper-system,
                     cattle-global-data,
                     cattle-global-nt,
                     cattle-impersonation-system,
                     cattle-istio,
                     cattle-istio-system,
                     cattle-logging,
                     cattle-logging-system,
                     cattle-monitoring-system,
                     cattle-neuvector-system,
                     cattle-prometheus,
                     cattle-resources-system,
                     cattle-sriov-system,
                     cattle-system,
                     cattle-ui-plugin-system,
                     cattle-windows-gmsa-system,
                     cert-manager,
                     cis-operator-system,
                     fleet-default,
                     ingress-nginx,
                     istio-system,
                     kube-node-lease,
                     kube-public,
                     kube-system,
                     longhorn-system,
                     rancher-alerting-drivers,
                     security-scan,
                     tigera-operator]

2.3 KiB Raw Blame History

2.3 KiB

Raw Blame History