2.4.5. Pod 安全策略

Kubernetes 配置策略控制器负责监控 Pod 安全策略的状态。应用 Pod 安全策略来保护 Pod 和容器。如需更多信息,请参阅 Kubernetes 文档中的 Pod 安全策略。在以下部分了解更多有关 pod 安全策略结构的详细信息。

2.4.5.1. Pod 安全策略 YAML 结构

   apiVersion: policy.open-cluster-management.io/v1
   kind: Policy
   metadata:
     name: policy-podsecuritypolicy
     namespace:
   spec:
     complianceType:
     remediationAction:
     namespaces:
       exclude:
       include:
     object-templates:
       - complianceType:
         objectDefinition:
           apiVersion:
           kind: PodSecurityPolicy # no privileged pods
           metadata:
             name:
             annotations:
           spec:
             privileged:
             allowPrivilegeEscalation:
             allowedCapabilities:
             volumes:
             hostNetwork:
             hostPorts:
             hostIPC:
             hostPID:
             runAsUser:
               rule:
             seLinux:
               rule:
             supplementalGroups:
               rule:
             fsGroup:
               rule:
        ...