kubernetes
/
website
mirror of https://github.com/kubernetes/website.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Use `runtime/default` for seccomp. (#14616)

This commit is contained in:
Martin Vladev 2019-05-30 04:34:20 +02:00 committed by Kubernetes Prow Robot
parent 92760f80dc
commit 8e541844e9
3 changed files with 7 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
content/en/docs/concepts/policy/pod-security-policy.md
View File

@ -593,7 +593,9 @@ are:
- `unconfined` - Seccomp is not applied to the container processes (this is the - `unconfined` - Seccomp is not applied to the container processes (this is the
default in Kubernetes), if no alternative is provided. default in Kubernetes), if no alternative is provided.
- `docker/default` - The Docker default seccomp profile is used. - `runtime/default` - The default container runtime profile is used.
- `docker/default` - The Docker default seccomp profile is used. Deprecated as of
Kubernetes 1.11. Use `runtime/default` instead.
- `localhost/<path>` - Specify a profile as a file on the node located at - `localhost/<path>` - Specify a profile as a file on the node located at
`<seccomp_root>/<path>`, where `<seccomp_root>` is defined via the `<seccomp_root>/<path>`, where `<seccomp_root>` is defined via the
`--seccomp-profile-root` flag on the Kubelet. `--seccomp-profile-root` flag on the Kubelet.

4
content/en/examples/policy/restricted-psp.yaml
View File

@ -3,9 +3,9 @@ kind: PodSecurityPolicy
metadata: metadata:
name: restricted name: restricted
annotations: annotations:
seccomp.security.alpha.kubernetes.io/allowedProfileNames: 'docker/default' seccomp.security.alpha.kubernetes.io/allowedProfileNames: 'docker/default,runtime/default'
apparmor.security.beta.kubernetes.io/allowedProfileNames: 'runtime/default' apparmor.security.beta.kubernetes.io/allowedProfileNames: 'runtime/default'
seccomp.security.alpha.kubernetes.io/defaultProfileName: 'docker/default' seccomp.security.alpha.kubernetes.io/defaultProfileName: 'runtime/default'
apparmor.security.beta.kubernetes.io/defaultProfileName: 'runtime/default' apparmor.security.beta.kubernetes.io/defaultProfileName: 'runtime/default'
spec: spec:
privileged: false privileged: false

4
content/ja/examples/policy/restricted-psp.yaml
View File

@ -3,9 +3,9 @@ kind: PodSecurityPolicy
metadata: metadata:
name: restricted name: restricted
annotations: annotations:
seccomp.security.alpha.kubernetes.io/allowedProfileNames: 'docker/default' seccomp.security.alpha.kubernetes.io/allowedProfileNames: 'docker/default,runtime/default'
apparmor.security.beta.kubernetes.io/allowedProfileNames: 'runtime/default' apparmor.security.beta.kubernetes.io/allowedProfileNames: 'runtime/default'
seccomp.security.alpha.kubernetes.io/defaultProfileName: 'docker/default' seccomp.security.alpha.kubernetes.io/defaultProfileName: 'runtime/default'
apparmor.security.beta.kubernetes.io/defaultProfileName: 'runtime/default' apparmor.security.beta.kubernetes.io/defaultProfileName: 'runtime/default'
spec: spec:
privileged: false privileged: false