Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Document AllowedFlexVolumes in PSP #6967

Merged
merged 1 commit into from
Jan 22, 2018
Merged

Document AllowedFlexVolumes in PSP #6967

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
15 changes: 15 additions & 0 deletions docs/concepts/policy/pod-security-policy.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -28,6 +28,7 @@ administrator to control the following:
| Usage of host networking and ports | [`hostNetwork`, `hostPorts`](#host-namespaces) |
| Usage of volume types | [`volumes`](#volumes-and-file-systems) |
| Usage of the host filesystem | [`allowedHostPaths`](#volumes-and-file-systems) |
| Usage of FlexVolume drivers | [`allowedFlexVolumes`](#flexvolume-drivers) |
| Allocating an FSGroup that owns the pod's volumes | [`fsGroup`](#volumes-and-file-systems) |
| Requiring the use of a read only root file system | [`readOnlyRootFilesystem`](#volumes-and-file-systems) |
| The user and group IDs of the container | [`runAsUser`, `supplementalGroups`](#users-and-groups) |
Expand Down Expand Up @@ -417,6 +418,20 @@ containers, and abusing the credentials of system services, such as Kubelet._
**ReadOnlyRootFilesystem** - Requires that containers must run with a read-only
root filesystem (i.e. no writeable layer).

### FlexVolume drivers

When the [`Volumes`](#volumes-and-file-systems) field contains `flexVolume` in
its list value, the cluster admin can further specify which driver(s) is permitted
by setting the `allowedFlexVolumes` field.

**AllowedFlexVolumes** - Provides a whitelist of allowed FlexVolumes. Empty or
nil indicates that all FlexVolume drivers may be used. For example, the following
setting only permits the `examle/fast_cache` driver to be used on nodes:

```yaml
allowedFlexVolumes: [ "example/fast_cache" ]
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Unfortunately, this example incorrect and won't work :-|

allowedFlexVolumes accepts list of the objects (not list of the strings). See correct example in the original PR from @wanghaoran1988

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

My fault. It should be a list of objects where each object has a driver property. Will fix.

```

### Users and groups

**RunAsUser** - Controls the what user ID containers run as.
Expand Down