mirror of
https://github.com/openshift/openshift-docs.git
synced 2026-02-05 12:46:18 +01:00
Merge pull request #66375 from openshift-cherrypick-robot/cherry-pick-66082-to-enterprise-4.14
/lgtm
This commit is contained in:
Joe Aldinger
@@ -1,10 +1,10 @@
|
||||
:_content-type: ASSEMBLY
|
||||
[id="authentication-with-microshift"]
|
||||
= Pod security authentication and authorization on {product-title}
|
||||
= Pod security authentication and authorization
|
||||
include::_attributes/attributes-microshift.adoc[]
|
||||
:context: authentication-microshift
|
||||
|
||||
== Understanding and managing pod security admission
|
||||
== Understanding and managing pod security admission
|
||||
|
||||
Pod security admission is an implementation of the link:https://kubernetes.io/docs/concepts/security/pod-security-standards/[Kubernetes pod security standards]. Use pod security admission to restrict the behavior of pods.
|
||||
|
||||
|
||||
@@ -2,11 +2,13 @@
|
||||
//
|
||||
// * microshift_running_apps/microshift-authentication.adoc
|
||||
|
||||
:_content-type: PROCEDURE
|
||||
:_content-type: PROCEDURE
|
||||
[id="microshift-security-context-constraints-opting_{context}"]
|
||||
= Controlling pod security admission synchronization
|
||||
|
||||
You can enable or disable automatic pod security admission synchronization for most namespaces.
|
||||
You can enable automatic pod security admission synchronization for most namespaces.
|
||||
|
||||
System defaults are not enforced when the `security.openshift.io/scc.podSecurityLabelSync` field is empty or set to `false`. You must set the label to `true` for synchronization to occur.
|
||||
|
||||
[IMPORTANT]
|
||||
====
|
||||
@@ -18,23 +20,14 @@ Namespaces that are defined as part of the cluster payload have pod security adm
|
||||
* `kube-public`
|
||||
* `openshift`
|
||||
* All system-created namespaces that are prefixed with `openshift-`, except for `openshift-operators`
|
||||
By default, all namespaces that have an `openshift-` prefix are not synchronized. You can enable synchronization for any user-created [x-]`openshift-*` namespaces. You cannot enable synchronization for any system-created [x-]`openshift-*` namespaces, except for `openshift-operators`.
|
||||
By default, all namespaces that have an `openshift-` prefix are not synchronized. You can enable synchronization for any user-created [x-]`openshift-*` namespaces. You cannot enable synchronization for any system-created [x-]`openshift-*` namespaces, except for `openshift-operators`.
|
||||
|
||||
If an Operator is installed in a user-created `openshift-*` namespace, synchronization is turned on by default after a cluster service version (CSV) is created in the namespace. The synchronized label inherits the permissions of the service accounts in the namespace.
|
||||
====
|
||||
|
||||
.Procedure
|
||||
|
||||
* For each namespace that you want to configure, set a value for the `security.openshift.io/scc.podSecurityLabelSync` label:
|
||||
** To disable pod security admission label synchronization in a namespace, set the value of the `security.openshift.io/scc.podSecurityLabelSync` label to `false`.
|
||||
+
|
||||
Run the following command:
|
||||
+
|
||||
[source,terminal]
|
||||
----
|
||||
$ oc label namespace <namespace> security.openshift.io/scc.podSecurityLabelSync=false
|
||||
----
|
||||
** To enable pod security admission label synchronization in a namespace, set the value of the `security.openshift.io/scc.podSecurityLabelSync` label to `true`.
|
||||
* To enable pod security admission label synchronization in a namespace, set the value of the `security.openshift.io/scc.podSecurityLabelSync` label to `true`.
|
||||
+
|
||||
Run the following command:
|
||||
+
|
||||
|
||||
@@ -7,13 +7,13 @@
|
||||
|
||||
= Security context constraint synchronization with pod security standards
|
||||
|
||||
{product-title} includes link:https://kubernetes.io/docs/concepts/security/pod-security-admission[Kubernetes pod security admission]. Globally, the `restricted` profile is enforced by default for {product-title}.
|
||||
{microshift-short} includes link:https://kubernetes.io/docs/concepts/security/pod-security-admission[Kubernetes pod security admission].
|
||||
|
||||
In addition to the global pod security admission control configuration, a controller exists that applies pod security admission control `warn` and `audit` labels to namespaces according to the security context constraint (SCC) permissions of the service accounts that are in a given namespace.
|
||||
|
||||
[IMPORTANT]
|
||||
====
|
||||
Namespaces that are defined as part of the cluster payload have pod security admission synchronization disabled permanently. You can enable pod security admission synchronization on other namespaces as necessary. If an Operator is installed in a user-created `openshift-*` namespace, synchronization is turned on by default after a cluster service version (CSV) is created in the namespace.
|
||||
Namespaces that are defined as part of the cluster payload have pod security admission synchronization disabled permanently. You can enable pod security admission synchronization on other namespaces as necessary. If an Operator is installed in a user-created `openshift-*` namespace, synchronization is turned on by default after a cluster service version (CSV) is created in the namespace.
|
||||
====
|
||||
|
||||
The controller examines `ServiceAccount` object permissions to use security context constraints in each namespace. Security context constraints (SCCs) are mapped to pod security profiles based on their field values; the controller uses these translated profiles. Pod security admission `warn` and `audit` labels are set to the most privileged pod security profile found in the namespace to prevent warnings and audit logging as pods are created.
|
||||
|
||||
@@ -2,22 +2,21 @@
|
||||
//
|
||||
// * microshift_running_apps/microshift-authentication.adoc
|
||||
|
||||
:_content-type: PROCEDURE
|
||||
:_content-type: PROCEDURE
|
||||
[id="microshift-viewing-security-context_{context}"]
|
||||
= Viewing security context constraints in a namespace
|
||||
= Viewing security context constraints in a namespace
|
||||
|
||||
MicroShift allows you to access the security context constraints (SCC) permissions in a given namespace.
|
||||
You can view the security context constraints (SCC) permissions in a given namespace.
|
||||
|
||||
.Prerequisites
|
||||
.Prerequisites
|
||||
|
||||
* You have installed the OpenShift CLI (`oc`)
|
||||
* You have installed the OpenShift CLI (`oc`).
|
||||
|
||||
.Procedure
|
||||
|
||||
* To view the security context constraints in your namespace, run the following command:
|
||||
* To view the security context constraints in your namespace, run the following command:
|
||||
+
|
||||
[source,terminal]
|
||||
----
|
||||
oc get --show-labels namespace <namespace>
|
||||
----
|
||||
|
||||
|
||||
Reference in New Issue
Block a user