openshift/openshift-docs
1
0
Fork 0
mirror of https://github.com/openshift/openshift-docs.git synced 2026-02-05 12:46:18 +01:00
Code Issues Releases Activity

PSA and SCC Coexistence for PSA RHIBMCS-145

Browse Source
This commit is contained in:
Chris D. Johnson
2024-02-12 11:43:10 -08:00
committed by openshift-cherrypick-robot
parent a3b664843d
commit c76c0476ca
2 changed files with 18 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
authentication/understanding-and-managing-pod-security-admission.adoc
View File

@@ -11,6 +11,9 @@ Pod security admission is an implementation of the link:https://kubernetes.io/do
// About pod security admission
include::modules/security-context-constraints-psa-about.adoc[leveloffset=+1]
// Understanding pod security admission coexistence
include::modules/security-context-constraints-psa-coexistence.adoc[leveloffset=+2]
// About pod security admission synchronization
include::modules/security-context-constraints-psa-synchronization.adoc[leveloffset=+1]

15
modules/security-context-constraints-psa-coexistence.adoc Normal file
View File

@@ -0,0 +1,15 @@
// Module included in the following assemblies:
//
// * authentication/understanding-and-managing-pod-security-admission.adoc
:_mod-docs-content-type: CONCEPT
[id="security-context-constraints-psa-coexistence_{context}"]
= Pod security admission and security context constraints
Pod security admission standards and security context constraints are reconciled and enforced by two independent controllers. The two controllers work independently using the following processes to enforce security policies:
. The security context constraint controller may mutate some security context fields per the pod's assigned SCC. For example, if the seccomp profile is empty or not set and if the pod's assigned SCC enforces `seccompProfiles` field to be `runtime/default`, the controller sets the default type to `RuntimeDefault`.
. The security context constraint controller validates the pod's security context against the matching SCC.
. The pod security admission controller validates the pod's security context against the pod security standard assigned to the namespace.