Commit 1f0c5e15 authored by Slava Semushin's avatar Slava Semushin

examples/podsecuritypolicy/rbac: fix names in comments and sync with examples repository.

parent b00c15f1
# privilegedPSP gives the privilegedPSP role # privileged-psp-users gives the privileged-psp-user role
# to the group privileged. # to the group privileged-psp-users.
apiVersion: rbac.authorization.k8s.io/v1 apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding kind: ClusterRoleBinding
metadata: metadata:
...@@ -13,8 +13,8 @@ roleRef: ...@@ -13,8 +13,8 @@ roleRef:
kind: ClusterRole kind: ClusterRole
name: privileged-psp-user name: privileged-psp-user
--- ---
# restrictedPSP grants the restrictedPSP role to # restricted-psp-users grants the restricted-psp-user role to
# the groups restricted and privileged. # the groups restricted-psp-users and privileged-psp-users.
apiVersion: rbac.authorization.k8s.io/v1 apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding kind: ClusterRoleBinding
metadata: metadata:
...@@ -32,7 +32,7 @@ roleRef: ...@@ -32,7 +32,7 @@ roleRef:
name: restricted-psp-user name: restricted-psp-user
--- ---
# edit grants edit role to the groups # edit grants edit role to the groups
# restricted and privileged. # restricted-psp-users and privileged-psp-users.
apiVersion: rbac.authorization.k8s.io/v1 apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding kind: ClusterRoleBinding
metadata: metadata:
......
...@@ -16,6 +16,12 @@ spec: ...@@ -16,6 +16,12 @@ spec:
- '*' - '*'
allowedCapabilities: allowedCapabilities:
- '*' - '*'
hostPID: true
hostIPC: true
hostNetwork: true
hostPorts:
- min: 1
max: 65536
--- ---
apiVersion: extensions/v1beta1 apiVersion: extensions/v1beta1
kind: PodSecurityPolicy kind: PodSecurityPolicy
...@@ -38,4 +44,6 @@ spec: ...@@ -38,4 +44,6 @@ spec:
- 'configMap' - 'configMap'
- 'persistentVolumeClaim' - 'persistentVolumeClaim'
- 'projected' - 'projected'
hostPID: false
hostIPC: false
hostNetwork: false
# restrictedPSP grants access to use # restricted-psp-user grants access to use the restricted PSP.
# the restricted PSP.
apiVersion: rbac.authorization.k8s.io/v1 apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole kind: ClusterRole
metadata: metadata:
name: restricted-psp-user name: restricted-psp-user
rules: rules:
- apiGroups: - apiGroups:
- extensions - extensions
resources: resources:
...@@ -14,13 +13,12 @@ rules: ...@@ -14,13 +13,12 @@ rules:
verbs: verbs:
- use - use
--- ---
# privilegedPSP grants access to use the privileged # privileged-psp-user grants access to use the privileged PSP.
# PSP.
apiVersion: rbac.authorization.k8s.io/v1 apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole kind: ClusterRole
metadata: metadata:
name: privileged-psp-user name: privileged-psp-user
rules: rules:
- apiGroups: - apiGroups:
- extensions - extensions
resources: resources:
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment