Merge pull request #67624 from tallclair/psp-addons

Automatic merge from submit-queue. If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>. Allow adding default capabilities to unprivileged addons **What this PR does / why we need it**: Allow adding the default set of capabilities back to unprivileged addons, when using the the default GCE PodSecurityPolicies. This is useful when paired with `drop: [ 'all' ]` This is not a relaxation of permissions, as a pod that didn't touch capabilities (implicitly has the default set) is already allowed. **Which issue(s) this PR fixes**: Fixes https://github.com/kubernetes/dns/issues/254 **Release note**: ```release-note NONE ```

Merge pull request #67624 from tallclair/psp-addons
b72e61ed · Kubernetes Submit Queue · GitHub · 09cdfc52 · 13adb977 · b72e61ed
Unverified Commit b72e61ed authored Aug 21, 2018 by Kubernetes Submit Queue Committed by GitHub Aug 21, 2018
Hide whitespace changes
Inline Side-by-side

Showing with 16 additions and 0 deletions

unprivileged-addon.yaml ...er/gce/addons/podsecuritypolicies/unprivileged-addon.yaml +16 -0

No files found.
--- a/cluster/gce/addons/podsecuritypolicies/unprivileged-addon.yaml
+++ b/cluster/gce/addons/podsecuritypolicies/unprivileged-addon.yaml
@@ -19,6 +19,22 @@ metadata:
 spec:
  privileged: false
  allowPrivilegeEscalation: false
+  # The docker default set of capabilities
+  allowedCapabilities:
+  - SETPCAP
+  - MKNOD
+  - AUDIT_WRITE
+  - CHOWN
+  - NET_RAW
+  - DAC_OVERRIDE
+  - FOWNER
+  - FSETID
+  - KILL
+  - SETGID
+  - SETUID
+  - NET_BIND_SERVICE
+  - SYS_CHROOT
+  - SETFCAP
  volumes:
  - 'emptyDir'
  - 'configMap'