• Kubernetes Submit Queue's avatar
    Merge pull request #51337 from php-coder/psp_star_in_allowed_caps · fb994df7
    Kubernetes Submit Queue authored
    Automatic merge from submit-queue (batch tested with PRs 51337, 47080, 52646, 52635, 52666). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>..
    
    PodSecurityPolicy.allowedCapabilities: add support for * to allow to request any capabilities
    
    **What this PR does / why we need it**:
    Prior this change there was no way to allow to pods to request any capabilities. Cluster admin had always specify a full list of capabilities explicitly. Because there are many of them, it gets tedious. This PR makes possible to use `*` to allow all possible capabilities. Non-paranoid (and lazy) cluster admins can use it. Those who are super strict and paranoid of course won't use it because `*` allows capabilities that don't exist today but may be introduced in the future.
    
    "privileged" PSP in examples was modified to allow privileged users to use this feature.
    
    **Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: fixes #50055
    
    **Special notes for your reviewer**:
    This functional is already present in OpenShift: https://github.com/openshift/origin/pull/12875 and https://github.com/openshift/origin/pull/15135
    
    **Release note**:
    ```release-note
    PSP: add support for using `*` as a value in `allowedCapabilities` to allow to request any capabilities
    ```
    
    CC @simo5 @pweil- @gyliu513 @liqlin2015
    fb994df7
Name
Last commit
Last update
..
admit Loading commit data...
alwayspullimages Loading commit data...
antiaffinity Loading commit data...
defaulttolerationseconds Loading commit data...
deny Loading commit data...
eventratelimit Loading commit data...
exec Loading commit data...
gc Loading commit data...
imagepolicy Loading commit data...
initialization Loading commit data...
initialresources Loading commit data...
limitranger Loading commit data...
namespace Loading commit data...
noderestriction Loading commit data...
persistentvolume Loading commit data...
podnodeselector Loading commit data...
podpreset Loading commit data...
podtolerationrestriction Loading commit data...
priority Loading commit data...
resourcequota Loading commit data...
security Loading commit data...
securitycontext/scdeny Loading commit data...
serviceaccount Loading commit data...
storageclass/setdefault Loading commit data...
webhook Loading commit data...
OWNERS Loading commit data...