云容器引擎 CCE-PodSecurityPolicy配置:Pod安全策略开放非安全系统配置示例

时间：2023-11-01 16:25:55

云容器引擎 CCE

Pod安全策略开放非安全系统配置示例

节点池管理中可以为相应的节点池配置allowed-unsafe-sysctls，CCE从1.17.17集群版本开始，需要在Pod安全策略的allowedUnsafeSysctls字段中增加相应的配置才能生效，配置详情请参考表1。

除修改全局Pod安全策略外，也可增加新的Pod安全策略，如开放net.core.somaxconn非安全系统配置，新增Pod安全策略示例参考如下：

apiVersion: policy/v1beta1kind: PodSecurityPolicymetadata:  annotations:    seccomp.security.alpha.kubernetes.io/allowedProfileNames: '*'  name: sysctl-pspspec:  allowedUnsafeSysctls:  - net.core.somaxconn  allowPrivilegeEscalation: true  allowedCapabilities:  - '*'  fsGroup:    rule: RunAsAny  hostIPC: true  hostNetwork: true  hostPID: true  hostPorts:  - max: 65535    min: 0  privileged: true  runAsGroup:    rule: RunAsAny  runAsUser:    rule: RunAsAny  seLinux:    rule: RunAsAny  supplementalGroups:    rule: RunAsAny  volumes:  - '*'---kind: ClusterRoleapiVersion: rbac.authorization.k8s.io/v1metadata:  name: sysctl-psprules:  - apiGroups:      - "*"    resources:      - podsecuritypolicies    resourceNames:      - sysctl-psp    verbs:      - use---apiVersion: rbac.authorization.k8s.io/v1kind: ClusterRoleBindingmetadata:  name: sysctl-psproleRef:  kind: ClusterRole  name: sysctl-psp  apiGroup: rbac.authorization.k8s.iosubjects:- kind: Group  name: system:authenticated  apiGroup: rbac.authorization.k8s.io

上一篇：云容器引擎 CCE-PodSecurityPolicy配置:恢复原始Pod安全策略

下一篇：云容器引擎 CCE-PodSecurityPolicy配置:修改全局默认Pod安全策略