2.4.5. Pod 安全策略
Kubernetes 配置策略控制器负责监控 Pod 安全策略的状态。应用 Pod 安全策略来保护 Pod 和容器。如需更多信息，请参阅 Kubernetes 文档中的 Pod 安全策略。在以下部分了解更多有关 pod 安全策略结构的详细信息。
2.4.5.1. Pod 安全策略 YAML 结构
apiVersion: policy.open-cluster-management.io/v1
kind: Policy
metadata:
name: policy-podsecuritypolicy
namespace:
spec:
complianceType:
remediationAction:
namespaces:
exclude:
include:
object-templates:
- complianceType:
objectDefinition:
apiVersion:
kind: PodSecurityPolicy # no privileged pods
metadata:
name:
annotations:
spec:
privileged:
allowPrivilegeEscalation:
allowedCapabilities:
volumes:
hostNetwork:
hostPorts:
hostIPC:
hostPID:
runAsUser:
rule:
seLinux:
rule:
supplementalGroups:
rule:
fsGroup:
rule:
...