2.5.8. 安全性上下文约束策略
Kubernetes 配置策略控制器负责监控安全性上下文约束 (SCC) 策略的状态。应用安全性上下文约束 (SCC) 策略，通过在策略中定义条件来控制 Pod 的权限。
在以下部分了解更多有关 SCC 策略的详细信息：
2.5.8.1. SCC 策略 YAML 结构
apiVersion: policy.open-cluster-management.io/v1
kind: Policy
metadata:
name: policy-scc
namespace: open-cluster-management-policies
spec:
complianceType:
remediationAction:
namespaces:
exclude:
include:
object-templates:
- complianceType:
objectDefinition:
apiVersion:
kind: SecurityContextConstraints # restricted scc
metadata:
annotations:
kubernetes.io/description:
name: sample-restricted-scc
allowHostDirVolumePlugin:
allowHostIPC:
allowHostNetwork:
allowHostPID:
allowHostPorts:
allowPrivilegeEscalation:
allowPrivilegedContainer:
allowedCapabilities:
defaultAddCapabilities:
fsGroup:
type:
groups:
- system:
priority:
readOnlyRootFilesystem:
requiredDropCapabilities:
runAsUser:
type:
seLinuxContext:
type:
supplementalGroups:
type:
users:
volumes: