Pod security policy (PSP)

@toc

Enable Pod The security policy

#  edit kube-apiserver.yaml
vim /etc/kubernetes/manifests/kube-apiserver.yaml

#  Enable pod The security policy , stay kube-apiserver.yaml Add the following parameters 
- --enable-admission-plugins=NodeRestriction,PodSecurityPolicy

#  restart kubelet service 
systemctl restart kubelet

It is forbidden to create privilege mode pod

#  Create a service account in the default namespace aliang
kubectl create sa aliang

#  take SA Bind to system built-in Role
kubectl create rolebinding aliang --clusterrole=edit --sa=default:aliang

#  Create using PSP Authority to Role
kubectl create role psp:unprivileged --verb=use --resource=podsecuritypolicy --resource-name=psp-example

#  take SA Bound to the Role
kubectl create rolebinding aliang:psp:unprivileged --role=psp:unprivileged --sa=default:aliang