Skip to content

Commit

Permalink
Merge pull request #90 from utilitywarehouse/rm-psp
Browse files Browse the repository at this point in the history
Remove deprecated PSP
  • Loading branch information
ffilippopoulos authored Jul 6, 2022
2 parents e0dcf57 + b3ddec0 commit 75eb959
Showing 1 changed file with 0 additions and 38 deletions.
38 changes: 0 additions & 38 deletions base/cluster-wide/rbac.yaml
Original file line number Diff line number Diff line change
@@ -1,41 +1,3 @@
# Used by vault to get SYS_PTRACE capability
# ptrace is neeeded by the config reloader sidecar to send SIGHUP to vault
# https://kubernetes.io/docs/tasks/configure-pod-container/share-process-namespace/
apiVersion: policy/v1beta1
kind: PodSecurityPolicy
metadata:
name: vault
spec:
allowedCapabilities:
- SYS_PTRACE
seLinux:
rule: RunAsAny
supplementalGroups:
rule: RunAsAny
runAsUser:
rule: RunAsAny
fsGroup:
rule: RunAsAny
# Allow same volumes as the default policy
volumes:
- "configMap"
- "emptyDir"
- "projected"
- "secret"
- "downwardAPI"
- "persistentVolumeClaim"
---
kind: ClusterRole
apiVersion: rbac.authorization.k8s.io/v1
metadata:
name: vault
rules:
- apiGroups: ["policy"]
resources: ["podsecuritypolicies"]
verbs: ["use"]
resourceNames:
- vault
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
Expand Down

0 comments on commit 75eb959

Please sign in to comment.