mirror of
https://github.com/jpetazzo/container.training.git
synced 2026-05-06 17:06:37 +00:00
f123c8b86d
For now we set to warn+audit on baseline pods, but don't enforce any restriction yet. This way, it shouldn't break anything, but will still issue visible warnings for problematic pods.
22 lines
619 B
YAML
22 lines
619 B
YAML
apiVersion: apiserver.config.k8s.io/v1
|
|
kind: AdmissionConfiguration
|
|
plugins:
|
|
- name: PodSecurity
|
|
configuration:
|
|
apiVersion: pod-security.admission.config.k8s.io/v1
|
|
kind: PodSecurityConfiguration
|
|
defaults:
|
|
enforce: "privileged"
|
|
enforce-version: "latest"
|
|
audit: "baseline"
|
|
audit-version: "latest"
|
|
warn: "baseline"
|
|
warn-version: "latest"
|
|
exemptions:
|
|
# Array of authenticated usernames to exempt.
|
|
usernames: []
|
|
# Array of runtime class names to exempt.
|
|
runtimeClasses: []
|
|
# Array of namespaces to exempt.
|
|
namespaces: [ kube-system ]
|