Skip to content

Commit 4d11600

Browse files
Robert FeketeRobert Fekete
authored andcommitted
Delete references to PSPs
1 parent a7a8b30 commit 4d11600

File tree

2 files changed

+1
-122
lines changed

2 files changed

+1
-122
lines changed

content/docs/configuration/crds/v1beta1/common_types.md

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -93,6 +93,7 @@ Security defines Fluentd, FluentbitAgent deployment security properties
9393

9494
### podSecurityPolicyCreate (bool, optional) {#security-podsecuritypolicycreate}
9595

96+
Warning: this is not supported anymore and does nothing
9697

9798
### roleBasedAccessControlCreate (*bool, optional) {#security-rolebasedaccesscontrolcreate}
9899

content/docs/logging-infrastructure/security/_index.md

Lines changed: 0 additions & 122 deletions
Original file line numberDiff line numberDiff line change
@@ -13,7 +13,6 @@ aliases:
1313
| Variable Name | Type | Required | Default | Description |
1414
|---|---|---|---|---|
1515
| roleBasedAccessControlCreate | bool | No | True | create RBAC resources |
16-
| podSecurityPolicyCreate | bool | No | False | create PSP resources |
1716
| serviceAccount | string | No | - | Set ServiceAccount |
1817
| securityContext | [SecurityContext](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.26/#securitycontext-v1-core) | No | {} | SecurityContext holds security configuration that will be applied to a container. |
1918
| podSecurityContext | [PodSecurityContext](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.26/#podsecuritycontext-v1-core) | No | {} | PodSecurityContext holds pod-level security attributes and common container settings. Some |
@@ -151,127 +150,6 @@ spec:
151150
EOF
152151
```
153152

154-
## Enabling Pod Security Policies ([PSP](https://kubernetes.io/docs/concepts/policy/pod-security-policy/))
155-
156-
> This option depends on the roleBasedAccessControlCreate enabled status because the psp require rbac roles also.
157-
158-
### Deploy with Kubernetes Manifests {#psp-deploy-kubernetes-manifests}
159-
160-
Create `logging` resource with PSP
161-
162-
```yaml
163-
kubectl -n logging apply -f - <<"EOF"
164-
apiVersion: logging.banzaicloud.io/v1beta1
165-
kind: Logging
166-
metadata:
167-
name: default-logging-simple
168-
spec:
169-
fluentd:
170-
security:
171-
podSecurityPolicyCreate: true
172-
roleBasedAccessControlCreate: true
173-
fluentbit:
174-
security:
175-
podSecurityPolicyCreate: true
176-
roleBasedAccessControlCreate: true
177-
controlNamespace: logging
178-
EOF
179-
```
180-
181-
### Example Manifest Generated by the operator
182-
183-
#### Fluentd PSP+Role Output
184-
185-
```yaml
186-
apiVersion: rbac.authorization.k8s.io/v1
187-
kind: Role
188-
metadata:
189-
name: nginx-demo-nginx-logging-demo-logging-fluentd-psp
190-
rules:
191-
- apiGroups:
192-
- policy
193-
- extensions
194-
resources:
195-
- podsecuritypolicies
196-
resourceNames:
197-
- nginx-demo-nginx-logging-demo-logging-fluentd
198-
verbs:
199-
- use
200-
201-
---
202-
apiVersion: policy/v1beta1
203-
kind: PodSecurityPolicy
204-
metadata:
205-
name: nginx-demo-nginx-logging-demo-logging-fluentd
206-
spec:
207-
allowPrivilegeEscalation: false
208-
fsGroup:
209-
ranges:
210-
- max: 101
211-
min: 101
212-
rule: MustRunAs
213-
runAsUser:
214-
ranges:
215-
- max: 100
216-
min: 100
217-
rule: MustRunAs
218-
seLinux:
219-
rule: RunAsAny
220-
supplementalGroups:
221-
ranges:
222-
- max: 101
223-
min: 101
224-
rule: MustRunAs
225-
volumes:
226-
- configMap
227-
- emptyDir
228-
- secret
229-
- hostPath
230-
- persistentVolumeClaim
231-
```
232-
233-
#### Fluentbit PSP+ClusterRole Output
234-
235-
```yaml
236-
apiVersion: rbac.authorization.k8s.io/v1
237-
kind: ClusterRole
238-
metadata:
239-
name: nginx-demo-nginx-logging-demo-logging-fluentbit-psp
240-
rules:
241-
- apiGroups:
242-
- policy
243-
resources:
244-
- nginx-demo-nginx-logging-demo-logging-fluentbit
245-
verbs:
246-
- use
247-
---
248-
apiVersion: policy/v1beta1
249-
kind: PodSecurityPolicy
250-
metadata:
251-
name: nginx-demo-nginx-logging-demo-logging-fluentbit
252-
spec:
253-
allowPrivilegeEscalation: false
254-
allowedHostPaths:
255-
- pathPrefix: /var/lib/docker/containers
256-
readOnly: true
257-
- pathPrefix: /var/log
258-
readOnly: true
259-
fsGroup:
260-
rule: RunAsAny
261-
readOnlyRootFilesystem: true
262-
runAsUser:
263-
rule: RunAsAny
264-
seLinux:
265-
rule: RunAsAny
266-
supplementalGroups:
267-
rule: RunAsAny
268-
volumes:
269-
- configMap
270-
- emptyDir
271-
- secret
272-
- hostPath
273-
```
274-
275153
## [Security Context](https://kubernetes.io/docs/tasks/configure-pod-container/security-context/)
276154

277155
- [Security Context Parameters](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.26/#securitycontext-v1-core)

0 commit comments

Comments
 (0)