@@ -13,6 +13,8 @@ content_type: concept
13
13
weight: 30
14
14
-->
15
15
16
+ <!-- overview -->
17
+
16
18
{{< feature-state for_k8s_version="v1.21" state="deprecated" >}}
17
19
18
20
{{< caution >}}
@@ -50,9 +52,9 @@ administrator to control the following:
50
52
-->
51
53
## 什么是 Pod 安全策略? {#what-is-a-pod-security-policy}
52
54
53
- ** Pod 安全策略(Pod Security Policy)** 是集群级别的资源,它能够控制 Pod
55
+ ** Pod 安全策略(Pod Security Policy)** 是集群级别的资源,它能够控制 Pod
54
56
规约中与安全性相关的各个方面。
55
- [ PodSecurityPolicy] (/zh-cn/ docs/reference/generated/kubernetes-api/{{< param "version" >}}/#podsecuritypolicy-v1beta1-policy)
57
+ [ PodSecurityPolicy] (/docs/reference/generated/kubernetes-api/{{< param "version" >}}/#podsecuritypolicy-v1beta1-policy)
56
58
对象定义了一组 Pod 运行时必须遵循的条件及相关字段的默认值,只有 Pod 满足这些条件才会被系统接受。
57
59
Pod 安全策略允许管理员控制如下操作:
58
60
@@ -269,7 +271,7 @@ paired with system groups to grant access to all pods run in the namespace:
269
271
270
272
<!--
271
273
For more examples of RBAC bindings, see
272
- [Role Binding Examples ](/docs/reference/access-authn-authz/rbac#role-binding-examples).
274
+ [RoleBinding examples ](/docs/reference/access-authn-authz/rbac#role-binding-examples).
273
275
For a complete example of authorizing a PodSecurityPolicy, see [below](#example).
274
276
-->
275
277
参阅[角色绑定示例](/zh-cn/docs/reference/access-authn-authz/rbac#role-binding-examples)查看
@@ -310,7 +312,7 @@ PodSecurityPolicy 正在被一个新的、简化的 `PodSecurity`
310
312
- {{< example file="policy/restricted-psp.yaml" >}}Restricted{{< /example >}}
311
313
312
314
<!--
313
- 2 . Only bind PSPs to entire namespaces, by using the `system:serviceaccounts:<namespace>` group
315
+ 1 . Only bind PSPs to entire namespaces, by using the `system:serviceaccounts:<namespace>` group
314
316
(where `<namespace>` is the target namespace). For example :
315
317
316
318
` ` ` yaml
@@ -357,7 +359,7 @@ PodSecurityPolicy 正在被一个新的、简化的 `PodSecurity`
357
359
<!--
358
360
# ## Troubleshooting
359
361
360
- - The [Controller Manager ](/docs/reference/command-line-tools-reference/kube-controller-manager/)
362
+ - The [controller manager ](/docs/reference/command-line-tools-reference/kube-controller-manager/)
361
363
must be run against the secured API port and must not have superuser permissions. See
362
364
[Controlling Access to the Kubernetes API](/docs/concepts/security/controlling-access)
363
365
to learn about API server access controls.
@@ -620,9 +622,9 @@ kubectl-user get pod pause -o yaml | grep kubernetes.io/psp
620
622
```
621
623
622
624
<!--
623
- The output is similar to this:
625
+ The output is similar to this
624
626
-->
625
- 输出类似于:
627
+ 输出类似于
626
628
627
629
```
628
630
kubernetes.io/psp: example
@@ -679,18 +681,15 @@ Let's try that again, slightly differently:
679
681
kubectl-user create deployment pause --image=k8s.gcr.io/pause
680
682
```
681
683
682
- 输出为:
683
684
684
- ```
685
+
686
+ ``` none
685
687
deployment "pause" created
686
688
```
687
-
688
689
``` shell
689
690
kubectl-user get pods
690
691
```
691
692
692
- 输出为:
693
-
694
693
```
695
694
No resources found.
696
695
```
@@ -699,7 +698,6 @@ No resources found.
699
698
kubectl-user get events | head -n 2
700
699
```
701
700
702
- 输出为:
703
701
```
704
702
LASTSEEN FIRSTSEEN COUNT NAME KIND SUBOBJECT TYPE REASON SOURCE MESSAGE
705
703
1m 2m 15 pause-7774d79b5 ReplicaSet Warning FailedCreate replicaset-controller Error creating: pods "pause-7774d79b5-" is forbidden: no providers available to validate pod request
@@ -791,9 +789,7 @@ up separately:
791
789
kubectl-admin delete psp example
792
790
```
793
791
794
- 输出类似于:
795
-
796
- ``` none
792
+ ```
797
793
podsecuritypolicy "example" deleted
798
794
```
799
795
@@ -1379,5 +1375,5 @@ Refer to the [Sysctl documentation](/docs/tasks/administer-cluster/sysctl-cluste
1379
1375
1380
1376
- 参阅 [Pod 安全标准](/zh-cn/docs/concepts/security/pod-security-standards/),
1381
1377
了解策略建议。
1382
- - 阅读 [PodSecurityPolicy 参考](/zh-cn/ docs/reference/generated/kubernetes-api/{{< param "version" >}}/#podsecuritypolicy-v1beta1-policy),
1378
+ - 阅读 [PodSecurityPolicy 参考](/docs/reference/generated/kubernetes-api/{{< param "version" >}}/#podsecuritypolicy-v1beta1-policy),
1383
1379
了解 API 细节。
0 commit comments