@@ -736,15 +736,22 @@ for more information.
736
736
737
737
# ## SecurityContextDeny {#securitycontextdeny}
738
738
739
- {{< feature-state for_k8s_version="v1.0 " state="alpha " >}}
739
+ {{< feature-state for_k8s_version="v1.27 " state="deprecated " >}}
740
740
741
741
{{< caution >}}
742
- This admission controller plugin is **outdated** and **incomplete**, it may be
743
- unusable or not do what you would expect. It was originally designed to prevent
744
- the use of some, but not all, security-sensitive fields. Indeed, fields like
745
- ` privileged` , were not filtered at creation and the plugin was not updated with
746
- the most recent fields, and new APIs like the `ephemeralContainers` field for a
747
- Pod.
742
+ The Kubernetes project recommends that you **do not use** the
743
+ ` SecurityContextDeny` admission controller.
744
+
745
+ The `SecurityContextDeny` admission controller plugin is deprecated and disabled
746
+ by default. It will be removed in a future version. If you choose to enable the
747
+ ` SecurityContextDeny` admission controller plugin, you must enable the
748
+ ` SecurityContextDeny` feature gate as well.
749
+
750
+ The `SecurityContextDeny` admission plugin is deprecated because it is outdated
751
+ and incomplete; it may be unusable or not do what you would expect. As
752
+ implemented, this plugin is unable to restrict all security-sensitive attributes
753
+ of the Pod API. For example, the `privileged` and `ephemeralContainers` fields
754
+ were never restricted by this plugin.
748
755
749
756
The [Pod Security Admission](/docs/concepts/security/pod-security-admission/)
750
757
plugin enforcing the [Pod Security Standards](/docs/concepts/security/pod-security-standards/)
0 commit comments