Skip to content

Commit c9640eb

Browse files
author
Tim Bannister
committed
Make it clear that PSA example Pods do start OK
The reader sees a warning, but the Pods do run. That detail might not be obvious otherwise.
1 parent a39ee49 commit c9640eb

File tree

2 files changed

+2
-2
lines changed

2 files changed

+2
-2
lines changed

content/en/docs/tutorials/security/cluster-level-pss.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -295,7 +295,7 @@ following:
295295
kubectl apply -f https://k8s.io/examples/security/example-baseline-pod.yaml
296296
```
297297

298-
The output is similar to this:
298+
The pod is started normally, but the output includes a warning:
299299
```
300300
Warning: would violate PodSecurity "restricted:latest": allowPrivilegeEscalation != false (container "nginx" must set securityContext.allowPrivilegeEscalation=false), unrestricted capabilities (container "nginx" must set securityContext.capabilities.drop=["ALL"]), runAsNonRoot != true (pod or container "nginx" must set securityContext.runAsNonRoot=true), seccompProfile (pod or container "nginx" must set securityContext.seccompProfile.type to "RuntimeDefault" or "Localhost")
301301
pod/nginx created

content/en/docs/tutorials/security/ns-level-pss.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -115,7 +115,7 @@ namespace/example created
115115
```shell
116116
kubectl apply -n example -f https://k8s.io/examples/security/example-baseline-pod.yaml
117117
```
118-
The output is similar to this:
118+
The Pod does start OK; the output includes a warning. For example:
119119

120120
```
121121
Warning: would violate PodSecurity "restricted:latest": allowPrivilegeEscalation != false (container "nginx" must set securityContext.allowPrivilegeEscalation=false), unrestricted capabilities (container "nginx" must set securityContext.capabilities.drop=["ALL"]), runAsNonRoot != true (pod or container "nginx" must set securityContext.runAsNonRoot=true), seccompProfile (pod or container "nginx" must set securityContext.seccompProfile.type to "RuntimeDefault" or "Localhost")

0 commit comments

Comments
 (0)