@@ -455,28 +455,24 @@ for more information.
455
455
456
456
Example: ` pod-security.kubernetes.io/exempt: namespace `
457
457
458
- Used on: ` audit.k8s.io/Event `
459
-
460
458
Value ** must** be one of ` user ` , ` namespace ` , or ` runtimeClass ` which correspond to
461
459
[ Pod Security Exemption] ( /docs/concepts/security/pod-security-admission/#exemptions )
462
460
dimensions. This annotation indicates on which dimension was based the exemption
463
461
from the PodSecurity enforcement.
464
462
465
- {{< caution >}}
463
+ {{< note >}}
466
464
This annotation is not used within the Kubernetes API. When you
467
465
[ enable auditing] ( /docs/tasks/debug-application-cluster/audit/ ) in your cluster,
468
466
audit event data is written using ` Event ` from API group ` audit.k8s.io ` .
469
467
The annotation applies to audit events. Audit events are different from objects in the
470
468
[ Event API] ( /docs/reference/kubernetes-api/cluster-resources/event-v1/ ) (API group
471
469
` events.k8s.io ` ).
472
- {{< /caution >}}
470
+ {{< /note >}}
473
471
474
472
## pod-security.kubernetes.io/enforce-policy
475
473
476
474
Example: ` pod-security.kubernetes.io/enforce-policy: restricted:latest `
477
475
478
- Used on: ` audit.k8s.io/Event `
479
-
480
476
Value ** must** be ` privileged:<version> ` , ` baseline:<version> ` ,
481
477
` restricted:<version> ` which correspond to [ Pod Security
482
478
Standard] ( /docs/concepts/security/pod-security-standards ) levels accompanied by
@@ -487,23 +483,21 @@ allowed or denied the pod during PodSecurity admission.
487
483
See [ Pod Security Standards] ( /docs/concepts/security/pod-security-standards/ )
488
484
for more information.
489
485
490
- {{< caution >}}
486
+ {{< note >}}
491
487
This annotation is not used within the Kubernetes API. When you
492
488
[ enable auditing] ( /docs/tasks/debug-application-cluster/audit/ ) in your cluster,
493
489
audit event data is written using ` Event ` from API group ` audit.k8s.io ` .
494
490
The annotation applies to audit events. Audit events are different from objects in the
495
491
[ Event API] ( /docs/reference/kubernetes-api/cluster-resources/event-v1/ ) (API group
496
492
` events.k8s.io ` ).
497
- {{< /caution >}}
493
+ {{< /note >}}
498
494
499
495
## pod-security.kubernetes.io/audit-violations
500
496
501
497
Example: `pod-security.kubernetes.io/audit-violations: would violate
502
498
PodSecurity "restricted: latest ": allowPrivilegeEscalation != false (container
503
499
"example" must set securityContext.allowPrivilegeEscalation=false), ...`
504
500
505
- Used on: ` audit.k8s.io/Event `
506
-
507
501
Value details an audit policy violation, it contains the
508
502
[ Pod Security Standard] ( /docs/concepts/security/pod-security-standards/ ) level
509
503
that was transgressed as well as the specific policies on the fields that were
@@ -512,14 +506,14 @@ violated from the PodSecurity enforcement.
512
506
See [ Pod Security Standards] ( /docs/concepts/security/pod-security-standards/ )
513
507
for more information.
514
508
515
- {{< caution >}}
509
+ {{< note >}}
516
510
This annotation is not used within the Kubernetes API. When you
517
511
[ enable auditing] ( /docs/tasks/debug-application-cluster/audit/ ) in your cluster,
518
512
audit event data is written using ` Event ` from API group ` audit.k8s.io ` .
519
513
The annotation applies to audit events. Audit events are different from objects in the
520
514
[ Event API] ( /docs/reference/kubernetes-api/cluster-resources/event-v1/ ) (API group
521
515
` events.k8s.io ` ).
522
- {{< /caution >}}
516
+ {{< /note >}}
523
517
524
518
## seccomp.security.alpha.kubernetes.io/pod (deprecated) {#seccomp-security-alpha-kubernetes-io-pod}
525
519
0 commit comments