Skip to content

Commit 56b6ec6

Browse files
authored
Update README.MD
1 parent 3ff70c6 commit 56b6ec6

File tree

1 file changed

+4
-5
lines changed

1 file changed

+4
-5
lines changed

README.MD

Lines changed: 4 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -20,8 +20,8 @@ The plugin will be available as `kubectl advise-psp`.
2020
- 2.1 ```./kube-psp-advisor inspect --report``` to print the details reports (why this PSP is recommended for the cluster)
2121
- 2.2 ```./kube-psp-advisor inspect --grant``` to print PSPs, roles and rolebindings for service accounts (refer to [psp-grant.yaml](./test-yaml/psp-grant.yaml))
2222
- 2.3 ```./kube-psp-advisor inspect --namespace=<ns>``` to print report or PSP(s) within a given namespace (default to all)
23-
- 2.4 ```./kube-psp-advisor inspect --opa``` to generate OPA Policy based on running cluster configuration
24-
- 2.5 ```./kube-psp-advisor inspect --opa --deny-by-default``` to generate an OPA Policy, where OPA Default Rule is Deny ALL
23+
- 2.4 ```./kube-psp-advisor inspect --policy opa``` to generate OPA Policy based on running cluster configuration
24+
- 2.5 ```./kube-psp-advisor inspect --policy opa --deny-by-default``` to generate an OPA Policy, where OPA Default Rule is Deny ALL
2525
4. ```./kube-psp-advisor convert --podFile <path> --pspFile <path>``` to generate a PSP from a single .yaml file.
2626
- 4.1 ```./kube-psp-advisor convert --podFile <path> --pspFile <path> --opa``` to generate an OPA Policy from a single .yaml file.
2727
- 4.2 ```./kube-psp-advisor convert --podFile <path> --pspFile <path> --opa --deny-by-default``` to generate an OPA Policy from a single .yaml file, where OPA Default Rule is Deny ALL.
@@ -32,9 +32,8 @@ The plugin will be available as `kubectl advise-psp`.
3232

3333
## Use Cases
3434
1. Help verify the deployment, daemonset settings in cluster and plan to reduce unnecessary privileges/resources
35-
2. Apply Pod Security Policy to the target cluster
36-
3. Apply OPA Policy to the target cluster
37-
3. flag `--namespace=<namespace>` is introduced to debug and narrow down the security context per namespace
35+
2. Apply Pod Security Policy or OPA policy to the target cluster
36+
3. Using flag `--namespace=<namespace>` with `--report` to debug and narrow down the security context per namespace
3837

3938
## Attributes Aggregated for Pod Security Policy
4039
- allowPrivilegeEscalation

0 commit comments

Comments
 (0)