istio-psp.yaml

istio-psp.yaml

apiVersion: extensions/v1beta1
kind: PodSecurityPolicy
metadata:
  name: istio-init-psp
spec:
  privileged: true
  allowPrivilegeEscalation: true
  allowedCapabilities:
  - '*'
  volumes:
  - '*'
  fsGroup:
    rule: RunAsAny
  runAsUser:
    rule: RunAsAny
  seLinux:
    rule: RunAsAny
  supplementalGroups:
    rule: RunAsAny
---
apiVersion: rbac.authorization.k8s.io/v1beta1
kind: ClusterRole
metadata:
  name: istio-init-clusterrole
rules:
- apiGroups: ["extensions"]
  resources: ["podsecuritypolicies"]
  resourceNames: ["istio-init-psp"]
  verbs: ["use"]
---
apiVersion: rbac.authorization.k8s.io/v1beta1
kind: ClusterRoleBinding
metadata:
  name: istio-init-rolebinding
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: istio-init-clusterrole
subjects:
  - kind: ServiceAccount
    namespace: istio-system
    name: istio-init-service-account
  - kind: ServiceAccount
    namespace: istio-system
    name: istio-citadel-service-account
  - kind: ServiceAccount
    namespace: istio-system
    name: istio-galley-service-account
  - kind: ServiceAccount
    namespace: istio-system
    name: istio-grafana-post-install-service-account
  - kind: ServiceAccount
    namespace: istio-system
    name: istio-ingressgateway-service-account
  - kind: ServiceAccount
    namespace: istio-system
    name: istio-mixer-service-service-account
  - kind: ServiceAccount
    namespace: istio-system
    name: istio-multi-account
  - kind: ServiceAccount
    namespace: istio-system
    name: istio-pilot-service-account
  - kind: ServiceAccount
    namespace: istio-system
    name: istio-security-post-install-account
  - kind: ServiceAccount
    namespace: istio-system
    name: istio-sidecar-injector-service-account
  - kind: ServiceAccount
    namespace: istio-system
    name: kiali-service-account
  - kind: ServiceAccount
    namespace: istio-system
    name: istio-mixer-service-account
  - kind: ServiceAccount
    namespace: istio-system
    name: istio-grafana-post-install-account
  - kind: ServiceAccount
    namespace: istio-system
    name: istio-cleanup-secrets-service-account
  - kind: ServiceAccount
    namespace: istio-system
    name: prometheus
  - kind: ServiceAccount
    namespace: istio-system
    name: default