Shazad Brohi shazadbrohi

shazadbrohi / restricted-psp-rbac.yaml

Last active November 4, 2020 07:56

A set of RBAC resources to enforce the restricted psp across all service accounts

	apiVersion: rbac.authorization.k8s.io/v1
	kind: ClusterRole
	metadata:
	name: restricted-cluster-role
	rules:
	- apiGroups:
	- policy
	resourceNames:
	- restricted-psp
	resources:

shazadbrohi / restricted-psp.yaml

Last active November 4, 2020 07:53

A restricted pod security policy

	apiVersion: policy/v1beta1
	kind: PodSecurityPolicy
	metadata:
	name: my-restricted-psp
	spec:
	privileged: false
	# Required to prevent escalations to root.
	allowPrivilegeEscalation: false
	# Allow core volume types.
	volumes: