Continental Innovates with Rancher and Kubernetes
Pod Security Policies (or PSPs) are objects that control security-sensitive aspects of pod specification (like root privileges).
If a pod does not meet the conditions specified in the PSP, Kubernetes will not allow it to start, and Rancher will display an error message of Pod <NAME> is forbidden: unable to validate....
Pod <NAME> is forbidden: unable to validate...
You can assign PSPs at the cluster or project level.
PSPs work through inheritance:
Any workloads that are already running in a cluster or project before a PSP is assigned will not be checked if it complies with the PSP. Workloads would need to be cloned or upgraded to see if they pass the PSP.
Read more about Pod Security Policies in the Kubernetes Documentation.
Available as of v2.0.7
Rancher ships with two default Pod Security Policies (PSPs): the restricted and unrestricted policies.
This policy is based on the Kubernetes example restricted policy. It significantly restricts what types of pods can be deployed to a cluster or project. This policy:
This policy is equivalent to running Kubernetes with the PSP controller disabled. It has no restrictions on what pods can be deployed into a cluster or project.
Using Rancher, you can create a Pod Security Policy using our GUI rather than creating a YAML file.
Rancher can only assign PSPs for clusters that are launched using RKE.
You must enable PSPs at the cluster level before you can assign them to a project. This can be configured by editing the cluster.
It is a best practice to set PSP at the cluster level.
We recommend adding PSPs during cluster and project creation instead of adding it to an existing one.
From the Global view, select Security > Pod Security Policies from the main menu. Then click Add Policy.
Step Result: The Add Policy form opens.
Name the policy.
Complete each section of the form. Refer to the Kubernetes documentation for more information on what each policy does.
The Kubernetes documentation on PSPs is here.