specify runAsGroup, allow safe sysctls by default (#7399)

kubernetes-sigs · Mar 25, 2021 · 7dec8e5 · 7dec8e5
1 parent 49abf60
commit 7dec8e5
Showing 1 changed file with 7 additions and 2 deletions.
diff --git a/roles/kubernetes-apps/cluster_roles/defaults/main.yml b/roles/kubernetes-apps/cluster_roles/defaults/main.yml
@@ -19,6 +19,11 @@ podsecuritypolicy_restricted_spec:
     rule: 'MustRunAsNonRoot'
   seLinux:
     rule: 'RunAsAny'
+  runAsGroup:
+    rule: 'MustRunAs'
+    ranges:
+      - min: 1
+        max: 65535
   supplementalGroups:
     rule: 'MustRunAs'
     ranges:
@@ -30,8 +35,6 @@ podsecuritypolicy_restricted_spec:
       - min: 1
         max: 65535
   readOnlyRootFilesystem: false
-  forbiddenSysctls:
-    - '*'
 
 podsecuritypolicy_privileged_spec:
   privileged: true
@@ -50,6 +53,8 @@ podsecuritypolicy_privileged_spec:
     rule: 'RunAsAny'
   seLinux:
     rule: 'RunAsAny'
+  runAsGroup:
+    rule: 'RunAsAny'
   supplementalGroups:
     rule: 'RunAsAny'
   fsGroup: