k8spspprocmount

Basic Information

• Policy type: security
• Recommended level: L3
• Effective resource type: Pod
• Parameter

  exemptImages: String array

  procMount: String

Function

This policy restricts the allowedProcMountTypes field in PodSecurityPolicy.

Policy Example

The following policy instance shows the resource types for which the policy definition takes effect. In parameters, the value of procMount is set to Default.

apiVersion: constraints.gatekeeper.sh/v1beta1
kind: K8sPSPProcMount
metadata:
  name: psp-proc-mount
spec:
  match:
    kinds:
      - apiGroups: [""]
        kinds: ["Pod"]
  parameters:
    procMount: Default

Resource Definition That Complies with the Policy

In the example, procMount in the securityContext field is Default, which complies with the policy instance.

apiVersion: v1
kind: Pod
metadata:
  name: nginx-proc-mount-disallowed
  labels:
    app: nginx-proc-mount
spec:
  containers:
  - name: nginx
    image: nginx
    securityContext:
      procMount: Default

Resource Definition That Does Not Comply with the Policy

In the example, the value of procMount in the securityContext field is Unmasked, which does not comply with the policy instance.

apiVersion: v1
kind: Pod
metadata:
  name: nginx-proc-mount-disallowed
  labels:
    app: nginx-proc-mount
spec:
  containers:
  - name: nginx
    image: nginx
    securityContext:
      procMount: Unmasked