更新时间:2024-02-01 GMT+08:00
k8spspautomountserviceaccounttokenpod
基本信息
- 策略类型:合规
- 推荐级别:L1
- 生效资源类型:Pod
- 参数:无
作用
约束容器不能设置automountServiceAccountToken为true。
策略实例示例
示例声明了match匹配的对象不能把automountServiceAccountToken字段设为true。
apiVersion: constraints.gatekeeper.sh/v1beta1 kind: K8sPSPAutomountServiceAccountTokenPod metadata: name: psp-automount-serviceaccount-token-pod spec: match: kinds: - apiGroups: [""] kinds: ["Pod"] excludedNamespaces: ["kube-system"]
符合策略实例的资源定义
Pod的automountServiceAccountToken字段设为false,符合策略实例。
apiVersion: v1 kind: Pod metadata: name: nginx-automountserviceaccounttoken-allowed labels: app: nginx-not-automountserviceaccounttoken spec: automountServiceAccountToken: false containers: - name: nginx image: nginx
不符合策略实例的资源定义
Pod的automountServiceAccountToken字段设为true,不符合策略实例。
apiVersion: v1 kind: Pod metadata: name: nginx-automountserviceaccounttoken-disallowed labels: app: nginx-automountserviceaccounttoken spec: automountServiceAccountToken: true containers: - name: nginx image: nginx
父主题: 使用策略定义库