# k8spspallowedusers
#### 基本信息
- 策略类型：安全
- 推荐级别：L3
- 生效资源类型：Pod
- 参数：
  ```
  exemptImages: 字符串数组
  runAsUser:
    rule: 字符串
    ranges:
      - min: 整型
        max: 整型
  runAsGroup:
    rule: 字符串
    ranges:
      - min: 整型
        max: 整型
  supplementalGroups:
    rule: 字符串
    ranges:
      - min: 整型
        max: 整型
  fsGroup:
    rule: 字符串
    ranges:
      - min: 整型
        max: 整型
  ```
  
 
#### 作用
约束PodSecurityPolicy中的runAsUser、runAsGroup、supplementalGroups和fsGroup字段。
#### 策略实例示例
以下策略实例展示了策略定义生效的资源类型，parameters中定义了对runAsUser、runAsGroup、supplementalGroups和fsGroup等字段的约束。
```
apiVersion: constraints.gatekeeper.sh/v1beta1
kind: K8sPSPAllowedUsers
metadata:
  name: psp-pods-allowed-user-ranges
spec:
  match:
    kinds:
      - apiGroups: [""]
        kinds: ["Pod"]
  parameters:
    runAsUser:
      rule: MustRunAs # MustRunAsNonRoot # RunAsAny 
      ranges:
        - min: 100
          max: 200
    runAsGroup:
      rule: MustRunAs # MayRunAs # RunAsAny 
      ranges:
        - min: 100
          max: 200
    supplementalGroups:
      rule: MustRunAs # MayRunAs # RunAsAny 
      ranges:
        - min: 100
          max: 200
    fsGroup:
      rule: MustRunAs # MayRunAs # RunAsAny 
      ranges:
        - min: 100
          max: 200
```
#### 符合策略实例的资源定义
示例中runAsUser等参数均在范围内，符合策略实例。
```
apiVersion: v1
kind: Pod
metadata:
  name: nginx-users-allowed
  labels:
    app: nginx-users
spec:
  securityContext:
    supplementalGroups:
      - 199
    fsGroup: 199
  containers:
    - name: nginx
      image: nginx
      securityContext:
        runAsUser: 199
        runAsGroup: 199
```
#### 不符合策略实例的资源定义
示例中runAsUser等参数不在范围内，不符合策略实例。
```
apiVersion: v1
kind: Pod
metadata:
  name: nginx-users-disallowed
  labels:
    app: nginx-users
spec:
  securityContext:
    supplementalGroups:
      - 250
    fsGroup: 250
  containers:
    - name: nginx
      image: nginx
      securityContext:
        runAsUser: 250
        runAsGroup: 250
```