华为云UCS
华为云UCS
- 最新动态
- 服务公告
- 产品介绍
- 计费说明
- 快速入门
-
用户指南
- UCS集群
- 容器舰队
- 集群联邦
- 镜像仓库
- 权限管理
-
策略中心
- 策略中心概述
- 策略定义与策略实例的基本概念
- 启用策略中心
- 创建和管理策略实例
- 示例:使用策略中心实现Kubernetes资源合规性治理
-
使用策略定义库
- 策略定义库概述
- k8spspvolumetypes
- k8spspallowedusers
- k8spspselinuxv2
- k8spspseccomp
- k8spspreadonlyrootfilesystem
- k8spspprocmount
- k8spspprivilegedcontainer
- k8spsphostnetworkingports
- k8spsphostnamespace
- k8spsphostfilesystem
- k8spspfsgroup
- k8spspforbiddensysctls
- k8spspflexvolumes
- k8spspcapabilities
- k8spspapparmor
- k8spspallowprivilegeescalationcontainer
- k8srequiredprobes
- k8srequiredlabels
- k8srequiredannotations
- k8sreplicalimits
- noupdateserviceaccount
- k8simagedigests
- k8sexternalips
- k8sdisallowedtags
- k8sdisallowanonymous
- k8srequiredresources
- k8scontainerratios
- k8scontainerrequests
- k8scontainerlimits
- k8sblockwildcardingress
- k8sblocknodeport
- k8sblockloadbalancer
- k8sblockendpointeditdefaultrole
- k8spspautomountserviceaccounttokenpod
- k8sallowedrepos
- 配置管理
- 服务网格
- 流量分发
- 可观测性
- 云原生服务中心
- 容器迁移
- 流水线
- 错误码
- 最佳实践
- API参考
- 常见问题
- 文档下载
- 通用参考
本文导读
链接复制成功!
noupdateserviceaccount
作用
拒绝白名单外的资源更新ServiceAccount。
策略实例示例
以下策略实例展示了策略定义生效的资源类型,parameters中定义了允许的组列表allowedGroups和允许的用户列表allowedUsers。
# IMPORTANT: Before deploying this policy, make sure you allow-list any groups # or users that need to deploy workloads to kube-system, such as cluster- # lifecycle controllers, addon managers, etc. Such controllers may need to # update service account names during automated rollouts (e.g. of refactored # configurations). You can allow-list them with the allowedGroups and # allowedUsers properties of the NoUpdateServiceAccount Constraint. apiVersion: constraints.gatekeeper.sh/v1beta1 kind: NoUpdateServiceAccount metadata: name: no-update-kube-system-service-account spec: match: namespaces: ["kube-system"] kinds: - apiGroups: [""] kinds: # You can optionally add "Pod" here, but it is unnecessary because # Pod service account immutability is enforced by the Kubernetes API. - "ReplicationController" - apiGroups: ["apps"] kinds: - "ReplicaSet" - "Deployment" - "StatefulSet" - "DaemonSet" - apiGroups: ["batch"] kinds: # You can optionally add "Job" here, but it is unnecessary because # Job service account immutability is enforced by the Kubernetes API. - "CronJob" parameters: allowedGroups: [] allowedUsers: []
符合策略实例的资源定义
没有更新ServiceAccount,符合策略实例。
# Note: The gator tests currently require exactly one object per example file. # Since this is an update-triggered policy, at least two objects are technically # required to demonstrate it. Due to the gator requirement, we only have one # object below. The policy should allow changing everything but the # serviceAccountName field. kind: Deployment apiVersion: apps/v1 metadata: name: policy-test namespace: kube-system labels: app: policy-test spec: replicas: 1 selector: matchLabels: app: policy-test-deploy template: metadata: labels: app: policy-test-deploy spec: # Changing anything except this field should be allowed by the policy. serviceAccountName: policy-test-sa-1 containers: - name: policy-test image: ubuntu command: - /bin/bash - -c - sleep 99999
父主题: 使用策略定义库