diff --git a/content/en/docs/concepts/security/pod-security-standards.md b/content/en/docs/concepts/security/pod-security-standards.md index 724d46e4ea..869f228dfb 100644 --- a/content/en/docs/concepts/security/pod-security-standards.md +++ b/content/en/docs/concepts/security/pod-security-standards.md @@ -326,7 +326,7 @@ fail validation.
Privilege escalation (such as via set-user-ID or set-group-ID file mode) should not be allowed. This is Linux only policy in v1.25+ (spec.os.name != windows)
Privilege escalation (such as via set-user-ID or set-group-ID file mode) should not be allowed. This is Linux only policy in v1.25+ (spec.os.name != windows)
Restricted Fields
spec.containers[*].securityContext.allowPrivilegeEscalation
Restricted Fields
spec.securityContext.runAsUser
spec.containers[*].securityContext.runAsUser
spec.containers[*].securityContext.runAsUser
spec.initContainers[*].securityContext.runAsUser
spec.ephemeralContainers[*].securityContext.runAsUser
Seccomp profile must be explicitly set to one of the allowed values. Both the Unconfined
profile and the absence of a profile are prohibited. This is Linux only policy in v1.25+ (spec.os.name != windows)
Seccomp profile must be explicitly set to one of the allowed values. Both the Unconfined
profile and the absence of a profile are prohibited. This is Linux only policy in v1.25+ (spec.os.name != windows)
Restricted Fields
spec.securityContext.seccompProfile.type
Containers must drop ALL
capabilities, and are only permitted to add back
- the NET_BIND_SERVICE
capability. This is Linux only policy in v1.25+ (.spec.os.name != "windows")
+ the NET_BIND_SERVICE
capability. This is Linux only policy in v1.25+ (.spec.os.name != "windows")
Restricted Fields