检测到您已登录华为云国际站账号，为了您更好的体验，建议您访问国际站服务网站 https://www.huaweicloud.com/intl/zh-cn
不再显示此消息
检测到您已登录华为云国际站账号，为了您更好的体验，建议您访问国际站服务网站 https://www.huaweicloud.com/intl/zh-cn
不再显示此消息
spec: match: kinds: - apiGroups: [""] kinds: ["Pod"] 符合策略实例的资源定义 示例中allowPrivilegeEscalation的值为false，符合策略实例。
- apiGroups: ["extensions", "networking.k8s.io"] kinds: ["Ingress"] 符合策略实例的资源定义 ingress配置的hostname不是空白或通配符类型，符合策略实例。
- apiGroups: [""] kinds: ["Service"] 符合策略实例的资源定义 Servie类型非Nodeport，符合策略实例。
apiVersion: constraints.gatekeeper.sh/v1beta1 kind: K8sPSPProcMount metadata: name: psp-proc-mount spec: match: kinds: - apiGroups
apiVersion: constraints.gatekeeper.sh/v1beta1 kind: K8sExternalIPs metadata: name: external-ips spec: match: kinds: - apiGroups
apiVersion: constraints.gatekeeper.sh/v1beta1 kind: K8sBlockEndpointEditDefaultRole metadata: name: block-endpoint-edit-default-role spec:
若您选择安装kube-prometheus-stack插件，在安装该插件后，需要将Prometheus注册为Metrics API的服务，具体操作请参见通过Metrics API提供资源指标。 自定义指标 安装kube-prometheus-stack。
apiVersion: v1 kind: Pod metadata: name: nginx-disallowed spec: containers: - name: nginx image: nginx 父主题： 使用策略定义库
- apiGroups: [""] kinds: ["Pod"] 符合策略实例的资源定义 示例中hostPID和hostIPC均为false，符合策略实例。
- apiGroups: [""] kinds: ["Pod"] excludedNamespaces: ["kube-system"] 符合策略实例的资源定义 示例中privileged设置为false，符合策略实例。
apiVersion: constraints.gatekeeper.sh/v1beta1 kind: K8sPSPAutomountServiceAccountTokenPod metadata: name: psp-automount-serviceaccount-token-pod
- apiGroups: [""] kinds: ["Pod"] namespaces: - "default" 符合策略实例的资源定义 容器镜像包含digest，符合策略实例。
apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRole metadata: name: karmada-controller-manager:karmada-{clusterName} rules: - apiGroups
apiVersion: constraints.gatekeeper.sh/v1beta1 kind: K8sPSPFlexVolumes metadata: name: psp-flexvolume-drivers spec: match: kinds:
apiVersion: constraints.gatekeeper.sh/v1beta1 kind: K8sPSPAppArmor metadata: name: psp-apparmor spec: match: kinds: - apiGroups
apiVersion: constraints.gatekeeper.sh/v1beta1 kind: K8sDisallowedTags metadata: name: container-image-must-not-have-latest-tag spec: match
apiVersion: constraints.gatekeeper.sh/v1beta1 kind: K8sPSPVolumeTypes metadata: name: psp-volume-types spec: match: kinds: - apiGroups
apiVersion: constraints.gatekeeper.sh/v1beta1 kind: K8sPSPSELinuxV2 metadata: name: psp-selinux-v2 spec: match: kinds: - apiGroups
apiVersion: constraints.gatekeeper.sh/v1beta1 kind: K8sRequiredProbes metadata: name: must-have-probes spec: match: kinds: - apiGroups
apiVersion: constraints.gatekeeper.sh/v1beta1 kind: K8sPSPForbiddenSysctls metadata: name: psp-forbidden-sysctls spec: match: kinds:
长按/截图保存，微信识别二维码
或者关注公众号“华为云”
