https://rancher.com/ logo
Join Slack
Powered by
This message was deleted.
# k3s
a
This message was deleted.
e
tried ☝️ but it doesn’t seem it worked…
I’ve tried this:
Copy code
apiVersion: <http://apiserver.config.k8s.io/v1|apiserver.config.k8s.io/v1>
kind: AdmissionConfiguration
plugins:
- name: PodSecurity
  configuration:
    apiVersion: <http://pod-security.admission.config.k8s.io/v1beta1|pod-security.admission.config.k8s.io/v1beta1>
    kind: PodSecurityConfiguration
    defaults:
      enforce: "privileged"
      enforce-version: "latest"
      audit: "privileged"
      audit-version: "latest"
      warn: "privileged"
      warn-version: "latest"
    exemptions:
      usernames: []
      runtimeClasses: []
      namespaces: []
n
Not working in what way? Setting all levels to "privileged" is the equivalent of not setting any kind of PSA.
e
yeah exactly, that is what I was expecting but i still have pods having issues due to permissions
on rke2 clusters I just added 
defaultPodSecurityAdmissionConfigurationTemplateName: rancher-privileged
and that worked
but for k3s standalone I don’t see how to set it up
n
You could just not set up any PSAs
Or was this a stepping stone to adding more restrictive PSAs later?
e
nope, I want to disable it I am using kyverno for managing policies
so I wan’t to disable PSA if that’s possible or set it to privileged to not block anything on pod security level
n
If you don't want PSAs on k3s standalone, just don't pass the 
--kube-apiserver-arg="admission-control-config-file=/var/lib/rancher/k3s/server/psa.yaml"
argument on startup
By default standalone K3s has no PSAs installed
e
oh… ok, then I might have some other issue because I didn’t have initially 
--kube-apiserver-arg="admission-control-config-file=/var/lib/rancher/k3s/server/psa.yaml"
I’ve added it to try to force 
privileged
because I was assuming that k3s does 
restricted
by default
which case I was looking in wrong direction
n
Ah no, K3s is not secure or hardened by default
e
👍 thanks, then my problem is somewhere else.
n
Just to complete the thought, standalone RKE2 does have default policies depending on the 
cis
flag, you can find info about that here: https://docs.rke2.io/security/pod_security_standards
e
oh yeah I am aware of this, thanks for sharing 👍
👍 1
12 Views
Open in Slack
PreviousNext
Powered by