Add PSP for longhorn-uninstall
+apiVersion: policy/v1beta1
+kind: PodSecurityPolicy
+metadata:
+ name: longhorn-uninstall-psp
+spec:
+ privileged: true
+ allowPrivilegeEscalation: true
+ requiredDropCapabilities:
+ - NET_RAW
+ allowedCapabilities:
+ - SYS_ADMIN
+ hostNetwork: false
+ hostIPC: false
+ hostPID: true
+ runAsUser:
+ rule: RunAsAny
+ seLinux:
+ rule: RunAsAny
+ fsGroup:
+ rule: RunAsAny
+ supplementalGroups:
+ rule: RunAsAny
+ volumes:
+ - configMap
+ - downwardAPI
+ - emptyDir
+ - secret
+ - projected
+ - hostPath
+---
apiVersion: v1
kind: ServiceAccount
metadata:
@@ -39,6 +69,10 @@ rules:
- apiGroups: ["coordination.k8s.io"]
resources: ["leases"]
verbs: ["*"]
+ - apiGroups: ["policy"]
+ resources: ["podsecuritypolicies"]
+ verbs: ["use"]
+ resourceNames: ["longhorn-uninstall-psp"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
