From a7ab49a5e396f31c9a27a2d462a592a81b540836 Mon Sep 17 00:00:00 2001 From: Adam Leiner Date: Tue, 21 May 2024 20:32:26 -0400 Subject: [PATCH] updating documentation --- inventory/sample/group_vars/rke2_servers.yml | 1 + sample_files/pod-security-admission-config.yaml | 4 ++++ 2 files changed, 5 insertions(+) diff --git a/inventory/sample/group_vars/rke2_servers.yml b/inventory/sample/group_vars/rke2_servers.yml index c08256c..d451b62 100644 --- a/inventory/sample/group_vars/rke2_servers.yml +++ b/inventory/sample/group_vars/rke2_servers.yml @@ -49,4 +49,5 @@ rke2_config: {} # See https://ranchermanager.docs.rancher.com/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/psa-config-templates#exempting-required-rancher-namespaces # Available in RKE2 1.25+ # Add a pod security admission config file by specifying the file path on the control host +# Requires config.yaml to include `- admission-control-config-file=/etc/rancher/rke2/pod-security-admission-config.yaml` in order for this to be honored # pod_security_admission_config_file_path: "{{ playbook_dir }}/sample_files/pod-security-admission-config.yaml" diff --git a/sample_files/pod-security-admission-config.yaml b/sample_files/pod-security-admission-config.yaml index fbde7fa..280749c 100644 --- a/sample_files/pod-security-admission-config.yaml +++ b/sample_files/pod-security-admission-config.yaml @@ -1,3 +1,7 @@ +#This sample list was generated from: +#https://ranchermanager.docs.rancher.com/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/psa-config-templates#exempting-required-rancher-namespaces +#For security reasons, this list should be as concise as possible - only include active namespaces that need to be except from a restricted profile. + --- apiVersion: apiserver.config.k8s.io/v1 kind: AdmissionConfiguration