Mastering Kubernetes - Second Edition

Authorizing pod security policies through RBAC

This is the recommended way to enable the use of policies. Let's create clusterRole (Role works too) to grant access to use the target policies. It should look like this:

kind: ClusterRoleapiVersion: rbac.authorization.k8s.io/v1metadata:  name: <role name>rules:- apiGroups: ['policy']  resources: ['podsecuritypolicies']  verbs: ['use']  resourceNames:  - <list of policies to authorize>

Then, we need to bind the cluster role to the authorized users:

kind: ClusterRoleBindingapiVersion: rbac.authorization.k8s.io/v1metadata:  name: <binding name>roleRef:  kind: ClusterRole  name: <role name>  apiGroup: rbac.authorization.k8s.iosubjects:# Authorize specific service accounts:- kind: ServiceAccount name: <authorized ...