OCP K8S Matrix
| COCP | K8S | CoreOS |
|---|---|---|
| 4.10 | 1.23 | RHEL 8.4 |
| 4.11 | 1.24 | RHEL 8.6 |
| 4.12 | 1.25 | RHEL 8.6 |
| 4.13 | 1.26 | RHEL 8.6 |
| … | … | … |
Pod Security Admission
Pod Security Policies are deprecated in K8S 1.21
https://kubernetes.io/docs/concepts/security/pod-security-standards/
https://cloud.redhat.com/blog/pod-security-admission-in-openshift-4.11
New labels added in each namespace
pod-security.kubernetes.io/enforce=privileged
pod-security.kubernetes.io/audit=restricted
pod-security.kubernetes.io/warn=restricted
security.openshift.io/scc.podSecurityLabelSync=true #DefaultSpecs needed for restricted profile
securityContext:
runAsNonRoot: true
seccompProfile:
type: RuntimeDefault
containers:
- name: my-cronjob-container
securityContext:
allowPrivilegeEscalation: false
capabilities:
drop: ['ALL']Dry run apply enforce
$ oc label --dry-run=server --overwrite ns --all pod-security.kubernetes.io/enforce=restricted
Sample kickstart
A simple kickstart for easy deploy