Menu
Looking into Kubernetes documentation:
Mmmm... aren't eventually they doing the same? What is the difference?
893
A security context defines privilege and access control settings for a Pod or Container. Security context settings include, but are not limited to: Discretionary Access Control: Permission to access an object, like a file, is based on user ID (UID) and group ID (GID).
Security context constraints allow an administrator to control: Whether a pod can run privileged containers with the allowPrivilegedContainer flag. Whether a pod is constrained with the allowPrivilegeEscalation flag. The capabilities that a container can request. The use of host directories as volumes.
The Kubernetes pod security policy admission controller validates pod creation and update requests against a set of rules. By default, Amazon EKS clusters ship with a fully permissive security policy with no restrictions. For more information, see Pod Security Policies in the Kubernetes documentation.
The Red Hat OpenShift Container Platform (OCP) provides pod security policies using SecurityContextConstraints (SCC) resources rather than the PodSecurityPolicies (PSP) like all other Kubernetes platforms. SCCs control the actions that a pod can perform and what it has the ability to access.
I have no idea why folks are down-voting this question, it's spot on and actually we've got our docs to blame and not the OP. OK, here goes:
The pod security context (which is preceded by and largely based on OpenShift Security Context Constraints) allows you (as a developer?) to define runtime restrictions and/or settings on a per-pod basis.
But how do you enforce this? How do you make sure that folks are actually defining the constraints? That's where pod security policies (PSP) come into play: as a cluster or namespace admin you can define and enforce those security context-related policies using PSPs. See also the Kubernetes Security book for more details.
116
If you love us? You can donate to us via Paypal or buy me a coffee so we can maintain and grow! Thank you!
Donate Us With
