GetBoostrapSCCAccess provides the default set of access that should be passed to GetBootstrapSecurityContextConstraints.

GetBootstrapSecurityContextConstraints returns the slice of default SecurityContextConstraints for system bootstrapping.

Roles.

groups.

groups.

RoleBindings.

Roles.

users.

RoleBindings.

Roles.

RoleBindings.

Roles.

RoleBindings.

Roles.

RoleBindings.

Roles.

groups.

RoleBindings.

Roles.

Roles.

groups.

RoleBindings.

Roles.

known namespaces.

known namespaces.

users.

RoleBindings.

Roles.

users.

DescriptionAnnotation is the annotation used for attaching descriptions.

RoleBindings.

Roles.

Roles.

Roles.

RoleBindings.

Roles.

Roles.

RoleBindings.

Roles.

Roles.

Roles.

Previous versions used this as the username for the master to connect to the kubelet This should remain in the default role bindings for the NodeAdmin role.

users.

Not granted any API permissions, just an identity for a client certificate for the API proxy to use Should not be changed without considering impact to pods that may be verifying this identity by default.

users.

RoleBindings.

Roles.

groups.

users.

users.

RoleBindings.

NodeAdmin has full access to the API provided by the kubelet.

groups.

RoleBindings.

Roles.

RoleBindings.

NodeReader has read access to the metrics and stats provided by the kubelet.

groups.

RoleBindings.

Roles.

groups.

RoleBindings.

Roles.

RoleBindings.

Roles.

Roles.

RoleBindings.

Roles.

RoleBindings.

Roles.

RoleBindings.

Roles.

RoleBindings.

Roles.

RoleBindings.

Roles.

RoleBindings.

Roles.

RoleBindings.

Roles.

SecurityContextConstraintHostMountAndAnyUID is used as the name for the system default host mount + any UID scc.

SecurityContextConstraintHostNS is used as the name for the system default scc that grants access to all host ns features.

SecurityContextConstraintNonRoot is used as the name for the system default non-root scc.

SecurityContextConstraintPrivileged is used as the name for the system default privileged scc.

SecurityContextConstraintRestricted is used as the name for the system default restricted scc.

SecurityContextConstraintsAnyUID is used as the name for the system default scc that grants access to run as any uid but is still restricted to specific SELinux contexts.

SecurityContextConstraintsHostNetwork is used as the name for the system default scc that grants access to run with host networking and host ports but still allocates uid/gids/selinux from the namespace.

RoleBindings.

Roles.

RoleBindings.

Roles.

RoleBindings.

Roles.

Roles.

Roles.

users.

Roles.

groups.

groups.

Roles.

RoleBindings.

Roles.