kubernetes/plugin
Kubernetes Submit Queue fb994df7e0 Merge pull request #51337 from php-coder/psp_star_in_allowed_caps
Automatic merge from submit-queue (batch tested with PRs 51337, 47080, 52646, 52635, 52666). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>..

PodSecurityPolicy.allowedCapabilities: add support for * to allow to request any capabilities

**What this PR does / why we need it**:
Prior this change there was no way to allow to pods to request any capabilities. Cluster admin had always specify a full list of capabilities explicitly. Because there are many of them, it gets tedious. This PR makes possible to use `*` to allow all possible capabilities. Non-paranoid (and lazy) cluster admins can use it. Those who are super strict and paranoid of course won't use it because `*` allows capabilities that don't exist today but may be introduced in the future.

"privileged" PSP in examples was modified to allow privileged users to use this feature.

**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: fixes #50055

**Special notes for your reviewer**:
This functional is already present in OpenShift: https://github.com/openshift/origin/pull/12875 and https://github.com/openshift/origin/pull/15135

**Release note**:
```release-note
PSP: add support for using `*` as a value in `allowedCapabilities` to allow to request any capabilities
```

CC @simo5 @pweil- @gyliu513 @liqlin2015
2017-09-19 17:31:04 -07:00
..
cmd/kube-scheduler Add bsalamat to sig-scheduling-maintainers 2017-09-11 11:10:57 -07:00
pkg Merge pull request #51337 from php-coder/psp_star_in_allowed_caps 2017-09-19 17:31:04 -07:00
BUILD Update generated files - api, bazel, json 2017-09-04 09:02:35 +02:00
OWNERS Updated top level owners file to match new format 2017-01-19 11:29:16 -08:00