Linkerd and Pod Security Policies (PSP)

    To view the definition of the control plane’s Pod Security Policy, run:

    Adjust the value of the above label to match your control plane’s namespace.

    More information on the iptables rules used by the proxy-init init container can be found on the Architecture page.

    If your environment disallows the operation of containers with escalated Linux capabilities, Linkerd can be installed with its , which doesn’t require the NET_ADMIN and NET_RAW capabilities.

    For example, the following Pod Security Policy and RBAC will work with the injected emojivoto demo application:

    1. apiVersion: policy/v1beta1
    2. kind: PodSecurityPolicy
    3. metadata:
    4.   name: linkerd-emojivoto-data-plane
    5. spec:
    6.   allowPrivilegeEscalation: false
    7.   fsGroup:
    8.     ranges:
    9.     - max: 65535
    10.       min: 10001
    11.     rule: MustRunAs
    12.   readOnlyRootFilesystem: true
    13.   allowedCapabilities:
    14.   - NET_ADMIN
    15.   - NET_RAW
    17.   requiredDropCapabilities:
    18.   - ALL
    19.   runAsUser:
    20.     rule: RunAsAny
    21.   seLinux:
    22.     rule: RunAsAny
    23.     ranges:
    24.     - max: 65535
    25.       min: 10001
    26.     rule: MustRunAs
    27.   volumes:
    28.   - configMap
    29.   - emptyDir
    30.   - projected
    31.   - secret
    32.   - downwardAPI
    33.   - persistentVolumeClaim
    34. ---
    36. apiVersion: rbac.authorization.k8s.io/v1
    37. kind: Role
    38. metadata:
    39.   name: emojivoto-psp
    40.   namespace: emojivoto
    41. rules:
    42. - apiGroups: ['policy','extensions']
    43.   resources: ['podsecuritypolicies']
    45. ---
    47. apiVersion: rbac.authorization.k8s.io/v1
    48. kind: RoleBinding
    49. metadata:
    50.   name: emojivoto-psp
    51.   namespace: emojivoto
    52. roleRef:
    53.   apiGroup: rbac.authorization.k8s.io
    54.   kind: Role
    55.   name: emojivoto-psp
    56. subjects:
    57. - kind: ServiceAccount
    58.   name: default
    59.   namespace: emojivoto
    60. - kind: ServiceAccount
    61.   name: emoji
    62.   namespace: emojivoto
    63. - kind: ServiceAccount
    64.   name: voting
    65.   namespace: emojivoto
    66. - kind: ServiceAccount
    67.   namespace: emojivoto

    Note that the Linkerd proxy only requires the NET_ADMIN and NET_RAW capabilities when running without Linkerd CNI, and it’s run with UID 2102.