tree 69a7d9ce2d531c763d482e340afe5ceced40c068
parent c5e0dbd3437d5c739d42d7724a619b126eabdbf5
author Leopold Schabel <leo@monogon.tech> 1721827406 +0000
committer Leopold Schabel <leo@monogon.tech> 1721908972 +0000

metropolis/node/kubernetes: allow privileged pods

There are valid use cases for privileged pods in low-assurance clusters.
In particular, "kubectl debug node/... --profile=sysadmin" is very
useful for debugging and requires privileged pods.

In a production cluster, we'd want to restrict privileged pods
and other dangerous capabilities (which are already allowed)
using pod security or more sophisticated admission controllers,
including enforcing future cluster integrity policy levels.

Change-Id: I8f6470f636cdd13b7c980f04f08f95aaff833b20
Reviewed-on: https://review.monogon.dev/c/monogon/+/3246
Reviewed-by: Lorenz Brun <lorenz@monogon.tech>
Tested-by: Jenkins CI