docs: follow rrpo requirements #4

Signed-off-by: Pavel Tishkov <[email protected]>
deckhouse · Aug 14, 2024 · 32bc39b · 32bc39b
1 parent 7797521
commit 32bc39b
Show file tree

Hide file tree

Showing 2 changed files with 3 additions and 225 deletions.
diff --git a/docs/FAQ.md b/docs/FAQ.md
@@ -232,112 +232,3 @@ spec:
     - kind: VirtualDisk
       name: win-disk
 ```
-
-## Using virtualization in conjunction with the Admission-policy-engine module
-
-Before starting, it is recommended to familiarize yourself with the settings of the [Admission-policy-engine](https://deckhouse.ru/documentation/v1/modules/015-admission-policy-engine/) module.  
-When setting up security policies, it is recommended to follow the security policies that are installed in your company.
-
-Let's look at the example of the enabled Baseline policy.  
-Since Baseline does not allow the Pod of a virtual machine to run by default due to the elevated privileges required for the correct operation of the virtual machine, you will need to manually configure the namespaces in which they will run.
-
-1. Exclusion of the namespace from the Baseline policy.  
-```yaml
-apiVersion: v1
-kind: Namespace
-metadata:
-  labels:
-    kubernetes.io/metadata.name: <namespace>
-    security.deckhouse.io/pod-policy: privileged
-  name: <namespace>
-spec:
-  finalizers:
-  - kubernetes
-```
-2. Setting up a new security policy.  
-This policy is based on Baseline and allows you to run virtual machines in a given namespace.
-```yaml
----
-apiVersion: deckhouse.io/v1alpha1
-kind: SecurityPolicy
-metadata:
-  name: virt-launcher-deny
-spec:
-  enforcementAction: Deny
-  match:
-    namespaceSelector:
-      labelSelector:
-        matchLabels:
-          kubernetes.io/metadata.name: <namespace>
-    labelSelector:
-      matchLabels:
-        kubevirt.internal.virtualization.deckhouse.io: virt-launcher
-  policies:
-    allowPrivilegeEscalation: true
-    allowedCapabilities:
-      - NET_BIND_SERVICE
-      - SYS_NICE
-    runAsUser:
-      ranges:
-        - max: 0
-          min: 0
-      rule: MustRunAs
----
-apiVersion: deckhouse.io/v1alpha1
-kind: SecurityPolicy
-metadata:
-  name: other-deny
-spec:
-  enforcementAction: Deny
-  match:
-    namespaceSelector:
-      labelSelector:
-        matchLabels:
-          kubernetes.io/metadata.name: <namespace>
-    labelSelector:
-      matchExpressions:
-        - key: kubevirt.internal.virtualization.deckhouse.io
-          operator: NotIn
-          values:
-            - virt-launcher
-  policies:
-    allowedCapabilities:
-      - AUDIT_WRITE
-      - CHOWN
-      - DAC_OVERRIDE
-      - FOWNER
-      - FSETID
-      - KILL
-      - MKNOD
-      - NET_BIND_SERVICE
-      - SETFCAP
-      - SETGID
-      - SETPCAP
-      - SETUID
-      - SYS_CHROOT
-    allowedProcMount: Default
-    seccompProfiles:
-      allowedProfiles:
-        - RuntimeDefault
-        - Localhost
-        - ""
-        - undefined
-      allowedLocalhostFiles:
-        - '*'
-    allowedUnsafeSysctls:
-      - kernel.shm_rmid_forced
-      - net.ipv4.ip_local_port_range
-      - net.ipv4.ip_unprivileged_port_start
-      - net.ipv4.tcp_syncookies
-      - net.ipv4.ping_group_range
-    allowHostNetwork: false
-    allowPrivileged: false
-    allowPrivilegeEscalation: false
-    seLinux:
-      - type: container_t
-      - type: container_init_t
-      - type: container_kvm_t
-      - level: s0
-    runAsUser:
-      rule: MustRunAsNonRoot
-```
diff --git a/docs/FAQ.ru.md b/docs/FAQ.ru.md
@@ -134,7 +134,7 @@ docker push docker.io/username/image:latest
 1. Для этого создайте сервис с требуемыми настройками.
 
    В качестве примера приведена виртуальная машина с HTTP-сервисом, опубликованным на порте 80, и следующим набором меток:
-   
+
    ```yaml
    apiVersion: virtualization.deckhouse.io/v1alpha2
    kind: VirtualMachine
@@ -205,7 +205,7 @@ docker push docker.io/username/image:latest
    ```shell
    kubectl patch mc virtualization \
      --type merge -p '{"spec": {"settings": {"dvcr": {"storage": {"persistentVolumeClaim": {"size":"59G"}}}}}}'
-   
+
    #Output
    moduleconfig.deckhouse.io/virtualization patched
    ```
@@ -216,7 +216,7 @@ docker push docker.io/username/image:latest
    kubectl get mc virtualization -o jsonpath='{.spec.settings.dvcr.storage.persistentVolumeClaim}'
    #Output
    {"size":"59G","storageClass":"linstor-thick-data-r1"}
-   
+
    kubectl get pvc dvcr -n d8-virtualization
    #Output
    NAME   STATUS   VOLUME                                     CAPACITY     ACCESS MODES   STORAGECLASS            AGE
@@ -274,116 +274,3 @@ spec:
     - kind: VirtualDisk
       name: win-disk
 ```
-
-## Использование виртуализации совместно с модулем Admission-policy-engine
-
-Для начала рекомендуется ознакомиться с настройками модуля [Admission-policy-engine](https://deckhouse.ru/documentation/v1/modules/015-admission-policy-engine/).  
-При настройке политик безопасности рекомендуется руководствоваться политиками безопасности, которые установленны в вашей компании.
-
-Рассмотрим на примере включенной политики Baseline.
-
-Так как Baseline не позволяет по умолчанию запускать Pod виртуальной машины из-за повышенных привилегий, необходимых для корректной работы виртуальной машины, то потребуется вручную настроить пространства имён, в которых они будут запускаться.
-
-- Исключение пространства имён из политики Baseline.
-
-  ```yaml
-  apiVersion: v1
-  kind: Namespace
-  metadata:
-    labels:
-      kubernetes.io/metadata.name: <название пространства имён>
-      security.deckhouse.io/pod-policy: privileged
-    name: <название пространства имён>
-  spec:
-    finalizers:
-    - kubernetes
-  ```
-
-- Настройка новой политики безопасности.  
-
-  Эта политика основана на Baseline и позволяет запускать виртуальные машины в заданном прострастве имён.
-
-  ```yaml
-  apiVersion: deckhouse.io/v1alpha1
-  kind: SecurityPolicy
-  metadata:
-    name: virt-launcher-deny
-  spec:
-    enforcementAction: Deny
-    match:
-      namespaceSelector:
-        labelSelector:
-          matchLabels:
-            kubernetes.io/metadata.name: <название пространства имён>
-      labelSelector:
-        matchLabels:
-          kubevirt.internal.virtualization.deckhouse.io: virt-launcher
-    policies:
-      allowPrivilegeEscalation: true
-      allowedCapabilities:
-        - NET_BIND_SERVICE
-        - SYS_NICE
-      runAsUser:
-        ranges:
-          - max: 0
-            min: 0
-        rule: MustRunAs
-  ---
-  apiVersion: deckhouse.io/v1alpha1
-  kind: SecurityPolicy
-  metadata:
-    name: other-deny
-  spec:
-    enforcementAction: Deny
-    match:
-      namespaceSelector:
-        labelSelector:
-          matchLabels:
-            kubernetes.io/metadata.name: <название пространства имён>
-      labelSelector:
-        matchExpressions:
-          - key: kubevirt.internal.virtualization.deckhouse.io
-            operator: NotIn
-            values:
-              - virt-launcher
-    policies:
-      allowedCapabilities:
-        - AUDIT_WRITE
-        - CHOWN
-        - DAC_OVERRIDE
-        - FOWNER
-        - FSETID
-        - KILL
-        - MKNOD
-        - NET_BIND_SERVICE
-        - SETFCAP
-        - SETGID
-        - SETPCAP
-        - SETUID
-        - SYS_CHROOT
-      allowedProcMount: Default
-      seccompProfiles:
-        allowedProfiles:
-          - RuntimeDefault
-          - Localhost
-          - ""
-          - undefined
-        allowedLocalhostFiles:
-          - '*'
-      allowedUnsafeSysctls:
-        - kernel.shm_rmid_forced
-        - net.ipv4.ip_local_port_range
-        - net.ipv4.ip_unprivileged_port_start
-        - net.ipv4.tcp_syncookies
-        - net.ipv4.ping_group_range
-      allowHostNetwork: false
-      allowPrivileged: false
-      allowPrivilegeEscalation: false
-      seLinux:
-        - type: container_t
-        - type: container_init_t
-        - type: container_kvm_t
-        - level: s0
-      runAsUser:
-        rule: MustRunAsNonRoot
-  ```