The PodSecurityPolicy is something we really need for the security basics of running pods in the cluster.
Related docs: https://kubernetes.io/docs/concepts/policy/pod-security-policy/
Since Pod Security Policies (PSPs) are tightly integrated with RBAC, this task must address that as well.
It seems that so far, placing the PSPs with accompanying RBAC in an /etc/kubenetes subdir is agreed upon as well as likely combining everything needed to launch the cluster into a single file.
For reference, the ABAC used in toolforge right now looks like this for a toolforge user account:
{"apiVersion": "abac.authorization.kubernetes.io/v1beta1", "spec": {"user": "mytool", "namespace": "mytool", "resource": "pods", "apiGroup": "*"}, "kind": "Policy"}
{"apiVersion": "abac.authorization.kubernetes.io/v1beta1", "spec": {"user": "mytool", "namespace": "mytool", "resource": "replicationcontrollers", "apiGroup": "*"}, "kind": "Policy"}
{"apiVersion": "abac.authorization.kubernetes.io/v1beta1", "spec": {"user": "mytool", "namespace": "mytool", "resource": "services", "apiGroup": "*"}, "kind": "Policy"}
{"apiVersion": "abac.authorization.kubernetes.io/v1beta1", "spec": {"user": "mytool", "namespace": "mytool", "resource": "secrets", "apiGroup": "*"}, "kind": "Policy"}
{"apiVersion": "abac.authorization.kubernetes.io/v1beta1", "spec": {"user": "mytool", "namespace": "mytool", "resource": "deployments", "apiGroup": "*"}, "kind": "Policy"}
{"apiVersion": "abac.authorization.kubernetes.io/v1beta1", "spec": {"user": "mytool", "namespace": "mytool", "resource": "replicasets", "apiGroup": "*"}, "kind": "Policy"}
{"apiVersion": "abac.authorization.kubernetes.io/v1beta1", "spec": {"user": "mytool", "namespace": "mytool", "resource": "configmaps", "apiGroup": "*"}, "kind": "Policy"}
{"apiVersion": "abac.authorization.kubernetes.io/v1beta1", "spec": {"user": "mytool", "namespace": "mytool", "resource": "jobs", "apiGroup": "*"}, "kind": "Policy"}
{"apiVersion": "abac.authorization.kubernetes.io/v1beta1", "spec": {"user": "mytool", "namespace": "mytool", "resource": "cronjobs", "apiGroup": "*"}, "kind": "Policy"}
{"apiVersion": "abac.authorization.kubernetes.io/v1beta1", "spec": {"user": "mytool", "namespace": "mytool", "resource": "scheduledjobs", "apiGroup": "*"}, "kind": "Policy"}This functionally restricts a tool very little within the context of their own namespace. The admission controllers do more to limit behavior. That should be relatively simple to combine into a single role for the namespace or similar along with a binding to the PSP that replaces the admission controllers.