Usage of PSP for controlling safe/unsafe sysctls isn't documented

[php-coder]

It turns out that user can annotate PSP with security.alpha.kubernetes.io/sysctls annotation to specify "whitelist of allowed safe and unsafe sysctls in a pod spec". It isn't documented.

[liggitt]

I'd rather see them graduate to fields before getting officially documented and used
@pweil-

[pweil-]

Ok. @php-coder let's discuss what else needs to be done on the roadmap to graduate the feature and get this worked into a card for PM

[php-coder]

I found that the usage of safe/unsafe sysctls are documented here: https://kubernetes.io/docs/concepts/cluster-administration/sysctl-cluster/ But its usage doesn't relate to PSP at all.

@sttts Could you explain how PSP strategy (pkg/security/podsecuritypolicy/sysctl) is correlated with the current behavior when admin need to pass --experimental-allowed-unsafe-sysctls option to the kubelet?

[sttts]

The design and implementation is documented in https://github.com/kubernetes/community/blob/930ce65595a3f7ce1c49acfac711fee3a25f5670/contributors/design-proposals/node/sysctl.md#proposed-design.

[fejta-bot]

Issues go stale after 90d of inactivity.
Mark the issue as fresh with /remove-lifecycle stale.
Stale issues rot after an additional 30d of inactivity and eventually close.

If this issue is safe to close now please do so with /close.

Send feedback to sig-testing, kubernetes/test-infra and/or fejta.
/lifecycle stale

[php-coder]

The documentation was added in #7600 and is available at https://kubernetes.io/docs/concepts/cluster-administration/sysctl-cluster/#podsecuritypolicy-annotations

/close