Use runtime/default as default seccomp profile for unprivileged PodSecurityPolicy

cluster/addons/fluentd-gcp/podsecuritypolicies/event-exporter-psp.yaml

@@ -4,8 +4,8 @@ metadata:
   name: gce.event-exporter
   annotations:
     kubernetes.io/description: 'Policy used by the event-exporter addon.'
-    # TODO: event-exporter should run with the default seccomp profile
-    seccomp.security.alpha.kubernetes.io/allowedProfileNames: '*'
+    seccomp.security.alpha.kubernetes.io/defaultProfileName:  'docker/default'
+    seccomp.security.alpha.kubernetes.io/allowedProfileNames: 'runtime/default,docker/default'
     # 'runtime/default' is already the default, but must be filled in on the
     # pod to pass admission.
     apparmor.security.beta.kubernetes.io/defaultProfileName:  'runtime/default'

cluster/addons/fluentd-gcp/podsecuritypolicies/fluentd-gcp-psp.yaml

@@ -4,8 +4,8 @@ metadata:
   name: gce.fluentd-gcp
   annotations:
     kubernetes.io/description: 'Policy used by the fluentd-gcp addon.'
-    # TODO: fluentd-gcp should run with the default seccomp profile
-    seccomp.security.alpha.kubernetes.io/allowedProfileNames: '*'
+    seccomp.security.alpha.kubernetes.io/defaultProfileName:  'docker/default'
+    seccomp.security.alpha.kubernetes.io/allowedProfileNames: 'runtime/default,docker/default'
     # 'runtime/default' is already the default, but must be filled in on the
     # pod to pass admission.
     apparmor.security.beta.kubernetes.io/defaultProfileName:  'runtime/default'

cluster/gce/addons/podsecuritypolicies/persistent-volume-binder.yaml

@@ -5,8 +5,8 @@ metadata:
   annotations:
     kubernetes.io/description: 'Policy used by the persistent-volume-binder
       (a.k.a. persistentvolume-controller) to run recycler pods.'
-    # TODO: This should use the default seccomp profile.
-    seccomp.security.alpha.kubernetes.io/allowedProfileNames: '*'
+    seccomp.security.alpha.kubernetes.io/defaultProfileName:  'docker/default'
+    seccomp.security.alpha.kubernetes.io/allowedProfileNames: 'runtime/default,docker/default'
   labels:
     kubernetes.io/cluster-service: 'true'
     addonmanager.kubernetes.io/mode: Reconcile

cluster/gce/addons/podsecuritypolicies/unprivileged-addon.yaml

@@ -7,8 +7,8 @@ metadata:
       privilege necessary to run non-privileged kube-system pods. This policy is
       not intended for use outside of kube-system, and may include further
       restrictions in the future.'
-    # TODO: Addons should use the default seccomp profile.
-    seccomp.security.alpha.kubernetes.io/allowedProfileNames: '*'
+    seccomp.security.alpha.kubernetes.io/defaultProfileName:  'docker/default'
+    seccomp.security.alpha.kubernetes.io/allowedProfileNames: 'runtime/default,docker/default'
     # 'runtime/default' is already the default, but must be filled in on the
     # pod to pass admission.
     apparmor.security.beta.kubernetes.io/defaultProfileName:  'runtime/default'