Red Hat OpenShift Container Platform

Controlling pod security admission synchronization

To customize which namespaces have their pod security admission labels automatically updated, you can enable or disable synchronization for most namespaces.

You cannot enable pod security admission synchronization on some system-created namespaces. For more information, see Pod security admission synchronization namespace exclusions.

Procedure

For each namespace that you want to configure, set a value for the security.openshift.io/scc.podSecurityLabelSync label:
- To disable pod security admission label synchronization in a namespace, set the value of the security.openshift.io/scc.podSecurityLabelSync label to false.
  
  Run the following command:
  
  $ oc label namespace <namespace> security.openshift.io/scc.podSecurityLabelSync=false
- To enable pod security admission label synchronization in a namespace, set the value of the security.openshift.io/scc.podSecurityLabelSync label to true.
  
  Run the following command:
  
  $ oc label namespace <namespace> security.openshift.io/scc.podSecurityLabelSync=true
Use the --overwrite flag to overwrite the value if this label is already set on the namespace.