github.com/verrazzano/verrazzano@v1.7.0/platform-operator/thirdparty/charts/cert-manager/templates/startupapicheck-psp.yaml (about)

     1  {{- if .Values.startupapicheck.enabled }}
     2  {{- if .Values.global.podSecurityPolicy.enabled }}
     3  {{- if .Capabilities.APIVersions.Has "policy/v1beta1/PodSecurityPolicy" }}
     4  apiVersion: policy/v1beta1
     5  kind: PodSecurityPolicy
     6  metadata:
     7    name: {{ template "startupapicheck.fullname" . }}
     8    labels:
     9      app: {{ include "startupapicheck.name" . }}
    10      app.kubernetes.io/name: {{ include "startupapicheck.name" . }}
    11      app.kubernetes.io/instance: {{ .Release.Name }}
    12      app.kubernetes.io/component: "startupapicheck"
    13      {{- include "labels" . | nindent 4 }}
    14    annotations:
    15      seccomp.security.alpha.kubernetes.io/allowedProfileNames: 'docker/default'
    16      seccomp.security.alpha.kubernetes.io/defaultProfileName:  'docker/default'
    17      {{- if .Values.global.podSecurityPolicy.useAppArmor }}
    18      apparmor.security.beta.kubernetes.io/allowedProfileNames: 'runtime/default'
    19      apparmor.security.beta.kubernetes.io/defaultProfileName:  'runtime/default'
    20      {{- end }}
    21      {{- with .Values.startupapicheck.rbac.annotations }}
    22      {{- toYaml . | nindent 4 }}
    23      {{- end }}
    24  spec:
    25    privileged: false
    26    allowPrivilegeEscalation: false
    27    allowedCapabilities: []  # default set of capabilities are implicitly allowed
    28    volumes:
    29    - 'projected'
    30    - 'secret'
    31    hostNetwork: false
    32    hostIPC: false
    33    hostPID: false
    34    runAsUser:
    35      rule: 'MustRunAs'
    36      ranges:
    37      - min: 1000
    38        max: 1000
    39    seLinux:
    40      rule: 'RunAsAny'
    41    supplementalGroups:
    42      rule: 'MustRunAs'
    43      ranges:
    44      - min: 1000
    45        max: 1000
    46    fsGroup:
    47      rule: 'MustRunAs'
    48      ranges:
    49      - min: 1000
    50        max: 1000
    51  {{- end }}
    52  {{- end }}
    53  {{- end }}