@jkcfg/kubernetes
Version:
jk Kubernetes library
111 lines • 4.25 kB
JSON
{
"$schema": "http://json-schema.org/schema#",
"required": [
"seLinux",
"runAsUser",
"supplementalGroups",
"fsGroup"
],
"type": "object",
"description": "Pod Security Policy Spec defines the policy enforced.",
"properties": {
"allowedCapabilities": {
"items": {
"type": [
"string",
"null"
]
},
"type": [
"array",
"null"
],
"description": "AllowedCapabilities is a list of capabilities that can be requested to add to the container. Capabilities in this field may be added at the pod author's discretion. You must not list a capability in both AllowedCapabilities and RequiredDropCapabilities."
},
"runAsUser": {
"description": "runAsUser is the strategy that will dictate the allowable RunAsUser values that may be set.",
"$ref": "_definitions.json#/definitions/io.k8s.kubernetes.pkg.apis.extensions.v1beta1.RunAsUserStrategyOptions"
},
"supplementalGroups": {
"description": "SupplementalGroups is the strategy that will dictate what supplemental groups are used by the SecurityContext.",
"$ref": "_definitions.json#/definitions/io.k8s.kubernetes.pkg.apis.extensions.v1beta1.SupplementalGroupsStrategyOptions"
},
"fsGroup": {
"description": "FSGroup is the strategy that will dictate what fs group is used by the SecurityContext.",
"$ref": "_definitions.json#/definitions/io.k8s.kubernetes.pkg.apis.extensions.v1beta1.FSGroupStrategyOptions"
},
"hostNetwork": {
"type": "boolean",
"description": "hostNetwork determines if the policy allows the use of HostNetwork in the pod spec."
},
"hostPorts": {
"items": {
"$ref": "_definitions.json#/definitions/io.k8s.kubernetes.pkg.apis.extensions.v1beta1.HostPortRange"
},
"type": [
"array",
"null"
],
"description": "hostPorts determines which host port ranges are allowed to be exposed."
},
"seLinux": {
"description": "seLinux is the strategy that will dictate the allowable labels that may be set.",
"$ref": "_definitions.json#/definitions/io.k8s.kubernetes.pkg.apis.extensions.v1beta1.SELinuxStrategyOptions"
},
"volumes": {
"items": {
"type": [
"string",
"null"
]
},
"type": [
"array",
"null"
],
"description": "volumes is a white list of allowed volume plugins. Empty indicates that all plugins may be used."
},
"hostIPC": {
"type": "boolean",
"description": "hostIPC determines if the policy allows the use of HostIPC in the pod spec."
},
"defaultAddCapabilities": {
"items": {
"type": [
"string",
"null"
]
},
"type": [
"array",
"null"
],
"description": "DefaultAddCapabilities is the default set of capabilities that will be added to the container unless the pod spec specifically drops the capability. You may not list a capabiility in both DefaultAddCapabilities and RequiredDropCapabilities."
},
"requiredDropCapabilities": {
"items": {
"type": [
"string",
"null"
]
},
"type": [
"array",
"null"
],
"description": "RequiredDropCapabilities are the capabilities that will be dropped from the container. These are required to be dropped and cannot be added."
},
"readOnlyRootFilesystem": {
"type": "boolean",
"description": "ReadOnlyRootFilesystem when set to true will force containers to run with a read only root file system. If the container specifically requests to run with a non-read only root file system the PSP should deny the pod. If set to false the container may run with a read only root file system if it wishes but it will not be forced to."
},
"privileged": {
"type": "boolean",
"description": "privileged determines if a pod can request to be run as privileged."
},
"hostPID": {
"type": "boolean",
"description": "hostPID determines if the policy allows the use of HostPID in the pod spec."
}
}
}