@jkcfg/kubernetes/schemas/v1.8.1-local/podsecuritypolicyspec.json

jk Kubernetes library

{
  "description": "Pod Security Policy Spec defines the policy enforced.",
  "required": [
    "seLinux",
    "runAsUser",
    "supplementalGroups",
    "fsGroup"
  ],
  "properties": {
    "allowPrivilegeEscalation": {
      "description": "AllowPrivilegeEscalation determines if a pod can request to allow privilege escalation. If unspecified, defaults to true.",
      "type": "boolean"
    },
    "allowedCapabilities": {
      "description": "AllowedCapabilities is a list of capabilities that can be requested to add to the container. Capabilities in this field may be added at the pod author's discretion. You must not list a capability in both AllowedCapabilities and RequiredDropCapabilities.",
      "type": [
        "array",
        "null"
      ],
      "items": {
        "type": [
          "string",
          "null"
        ]
      }
    },
    "allowedHostPaths": {
      "description": "is a white list of allowed host paths. Empty indicates that all host paths may be used.",
      "type": [
        "array",
        "null"
      ],
      "items": {
        "$ref": "_definitions.json#/definitions/io.k8s.api.extensions.v1beta1.AllowedHostPath"
      }
    },
    "defaultAddCapabilities": {
      "description": "DefaultAddCapabilities is the default set of capabilities that will be added to the container unless the pod spec specifically drops the capability.  You may not list a capabiility in both DefaultAddCapabilities and RequiredDropCapabilities.",
      "type": [
        "array",
        "null"
      ],
      "items": {
        "type": [
          "string",
          "null"
        ]
      }
    },
    "defaultAllowPrivilegeEscalation": {
      "description": "DefaultAllowPrivilegeEscalation controls the default setting for whether a process can gain more privileges than its parent process.",
      "type": "boolean"
    },
    "fsGroup": {
      "description": "FSGroup is the strategy that will dictate what fs group is used by the SecurityContext.",
      "$ref": "_definitions.json#/definitions/io.k8s.api.extensions.v1beta1.FSGroupStrategyOptions"
    },
    "hostIPC": {
      "description": "hostIPC determines if the policy allows the use of HostIPC in the pod spec.",
      "type": "boolean"
    },
    "hostNetwork": {
      "description": "hostNetwork determines if the policy allows the use of HostNetwork in the pod spec.",
      "type": "boolean"
    },
    "hostPID": {
      "description": "hostPID determines if the policy allows the use of HostPID in the pod spec.",
      "type": "boolean"
    },
    "hostPorts": {
      "description": "hostPorts determines which host port ranges are allowed to be exposed.",
      "type": [
        "array",
        "null"
      ],
      "items": {
        "$ref": "_definitions.json#/definitions/io.k8s.api.extensions.v1beta1.HostPortRange"
      }
    },
    "privileged": {
      "description": "privileged determines if a pod can request to be run as privileged.",
      "type": "boolean"
    },
    "readOnlyRootFilesystem": {
      "description": "ReadOnlyRootFilesystem when set to true will force containers to run with a read only root file system.  If the container specifically requests to run with a non-read only root file system the PSP should deny the pod. If set to false the container may run with a read only root file system if it wishes but it will not be forced to.",
      "type": "boolean"
    },
    "requiredDropCapabilities": {
      "description": "RequiredDropCapabilities are the capabilities that will be dropped from the container.  These are required to be dropped and cannot be added.",
      "type": [
        "array",
        "null"
      ],
      "items": {
        "type": [
          "string",
          "null"
        ]
      }
    },
    "runAsUser": {
      "description": "runAsUser is the strategy that will dictate the allowable RunAsUser values that may be set.",
      "$ref": "_definitions.json#/definitions/io.k8s.api.extensions.v1beta1.RunAsUserStrategyOptions"
    },
    "seLinux": {
      "description": "seLinux is the strategy that will dictate the allowable labels that may be set.",
      "$ref": "_definitions.json#/definitions/io.k8s.api.extensions.v1beta1.SELinuxStrategyOptions"
    },
    "supplementalGroups": {
      "description": "SupplementalGroups is the strategy that will dictate what supplemental groups are used by the SecurityContext.",
      "$ref": "_definitions.json#/definitions/io.k8s.api.extensions.v1beta1.SupplementalGroupsStrategyOptions"
    },
    "volumes": {
      "description": "volumes is a white list of allowed volume plugins.  Empty indicates that all plugins may be used.",
      "type": [
        "array",
        "null"
      ],
      "items": {
        "type": [
          "string",
          "null"
        ]
      }
    }
  },
  "$schema": "http://json-schema.org/schema#",
  "type": "object"
}