| Tinoj Joseph | dd1fd9d | 2022-08-01 23:59:26 +0530 | [diff] [blame^] | 1 | # Copyright 2022-present Open Networking Foundation |
| 2 | # |
| 3 | # Licensed under the Apache License, Version 2.0 (the "License"); |
| 4 | # you may not use this file except in compliance with the License. |
| 5 | # You may obtain a copy of the License at |
| 6 | # |
| 7 | # http://www.apache.org/licenses/LICENSE-2.0 |
| 8 | # |
| 9 | # Unless required by applicable law or agreed to in writing, software |
| 10 | # distributed under the License is distributed on an "AS IS" BASIS, |
| 11 | # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
| 12 | # See the License for the specific language governing permissions and |
| 13 | # limitations under the License. |
| 14 | |
| 15 | {{- if .Values.podSecurityPolicy.create }} |
| 16 | apiVersion: {{ template "podSecurityPolicy.apiVersion" . }} |
| 17 | kind: PodSecurityPolicy |
| 18 | metadata: |
| 19 | name: {{ template "redis.fullname" . }} |
| 20 | namespace: {{ .Release.Namespace | quote }} |
| 21 | labels: |
| 22 | app: {{ template "redis.name" . }} |
| 23 | chart: {{ template "redis.chart" . }} |
| 24 | heritage: {{ .Release.Service }} |
| 25 | release: {{ .Release.Name }} |
| 26 | spec: |
| 27 | allowPrivilegeEscalation: false |
| 28 | fsGroup: |
| 29 | rule: 'MustRunAs' |
| 30 | ranges: |
| 31 | - min: {{ .Values.securityContext.fsGroup }} |
| 32 | max: {{ .Values.securityContext.fsGroup }} |
| 33 | hostIPC: false |
| 34 | hostNetwork: false |
| 35 | hostPID: false |
| 36 | privileged: false |
| 37 | readOnlyRootFilesystem: false |
| 38 | requiredDropCapabilities: |
| 39 | - ALL |
| 40 | runAsUser: |
| 41 | rule: 'MustRunAs' |
| 42 | ranges: |
| 43 | - min: {{ .Values.containerSecurityContext.runAsUser }} |
| 44 | max: {{ .Values.containerSecurityContext.runAsUser }} |
| 45 | seLinux: |
| 46 | rule: 'RunAsAny' |
| 47 | supplementalGroups: |
| 48 | rule: 'MustRunAs' |
| 49 | ranges: |
| 50 | - min: {{ .Values.containerSecurityContext.runAsUser }} |
| 51 | max: {{ .Values.containerSecurityContext.runAsUser }} |
| 52 | volumes: |
| 53 | - 'configMap' |
| 54 | - 'secret' |
| 55 | - 'emptyDir' |
| 56 | - 'persistentVolumeClaim' |
| 57 | {{- end }} |