helm/infrastructure/subcharts/prometheus/charts/kube-state-metrics/templates/podsecuritypolicy.yaml

   1 {{- if .Values.podSecurityPolicy.enabled }}
   2 apiVersion: policy/v1beta1
   3 kind: PodSecurityPolicy
   4 metadata:
   5   name: {{ template "kube-state-metrics.fullname" . }}
   6   labels:
   7     app.kubernetes.io/name: {{ template "kube-state-metrics.name" . }}
   8     helm.sh/chart: {{ .Chart.Name }}-{{ .Chart.Version }}
   9     app.kubernetes.io/managed-by: {{ .Release.Service }}
  10     app.kubernetes.io/instance: {{ .Release.Name }}
  11 {{- if .Values.podSecurityPolicy.annotations }}
  12   annotations:
  13 {{ toYaml .Values.podSecurityPolicy.annotations | indent 4 }}
  14 {{- end }}
  15 spec:
  16   privileged: false
  17   volumes:
  18     - 'secret'
  19   hostNetwork: false
  20   hostIPC: false
  21   hostPID: false
  22   runAsUser:
  23     rule: 'MustRunAsNonRoot'
  24   seLinux:
  25     rule: 'RunAsAny'
  26   supplementalGroups:
  27     rule: 'MustRunAs'
  28     ranges:
  29       # Forbid adding the root group.
  30       - min: 1
  31         max: 65535
  32   fsGroup:
  33     rule: 'MustRunAs'
  34     ranges:
  35       # Forbid adding the root group.
  36       - min: 1
  37         max: 65535
  38   readOnlyRootFilesystem: false
  39 {{- end }}