diff options
| author | Suren A. Chilingaryan <csa@suren.me> | 2017-04-01 04:53:28 +0200 |
|---|---|---|
| committer | Suren A. Chilingaryan <csa@suren.me> | 2017-04-01 04:53:28 +0200 |
| commit | e7ed329bd81c2273c03e94c93c9ce9c1d01cdc86 (patch) | |
| tree | 444778102e4f73b83ef9462235b7f614b004b264 /setup/projects/katrin/templates/00-katrin-restricted.yml.j2.excl | |
| download | ands-e7ed329bd81c2273c03e94c93c9ce9c1d01cdc86.tar.gz ands-e7ed329bd81c2273c03e94c93c9ce9c1d01cdc86.tar.bz2 ands-e7ed329bd81c2273c03e94c93c9ce9c1d01cdc86.tar.xz ands-e7ed329bd81c2273c03e94c93c9ce9c1d01cdc86.zip | |
Initial import
Diffstat (limited to 'setup/projects/katrin/templates/00-katrin-restricted.yml.j2.excl')
| -rw-r--r-- | setup/projects/katrin/templates/00-katrin-restricted.yml.j2.excl | 43 |
1 files changed, 43 insertions, 0 deletions
diff --git a/setup/projects/katrin/templates/00-katrin-restricted.yml.j2.excl b/setup/projects/katrin/templates/00-katrin-restricted.yml.j2.excl new file mode 100644 index 0000000..d155267 --- /dev/null +++ b/setup/projects/katrin/templates/00-katrin-restricted.yml.j2.excl @@ -0,0 +1,43 @@ +--- +allowHostDirVolumePlugin: false +allowHostIPC: false +allowHostNetwork: false +allowHostPID: false +allowHostPorts: false +allowPrivilegedContainer: false +allowedCapabilities: null +apiVersion: v1 +defaultAddCapabilities: null +fsGroup: + type: MustRunAs +groups: +- system:authenticated +kind: SecurityContextConstraints +metadata: + annotations: + kubernetes.io/description: restricted denies access to all host features and requires + pods to be run with a UID, and SELinux context that are allocated to the namespace. This + is the most restrictive SCC. + creationTimestamp: null + name: katrin-restricted +priority: null +readOnlyRootFilesystem: false +requiredDropCapabilities: +- KILL +- MKNOD +- SYS_CHROOT +- SETUID +- SETGID +runAsUser: + type: MustRunAsRange +seLinuxContext: + type: MustRunAs +supplementalGroups: + type: RunAsAny +volumes: +- glusterfs +- configMap +- downwardAPI +- emptyDir +- persistentVolumeClaim +- secret |