| {{- if and .Values.rbac.pspEnabled (.Capabilities.APIVersions.Has "policy/v1beta1/PodSecurityPolicy") }} |
| apiVersion: policy/v1beta1 |
| kind: PodSecurityPolicy |
| metadata: |
| name: {{ include "dubbo-admin.fullname" . }} |
| labels: |
| {{- include "dubbo-admin.labels" . | nindent 4 }} |
| spec: |
| privileged: false |
| allowPrivilegeEscalation: false |
| requiredDropCapabilities: |
| - ALL |
| volumes: |
| - 'configMap' |
| - 'emptyDir' |
| - 'projected' |
| - 'csi' |
| - 'secret' |
| - 'downwardAPI' |
| - 'persistentVolumeClaim' |
| hostNetwork: false |
| hostIPC: false |
| hostPID: false |
| runAsUser: |
| rule: 'RunAsAny' |
| seLinux: |
| rule: 'RunAsAny' |
| supplementalGroups: |
| rule: 'MustRunAs' |
| ranges: |
| - min: 1 |
| max: 65535 |
| fsGroup: |
| rule: 'MustRunAs' |
| ranges: |
| - min: 1 |
| max: 65535 |
| readOnlyRootFilesystem: false |
| {{- end }} |
