diff options
| author |   Dileep Ranganathan <dileep.ranganathan@intel.com> | 2019-05-30 12:38:37 -0700 |
|---|---|---|
| committer | Dileep Ranganathan <dileep.ranganathan@intel.com> | 2019-05-30 21:11:52 +0000 |
| commit | 3d5a3e06530c1250d48f7d838c619f3bfbcd019d (patch) | |
| tree | 349e370c43ce7318b3f7eb7736345de6872cbef2 /vnfs/DAaaS/deploy/visualization/charts/grafana/templates/podsecuritypolicy.yaml | |
| parent | 31802660dfe74a8671ae29789f0018f0f887ea1a (diff) | |
Refactor Distributed Analytics project structure
Modified the project structure to improve maintainability and to add future CI and
integration test support.
Change-Id: Id30bfb1f83f23785a6b5f99e81f42f752d59c0f8
Issue-ID: ONAPARC-280
Signed-off-by: Dileep Ranganathan <dileep.ranganathan@intel.com>
Diffstat (limited to 'vnfs/DAaaS/deploy/visualization/charts/grafana/templates/podsecuritypolicy.yaml')
| -rwxr-xr-x | vnfs/DAaaS/deploy/visualization/charts/grafana/templates/podsecuritypolicy.yaml | 54 |
1 files changed, 54 insertions, 0 deletions
diff --git a/vnfs/DAaaS/deploy/visualization/charts/grafana/templates/podsecuritypolicy.yaml b/vnfs/DAaaS/deploy/visualization/charts/grafana/templates/podsecuritypolicy.yaml new file mode 100755 index 00000000..d3ef3644 --- /dev/null +++ b/vnfs/DAaaS/deploy/visualization/charts/grafana/templates/podsecuritypolicy.yaml @@ -0,0 +1,54 @@ +{{- if .Values.rbac.pspEnabled }} +apiVersion: extensions/v1beta1 +kind: PodSecurityPolicy +metadata: + name: {{ template "grafana.fullname" . }} + labels: + app: {{ template "grafana.name" . }} + chart: {{ .Chart.Name }}-{{ .Chart.Version }} + heritage: {{ .Release.Service }} + release: {{ .Release.Name }} + annotations: + seccomp.security.alpha.kubernetes.io/allowedProfileNames: 'docker/default' + seccomp.security.alpha.kubernetes.io/defaultProfileName: 'docker/default' + {{- if .Values.rbac.pspUseAppArmor }} + apparmor.security.beta.kubernetes.io/allowedProfileNames: 'runtime/default' + apparmor.security.beta.kubernetes.io/defaultProfileName: 'runtime/default' + {{- end }} +spec: + privileged: false + allowPrivilegeEscalation: false + requiredDropCapabilities: + # Default set from Docker, without DAC_OVERRIDE or CHOWN + - FOWNER + - FSETID + - KILL + - SETGID + - SETUID + - SETPCAP + - NET_BIND_SERVICE + - NET_RAW + - SYS_CHROOT + - MKNOD + - AUDIT_WRITE + - SETFCAP + volumes: + - 'configMap' + - 'emptyDir' + - 'projected' + - 'secret' + - 'downwardAPI' + - 'persistentVolumeClaim' + hostNetwork: false + hostIPC: false + hostPID: false + runAsUser: + rule: 'RunAsAny' + seLinux: + rule: 'RunAsAny' + supplementalGroups: + rule: 'RunAsAny' + fsGroup: + rule: 'RunAsAny' + readOnlyRootFilesystem: false +{{- end }} |