diff options
author | Dileep Ranganathan <dileep.ranganathan@intel.com> | 2019-01-25 02:44:36 -0800 |
---|---|---|
committer | Dileep Ranganathan <dileep.ranganathan@intel.com> | 2019-01-25 02:49:50 -0800 |
commit | c942e55ceea4ce28e84168bb672a83572d0a6313 (patch) | |
tree | 8ef8e93a9d4bbd70c4076338ca5ce2be98990268 /vnfs/DAaaS/rook-ceph/templates/psp.yaml | |
parent | 1b97e2665be03fc518eb11de0863c42b2280149e (diff) |
Helm charts for Distributed Edge Analytics.
Initial Helm charts for CollectD, Prometheus Operator,
Kafka Strimzi operator, Rook Ceph Operator.
Change-Id: I7323029bd0bf1e4b39aac329fc567f705a59bc0c
Issue-ID: ONAPARC-366
Signed-off-by: Dileep Ranganathan <dileep.ranganathan@intel.com>
Diffstat (limited to 'vnfs/DAaaS/rook-ceph/templates/psp.yaml')
-rw-r--r-- | vnfs/DAaaS/rook-ceph/templates/psp.yaml | 35 |
1 files changed, 35 insertions, 0 deletions
diff --git a/vnfs/DAaaS/rook-ceph/templates/psp.yaml b/vnfs/DAaaS/rook-ceph/templates/psp.yaml new file mode 100644 index 00000000..412b2437 --- /dev/null +++ b/vnfs/DAaaS/rook-ceph/templates/psp.yaml @@ -0,0 +1,35 @@ +{{- if .Values.pspEnable }} +# PSP for rook-ceph-operator + +# Most of the teams follow the kubernetes docs and have these PSPs. +# * privileged (for kube-system namespace) +# * restricted (for all logged in users) +# +# If we name it as `rook-ceph-operator`, it comes next to `restricted` PSP alphabetically, +# and applies `restricted` capabilities to `rook-system`. Thats reason this is named with `00-rook-ceph-operator`, +# so it stays somewhere close to top and `rook-system` gets the intended PSP. +# +# More info on PSP ordering : https://kubernetes.io/docs/concepts/policy/pod-security-policy/#policy-order + +apiVersion: extensions/v1beta1 +kind: PodSecurityPolicy +metadata: + name: 00-rook-ceph-operator +spec: + fsGroup: + rule: RunAsAny + privileged: true + runAsUser: + rule: RunAsAny + seLinux: + rule: RunAsAny + supplementalGroups: + rule: RunAsAny + volumes: + - '*' + allowedCapabilities: + - '*' + hostPID: true + hostIPC: true + hostNetwork: true +{{- end }} |