Package io.fabric8.kubernetes.api.model.policy.v1beta1

Class PodSecurityPolicySpec

  • All Implemented Interfaces:
    io.fabric8.kubernetes.api.builder.Editable<PodSecurityPolicySpecBuilder>, io.fabric8.kubernetes.api.model.KubernetesResource, Serializable
    @Generated("io.fabric8.kubernetes.schema.generator.model.ModelGenerator")
public class PodSecurityPolicySpec
extends Object
implements io.fabric8.kubernetes.api.builder.Editable<PodSecurityPolicySpecBuilder>, io.fabric8.kubernetes.api.model.KubernetesResource
    PodSecurityPolicySpec defines the policy enforced.
    See Also:
    Serialized Form

    • Method Detail

      • getAllowPrivilegeEscalation

        public Boolean getAllowPrivilegeEscalation()
        allowPrivilegeEscalation determines if a pod can request to allow privilege escalation. If unspecified, defaults to true.

      • setAllowPrivilegeEscalation

        public void setAllowPrivilegeEscalation​(Boolean allowPrivilegeEscalation)
        allowPrivilegeEscalation determines if a pod can request to allow privilege escalation. If unspecified, defaults to true.

      • getAllowedCSIDrivers

        public List<AllowedCSIDriver> getAllowedCSIDrivers()
        AllowedCSIDrivers is an allowlist of inline CSI drivers that must be explicitly set to be embedded within a pod spec. An empty value indicates that any CSI driver can be used for inline ephemeral volumes. This is a beta field, and is only honored if the API server enables the CSIInlineVolume feature gate.

      • setAllowedCSIDrivers

        public void setAllowedCSIDrivers​(List<AllowedCSIDriver> allowedCSIDrivers)
        AllowedCSIDrivers is an allowlist of inline CSI drivers that must be explicitly set to be embedded within a pod spec. An empty value indicates that any CSI driver can be used for inline ephemeral volumes. This is a beta field, and is only honored if the API server enables the CSIInlineVolume feature gate.

      • getAllowedCapabilities

        public List<String> getAllowedCapabilities()
        allowedCapabilities is a list of capabilities that can be requested to add to the container. Capabilities in this field may be added at the pod author's discretion. You must not list a capability in both allowedCapabilities and requiredDropCapabilities.

      • setAllowedCapabilities

        public void setAllowedCapabilities​(List<String> allowedCapabilities)
        allowedCapabilities is a list of capabilities that can be requested to add to the container. Capabilities in this field may be added at the pod author's discretion. You must not list a capability in both allowedCapabilities and requiredDropCapabilities.

      • getAllowedFlexVolumes

        public List<AllowedFlexVolume> getAllowedFlexVolumes()
        allowedFlexVolumes is an allowlist of Flexvolumes. Empty or nil indicates that all Flexvolumes may be used. This parameter is effective only when the usage of the Flexvolumes is allowed in the "volumes" field.

      • setAllowedFlexVolumes

        public void setAllowedFlexVolumes​(List<AllowedFlexVolume> allowedFlexVolumes)
        allowedFlexVolumes is an allowlist of Flexvolumes. Empty or nil indicates that all Flexvolumes may be used. This parameter is effective only when the usage of the Flexvolumes is allowed in the "volumes" field.

      • getAllowedHostPaths

        public List<AllowedHostPath> getAllowedHostPaths()
        allowedHostPaths is an allowlist of host paths. Empty indicates that all host paths may be used.

      • setAllowedHostPaths

        public void setAllowedHostPaths​(List<AllowedHostPath> allowedHostPaths)
        allowedHostPaths is an allowlist of host paths. Empty indicates that all host paths may be used.

      • getAllowedProcMountTypes

        public List<String> getAllowedProcMountTypes()
        AllowedProcMountTypes is an allowlist of allowed ProcMountTypes. Empty or nil indicates that only the DefaultProcMountType may be used. This requires the ProcMountType feature flag to be enabled.

      • setAllowedProcMountTypes

        public void setAllowedProcMountTypes​(List<String> allowedProcMountTypes)
        AllowedProcMountTypes is an allowlist of allowed ProcMountTypes. Empty or nil indicates that only the DefaultProcMountType may be used. This requires the ProcMountType feature flag to be enabled.

      • getAllowedUnsafeSysctls

        public List<String> getAllowedUnsafeSysctls()
        allowedUnsafeSysctls is a list of explicitly allowed unsafe sysctls, defaults to none. Each entry is either a plain sysctl name or ends in "*" in which case it is considered as a prefix of allowed sysctls. Single * means all unsafe sysctls are allowed. Kubelet has to allowlist all allowed unsafe sysctls explicitly to avoid rejection.


        Examples: e.g. "foo/*" allows "foo/bar", "foo/baz", etc. e.g. "foo.*" allows "foo.bar", "foo.baz", etc.

      • setAllowedUnsafeSysctls

        public void setAllowedUnsafeSysctls​(List<String> allowedUnsafeSysctls)
        allowedUnsafeSysctls is a list of explicitly allowed unsafe sysctls, defaults to none. Each entry is either a plain sysctl name or ends in "*" in which case it is considered as a prefix of allowed sysctls. Single * means all unsafe sysctls are allowed. Kubelet has to allowlist all allowed unsafe sysctls explicitly to avoid rejection.


        Examples: e.g. "foo/*" allows "foo/bar", "foo/baz", etc. e.g. "foo.*" allows "foo.bar", "foo.baz", etc.

      • getDefaultAddCapabilities

        public List<String> getDefaultAddCapabilities()
        defaultAddCapabilities is the default set of capabilities that will be added to the container unless the pod spec specifically drops the capability. You may not list a capability in both defaultAddCapabilities and requiredDropCapabilities. Capabilities added here are implicitly allowed, and need not be included in the allowedCapabilities list.

      • setDefaultAddCapabilities

        public void setDefaultAddCapabilities​(List<String> defaultAddCapabilities)
        defaultAddCapabilities is the default set of capabilities that will be added to the container unless the pod spec specifically drops the capability. You may not list a capability in both defaultAddCapabilities and requiredDropCapabilities. Capabilities added here are implicitly allowed, and need not be included in the allowedCapabilities list.

      • getDefaultAllowPrivilegeEscalation

        public Boolean getDefaultAllowPrivilegeEscalation()
        defaultAllowPrivilegeEscalation controls the default setting for whether a process can gain more privileges than its parent process.

      • setDefaultAllowPrivilegeEscalation

        public void setDefaultAllowPrivilegeEscalation​(Boolean defaultAllowPrivilegeEscalation)
        defaultAllowPrivilegeEscalation controls the default setting for whether a process can gain more privileges than its parent process.

      • getForbiddenSysctls

        public List<String> getForbiddenSysctls()
        forbiddenSysctls is a list of explicitly forbidden sysctls, defaults to none. Each entry is either a plain sysctl name or ends in "*" in which case it is considered as a prefix of forbidden sysctls. Single * means all sysctls are forbidden.


        Examples: e.g. "foo/*" forbids "foo/bar", "foo/baz", etc. e.g. "foo.*" forbids "foo.bar", "foo.baz", etc.

      • setForbiddenSysctls

        public void setForbiddenSysctls​(List<String> forbiddenSysctls)
        forbiddenSysctls is a list of explicitly forbidden sysctls, defaults to none. Each entry is either a plain sysctl name or ends in "*" in which case it is considered as a prefix of forbidden sysctls. Single * means all sysctls are forbidden.


        Examples: e.g. "foo/*" forbids "foo/bar", "foo/baz", etc. e.g. "foo.*" forbids "foo.bar", "foo.baz", etc.

      • setFsGroup

        public void setFsGroup​(FSGroupStrategyOptions fsGroup)
        PodSecurityPolicySpec defines the policy enforced.

      • getHostIPC

        public Boolean getHostIPC()
        hostIPC determines if the policy allows the use of HostIPC in the pod spec.

      • setHostIPC

        public void setHostIPC​(Boolean hostIPC)
        hostIPC determines if the policy allows the use of HostIPC in the pod spec.

      • getHostNetwork

        public Boolean getHostNetwork()
        hostNetwork determines if the policy allows the use of HostNetwork in the pod spec.

      • setHostNetwork

        public void setHostNetwork​(Boolean hostNetwork)
        hostNetwork determines if the policy allows the use of HostNetwork in the pod spec.

      • getHostPID

        public Boolean getHostPID()
        hostPID determines if the policy allows the use of HostPID in the pod spec.

      • setHostPID

        public void setHostPID​(Boolean hostPID)
        hostPID determines if the policy allows the use of HostPID in the pod spec.

      • getHostPorts

        public List<HostPortRange> getHostPorts()
        hostPorts determines which host port ranges are allowed to be exposed.

      • setHostPorts

        public void setHostPorts​(List<HostPortRange> hostPorts)
        hostPorts determines which host port ranges are allowed to be exposed.

      • getPrivileged

        public Boolean getPrivileged()
        privileged determines if a pod can request to be run as privileged.

      • setPrivileged

        public void setPrivileged​(Boolean privileged)
        privileged determines if a pod can request to be run as privileged.

      • getReadOnlyRootFilesystem

        public Boolean getReadOnlyRootFilesystem()
        readOnlyRootFilesystem when set to true will force containers to run with a read only root file system. If the container specifically requests to run with a non-read only root file system the PSP should deny the pod. If set to false the container may run with a read only root file system if it wishes but it will not be forced to.

      • setReadOnlyRootFilesystem

        public void setReadOnlyRootFilesystem​(Boolean readOnlyRootFilesystem)
        readOnlyRootFilesystem when set to true will force containers to run with a read only root file system. If the container specifically requests to run with a non-read only root file system the PSP should deny the pod. If set to false the container may run with a read only root file system if it wishes but it will not be forced to.

      • getRequiredDropCapabilities

        public List<String> getRequiredDropCapabilities()
        requiredDropCapabilities are the capabilities that will be dropped from the container. These are required to be dropped and cannot be added.

      • setRequiredDropCapabilities

        public void setRequiredDropCapabilities​(List<String> requiredDropCapabilities)
        requiredDropCapabilities are the capabilities that will be dropped from the container. These are required to be dropped and cannot be added.

      • setRunAsGroup

        public void setRunAsGroup​(RunAsGroupStrategyOptions runAsGroup)
        PodSecurityPolicySpec defines the policy enforced.

      • setRunAsUser

        public void setRunAsUser​(RunAsUserStrategyOptions runAsUser)
        PodSecurityPolicySpec defines the policy enforced.

      • setRuntimeClass

        public void setRuntimeClass​(RuntimeClassStrategyOptions runtimeClass)
        PodSecurityPolicySpec defines the policy enforced.

      • setSeLinux

        public void setSeLinux​(SELinuxStrategyOptions seLinux)
        PodSecurityPolicySpec defines the policy enforced.

      • setSupplementalGroups

        public void setSupplementalGroups​(SupplementalGroupsStrategyOptions supplementalGroups)
        PodSecurityPolicySpec defines the policy enforced.

      • getVolumes

        public List<String> getVolumes()
        volumes is an allowlist of volume plugins. Empty indicates that no volumes may be used. To allow all volumes you may use '*'.

      • setVolumes

        public void setVolumes​(List<String> volumes)
        volumes is an allowlist of volume plugins. Empty indicates that no volumes may be used. To allow all volumes you may use '*'.

      • getAdditionalProperties

        public Map<String,​Object> getAdditionalProperties()

      • setAdditionalProperty

        public void setAdditionalProperty​(String name,
                                  Object value)

      • setAdditionalProperties

        public void setAdditionalProperties​(Map<String,​Object> additionalProperties)