SecurityContextConstraints: add AllowedFlexVolumes field.
@@ -50,6 +50,10 @@ type SecurityContextConstraints struct {
// of a VolumeSource (azureFile, configMap, emptyDir). To allow all volumes you may use "*".
// To allow no volumes, set to ["none"].
Volumes []FSType `json:"volumes" protobuf:"bytes,8,rep,name=volumes,casttype=FSType"`
+ // AllowedFlexVolumes is a whitelist of allowed Flexvolumes. Empty or nil indicates that all
+ // Flexvolumes may be used. This parameter is effective only when the usage of the Flexvolumes
+ // is allowed in the "Volumes" field.
+ AllowedFlexVolumes []AllowedFlexVolume `json:"allowedFlexVolumes" protobuf:"bytes,21,rep,name=allowedFlexVolumes"`
// AllowHostNetwork determines if the policy allows the use of HostNetwork in the pod spec.
AllowHostNetwork bool `json:"allowHostNetwork" protobuf:"varint,9,opt,name=allowHostNetwork"`
// AllowHostPorts determines if the policy allows host ports in the containers.
@@ -121,6 +125,12 @@ var (
FSTypeNone FSType = "none"
)
+// AllowedFlexVolume represents a single Flexvolume that is allowed to be used.
+type AllowedFlexVolume struct {
+ // Driver is the name of the Flexvolume driver.
+ Driver string `json:"driver,omitempty" protobuf:"bytes,1,opt,name=driver"`
+}
+
// SELinuxContextStrategyOptions defines the strategy type and any options used to create the strategy.
type SELinuxContextStrategyOptions struct {
// Type is the strategy that will dictate what SELinux context is used in the SecurityContext.
