kind: PodSecurityPolicy
apiVersion: policy/v1beta1
metadata:
    name: gce.gke-metrics-agent
    selfLink: /apis/policy/v1beta1/podsecuritypolicies/gce.gke-metrics-agent
    uid: ebe6cdb8-545a-4b68-85b4-ad12cf9cfca7
    resourceVersion: '61446628'
    creationTimestamp: '2020-06-13T08:00:07Z'
    labels:
        addonmanager.kubernetes.io/mode: Reconcile
        kubernetes.io/cluster-service: 'true'
    annotations:
        apparmor.security.beta.kubernetes.io/allowedProfileNames: runtime/default
        apparmor.security.beta.kubernetes.io/defaultProfileName: runtime/default
        kubectl.kubernetes.io/last-applied-configuration: >
            {"apiVersion":"policy/v1beta1","kind":"PodSecurityPolicy","metadata":{"annotations":{"apparmor.security.beta.kubernetes.io/allowedProfileNames":"runtime/default","apparmor.security.beta.kubernetes.io/defaultProfileName":"runtime/default","kubernetes.io/description":"Policy
            used by the gke-metrics-agent
            addon.","seccomp.security.alpha.kubernetes.io/allowedProfileNames":"runtime/default,docker/default","seccomp.security.alpha.kubernetes.io/defaultProfileName":"docker/default"},"labels":{"addonmanager.kubernetes.io/mode":"Reconcile","kubernetes.io/cluster-service":"true"},"name":"gce.gke-metrics-agent"},"spec":{"allowPrivilegeEscalation":false,"allowedHostPaths":[{"pathPrefix":"/etc/ssl/certs"}],"fsGroup":{"rule":"RunAsAny"},"hostIPC":false,"hostNetwork":true,"hostPID":false,"privileged":false,"readOnlyRootFilesystem":false,"runAsUser":{"rule":"RunAsAny"},"seLinux":{"rule":"RunAsAny"},"supplementalGroups":{"rule":"RunAsAny"},"volumes":["hostPath","secret","configMap"]}}
        kubernetes.io/description: Policy used by the gke-metrics-agent addon.
        seccomp.security.alpha.kubernetes.io/allowedProfileNames: 'runtime/default,docker/default'
        seccomp.security.alpha.kubernetes.io/defaultProfileName: docker/default
spec:
    volumes:
        - hostPath
        - secret
        - configMap
    hostNetwork: true
    seLinux:
        rule: RunAsAny
    runAsUser:
        rule: RunAsAny
    supplementalGroups:
        rule: RunAsAny
    fsGroup:
        rule: RunAsAny
    allowPrivilegeEscalation: false
    allowedHostPaths:
        -
            pathPrefix: /etc/ssl/certs

