apiVersion: policy/v1beta1
kind: PodSecurityPolicy
metadata:
  name: semaphore-wireguard
spec:
  seLinux:
    rule: RunAsAny
  supplementalGroups:
    rule: RunAsAny
  runAsUser:
    rule: RunAsAny
  fsGroup:
    rule: RunAsAny
  allowedCapabilities:
    - NET_ADMIN
  volumes:
    - configMap
    - hostPath
    - secret
  hostNetwork: true
  hostPorts:
    - min: 7773
      max: 7773
  allowedHostPaths:
    - pathPrefix: '/var/lib/semaphore-wireguard'
