apiVersion: policy/v1beta1
kind: PodSecurityPolicy
metadata:
  labels:
    app.kubernetes.io/component: observability
    app.kubernetes.io/instance: parca-agent
    app.kubernetes.io/name: parca-agent
    app.kubernetes.io/version: dev
  name: parca-agent
  namespace: parca
spec:
  allowPrivilegeEscalation: true
  allowedCapabilities:
  - '*'
  allowedHostPaths:
  - pathPrefix: /sys
  - pathPrefix: /lib/modules
  fsGroup:
    rule: RunAsAny
  hostIPC: true
  hostNetwork: true
  hostPID: true
  hostPorts:
  - max: 7071
    min: 7071
  privileged: true
  readOnlyRootFilesystem: true
  runAsUser:
    rule: RunAsAny
  seLinux:
    rule: RunAsAny
  supplementalGroups:
    rule: RunAsAny
  volumes:
  - configMap
  - emptyDir
  - projected
  - secret
  - downwardAPI
  - persistentVolumeClaim
  - hostPath
