---
apiVersion: policy/v1beta1
kind: PodSecurityPolicy
metadata:
  name: node-exporter
spec:
  privileged: true
  allowPrivilegeEscalation: true
  hostPorts:
    - max: 9100
      min: 9100
  allowedCapabilities:
    - '*'
  volumes:
    - "configMap"
    - "downwardAPI"
    - "emptyDir"
    - "persistentVolumeClaim"
    - "secret"
    - "projected"
    - "hostPath"
  hostNetwork: true
  hostIPC: true
  hostPID: true
  runAsUser:
    rule: 'RunAsAny'
  seLinux:
    rule: 'RunAsAny'
  supplementalGroups:
    rule: 'RunAsAny'
  fsGroup:
    rule: 'RunAsAny'
  readOnlyRootFilesystem: false
  # This will fail if allowed-unsafe-sysctls is not set accordingly in kubelet flags
  allowedUnsafeSysctls:
    - '*'
