apiVersion: policy/v1beta1
kind: PodSecurityPolicy
metadata:
  name: psp.csinodeplugin.privileged
  annotations:
    seccomp.security.alpha.kubernetes.io/allowedProfileNames: docker/default
    seccomp.security.alpha.kubernetes.io/defaultProfileName: docker/default
    apparmor.security.beta.kubernetes.io/allowedProfileNames: runtime/default
    apparmor.security.beta.kubernetes.io/defaultProfileName: runtime/default
spec:
  privileged: true 
  volumes:
    - configMap
    - secret
    - emptyDir
    - hostPath
  allowedHostPaths:
    - pathPrefix: "/var/lib/kubelet/pods"
    - pathPrefix: "/var/lib/kubelet/plugins/com.tencent.cloud.csi.cbs"
    - pathPrefix: "/var/lib/kubelet/plugins/kubernetes.io/csi/volumeDevices"
    - pathPrefix: "/dev"
    - pathPrefix: "/var/lib/kubelet/plugins_registry/"
    - pathPrefix: "/"
    - pathPrefix: "/sys"
    - pathPrefix: "/lib/modules"
  readOnlyRootFilesystem: false
  # Users and groups
  runAsUser:
    rule: RunAsAny
  supplementalGroups:
    rule: RunAsAny
  fsGroup:
    rule: RunAsAny
  # Privilege Escalation
  allowPrivilegeEscalation: true 
  defaultAllowPrivilegeEscalation: false
  # Capabilities
  allowedCapabilities: ['SYS_ADMIN']
  defaultAddCapabilities: []
  requiredDropCapabilities: []
  # Host namespaces
  hostPID: true 
  hostIPC: false
  hostNetwork: true
  hostPorts:
  - min: 0
    max: 65535
  # SELinux
  seLinux:
    # SELinux is unsed in CaaSP
    rule: 'RunAsAny'
