---
  apiVersion: policy/v1beta1
  kind: PodSecurityPolicy
  metadata:
    name: manager
    annotations:
      seccomp.security.alpha.kubernetes.io/allowedProfileNames: "docker/default,runtime/default"
      seccomp.security.alpha.kubernetes.io/defaultProfileName:  "runtime/default"

      # AppArmor isn't enabled by default on k3OS, punting on it for now.
      # apparmor.security.beta.kubernetes.io/allowedProfileNames: "runtime/default"
      # apparmor.security.beta.kubernetes.io/defaultProfileName:  "runtime/default"
  spec:
    privileged: false
    # required to prevent escalations to root
    allowPrivilegeEscalation: false
    # this is redundant with non-root + disallow privilege escalation but we can provide it for defense in depth
    requiredDropCapabilities:
      - ALL
    volumes:
      - hostPath
      - secret
      - downwardAPI
    hostNetwork: false
    hostIPC: false
    hostPID: false
    runAsUser:
      rule: RunAsAny
    allowedHostPaths:
      # allows "/foo", "/foo/", "/foo/bar" etc. but disallows "/fool", "/etc/foo" etc., "/foo/../" is never valid
      # - pathPrefix: "/foo"
      #   readOnly: true # only allow read-only mounts
      - pathPrefix: "/var/lib/rancher/k3os"
        readOnly: false
    seLinux:
      # this policy assumes the nodes are using AppArmor rather than SELinux
      rule: RunAsAny
    supplementalGroups:
      rule: RunAsAny
    fsGroup:
      rule: RunAsAny
    # forbid setting any sysctls
    forbiddenSysctls:
      - '*'
    readOnlyRootFilesystem: false
