# Source: metallb/templates/speaker-podsecuritypolicy.yaml
apiVersion: policy/v1beta1
kind: PodSecurityPolicy
metadata:
  labels:
    app: metallb
    gitops.jenkins-x.io/pipeline: 'namespaces'
  name: speaker
  namespace: metallb-system
  annotations:
    meta.helm.sh/release-name: 'metallb'
spec:
  allowPrivilegeEscalation: false
  allowedCapabilities:
    - NET_RAW
  allowedHostPaths: []
  defaultAddCapabilities: []
  defaultAllowPrivilegeEscalation: false
  fsGroup:
    rule: RunAsAny
  hostIPC: false
  hostNetwork: true
  hostPID: false
  hostPorts:
    - max: 7472
      min: 7472
    - max: 7946
      min: 7946
  privileged: true
  readOnlyRootFilesystem: true
  requiredDropCapabilities:
    - ALL
  runAsUser:
    rule: RunAsAny
  seLinux:
    rule: RunAsAny
  supplementalGroups:
    rule: RunAsAny
  volumes:
    - configMap
    - secret
    - emptyDir
