#
#  Author: Hari Sekhon
#  Date: [% DATE  # 2019-11-28 18:17:27 +0000 (Thu, 28 Nov 2019) %]
#
#  vim:ts=2:sts=2:sw=2:et
#
#  https://github.com/harisekhon/Kubernetes-configs
#
#  License: see accompanying Hari Sekhon LICENSE file
#
#  If you're using my code you're welcome to connect with me on LinkedIn
#  and optionally send me feedback to help improve or steer this or other code I publish
#
#  https://www.linkedin.com/in/HariSekhon
#

# ============================================================================ #
#                     P o d   S e c u r i t y   P o l i c y
# ============================================================================ #

# https://kubernetes.io/docs/concepts/security/pod-security-standards/

# https://kubernetes.io/docs/concepts/policy/pod-security-policy/

# https://kubernetes.io/docs/tasks/configure-pod-container/security-context/

# https://github.com/kubernetes/examples/blob/master/staging/podsecuritypolicy/rbac/README.md

---
apiVersion: policy/v1beta1
kind: PodSecurityPolicy
metadata:
  name: noprivpods
  namespace: NAMESPACE
spec:
  privileged: false
  allowPrivilegeEscalation: false
  defaultAllowPrivilegeEscalation: false
  seLinux:
    rule: RunAsAny
  supplementalGroups:
    rule: RunAsAny
  runAsUser:
    rule: MustRunAsNonRoot
  fsGroup:
    rule: RunAsAny
  volumes:
    - '*'
