apiVersion: policy/v1beta1
kind: PodSecurityPolicy
metadata:
  name: compass-runtime-agent
spec:
  allowPrivilegeEscalation: false
  allowedCapabilities:
  - NET_ADMIN
  - NET_RAW
  fsGroup:
    rule: 'MustRunAs'
    ranges:
      - min: 1
        max: 65535
  runAsUser:
    # due to istio init container
    rule: 'RunAsAny' #TODO after init-container removal set to 'MustRunAsNonRoot'
  privileged: false
  seLinux:
    rule: 'RunAsAny'
  supplementalGroups:
    rule: 'MustRunAs'
    ranges:
      - min: 1
        max: 65535
  volumes:
  - configMap
  - downwardAPI
  - emptyDir
  - projected
  - secret