Class PodSecurityContext
- java.lang.Object
-
- com.marcnuri.yakc.model.io.k8s.api.core.v1.PodSecurityContext
-
- All Implemented Interfaces:
com.marcnuri.yakc.model.Model
public class PodSecurityContext extends java.lang.Object implements com.marcnuri.yakc.model.Model
PodSecurityContext holds pod-level security attributes and common container settings. Some fields are also present in container.securityContext. Field values of container.securityContext take precedence over field values of PodSecurityContext.
-
-
Nested Class Summary
Nested Classes Modifier and Type Class Description static class
PodSecurityContext.Builder
-
Constructor Summary
Constructors Constructor Description PodSecurityContext()
PodSecurityContext(java.lang.Number fsGroup, java.lang.String fsGroupChangePolicy, java.lang.Number runAsGroup, java.lang.Boolean runAsNonRoot, java.lang.Number runAsUser, SELinuxOptions seLinuxOptions, SeccompProfile seccompProfile, java.util.List<java.lang.Number> supplementalGroups, java.util.List<Sysctl> sysctls, WindowsSecurityContextOptions windowsOptions)
-
Method Summary
All Methods Static Methods Instance Methods Concrete Methods Modifier and Type Method Description static PodSecurityContext.Builder
builder()
protected boolean
canEqual(java.lang.Object other)
boolean
equals(java.lang.Object o)
java.lang.Number
getFsGroup()
A special supplemental group that applies to all containers in a pod.java.lang.String
getFsGroupChangePolicy()
fsGroupChangePolicy defines behavior of changing ownership and permission of the volume before being exposed inside Pod.java.lang.Number
getRunAsGroup()
The GID to run the entrypoint of the container process.java.lang.Boolean
getRunAsNonRoot()
Indicates that the container must run as a non-root user.java.lang.Number
getRunAsUser()
The UID to run the entrypoint of the container process.SeccompProfile
getSeccompProfile()
SELinuxOptions
getSeLinuxOptions()
java.util.List<java.lang.Number>
getSupplementalGroups()
A list of groups applied to the first process run in each container, in addition to the container's primary GID.java.util.List<Sysctl>
getSysctls()
Sysctls hold a list of namespaced sysctls used for the pod.WindowsSecurityContextOptions
getWindowsOptions()
int
hashCode()
void
setFsGroup(java.lang.Number fsGroup)
A special supplemental group that applies to all containers in a pod.void
setFsGroupChangePolicy(java.lang.String fsGroupChangePolicy)
fsGroupChangePolicy defines behavior of changing ownership and permission of the volume before being exposed inside Pod.void
setRunAsGroup(java.lang.Number runAsGroup)
The GID to run the entrypoint of the container process.void
setRunAsNonRoot(java.lang.Boolean runAsNonRoot)
Indicates that the container must run as a non-root user.void
setRunAsUser(java.lang.Number runAsUser)
The UID to run the entrypoint of the container process.void
setSeccompProfile(SeccompProfile seccompProfile)
void
setSeLinuxOptions(SELinuxOptions seLinuxOptions)
void
setSupplementalGroups(java.util.List<java.lang.Number> supplementalGroups)
A list of groups applied to the first process run in each container, in addition to the container's primary GID.void
setSysctls(java.util.List<Sysctl> sysctls)
Sysctls hold a list of namespaced sysctls used for the pod.void
setWindowsOptions(WindowsSecurityContextOptions windowsOptions)
PodSecurityContext.Builder
toBuilder()
java.lang.String
toString()
-
-
-
Constructor Detail
-
PodSecurityContext
public PodSecurityContext(java.lang.Number fsGroup, java.lang.String fsGroupChangePolicy, java.lang.Number runAsGroup, java.lang.Boolean runAsNonRoot, java.lang.Number runAsUser, SELinuxOptions seLinuxOptions, SeccompProfile seccompProfile, java.util.List<java.lang.Number> supplementalGroups, java.util.List<Sysctl> sysctls, WindowsSecurityContextOptions windowsOptions)
-
PodSecurityContext
public PodSecurityContext()
-
-
Method Detail
-
builder
public static PodSecurityContext.Builder builder()
-
toBuilder
public PodSecurityContext.Builder toBuilder()
-
getFsGroup
public java.lang.Number getFsGroup()
A special supplemental group that applies to all containers in a pod. Some volume types allow the Kubelet to change the ownership of that volume to be owned by the pod:1. The owning GID will be the FSGroup 2. The setgid bit is set (new files created in the volume will be owned by FSGroup) 3. The permission bits are OR'd with rw-rw----
If unset, the Kubelet will not modify the ownership and permissions of any volume.
-
getFsGroupChangePolicy
public java.lang.String getFsGroupChangePolicy()
fsGroupChangePolicy defines behavior of changing ownership and permission of the volume before being exposed inside Pod. This field will only apply to volume types which support fsGroup based ownership(and permissions). It will have no effect on ephemeral volume types such as: secret, configmaps and emptydir. Valid values are "OnRootMismatch" and "Always". If not specified defaults to "Always".
-
getRunAsGroup
public java.lang.Number getRunAsGroup()
The GID to run the entrypoint of the container process. Uses runtime default if unset. May also be set in SecurityContext. If set in both SecurityContext and PodSecurityContext, the value specified in SecurityContext takes precedence for that container.
-
getRunAsNonRoot
public java.lang.Boolean getRunAsNonRoot()
Indicates that the container must run as a non-root user. If true, the Kubelet will validate the image at runtime to ensure that it does not run as UID 0 (root) and fail to start the container if it does. If unset or false, no such validation will be performed. May also be set in SecurityContext. If set in both SecurityContext and PodSecurityContext, the value specified in SecurityContext takes precedence.
-
getRunAsUser
public java.lang.Number getRunAsUser()
The UID to run the entrypoint of the container process. Defaults to user specified in image metadata if unspecified. May also be set in SecurityContext. If set in both SecurityContext and PodSecurityContext, the value specified in SecurityContext takes precedence for that container.
-
getSeLinuxOptions
public SELinuxOptions getSeLinuxOptions()
-
getSeccompProfile
public SeccompProfile getSeccompProfile()
-
getSupplementalGroups
public java.util.List<java.lang.Number> getSupplementalGroups()
A list of groups applied to the first process run in each container, in addition to the container's primary GID. If unspecified, no groups will be added to any container.
-
getSysctls
public java.util.List<Sysctl> getSysctls()
Sysctls hold a list of namespaced sysctls used for the pod. Pods with unsupported sysctls (by the container runtime) might fail to launch.
-
getWindowsOptions
public WindowsSecurityContextOptions getWindowsOptions()
-
setFsGroup
public void setFsGroup(java.lang.Number fsGroup)
A special supplemental group that applies to all containers in a pod. Some volume types allow the Kubelet to change the ownership of that volume to be owned by the pod:1. The owning GID will be the FSGroup 2. The setgid bit is set (new files created in the volume will be owned by FSGroup) 3. The permission bits are OR'd with rw-rw----
If unset, the Kubelet will not modify the ownership and permissions of any volume.
-
setFsGroupChangePolicy
public void setFsGroupChangePolicy(java.lang.String fsGroupChangePolicy)
fsGroupChangePolicy defines behavior of changing ownership and permission of the volume before being exposed inside Pod. This field will only apply to volume types which support fsGroup based ownership(and permissions). It will have no effect on ephemeral volume types such as: secret, configmaps and emptydir. Valid values are "OnRootMismatch" and "Always". If not specified defaults to "Always".
-
setRunAsGroup
public void setRunAsGroup(java.lang.Number runAsGroup)
The GID to run the entrypoint of the container process. Uses runtime default if unset. May also be set in SecurityContext. If set in both SecurityContext and PodSecurityContext, the value specified in SecurityContext takes precedence for that container.
-
setRunAsNonRoot
public void setRunAsNonRoot(java.lang.Boolean runAsNonRoot)
Indicates that the container must run as a non-root user. If true, the Kubelet will validate the image at runtime to ensure that it does not run as UID 0 (root) and fail to start the container if it does. If unset or false, no such validation will be performed. May also be set in SecurityContext. If set in both SecurityContext and PodSecurityContext, the value specified in SecurityContext takes precedence.
-
setRunAsUser
public void setRunAsUser(java.lang.Number runAsUser)
The UID to run the entrypoint of the container process. Defaults to user specified in image metadata if unspecified. May also be set in SecurityContext. If set in both SecurityContext and PodSecurityContext, the value specified in SecurityContext takes precedence for that container.
-
setSeLinuxOptions
public void setSeLinuxOptions(SELinuxOptions seLinuxOptions)
-
setSeccompProfile
public void setSeccompProfile(SeccompProfile seccompProfile)
-
setSupplementalGroups
public void setSupplementalGroups(java.util.List<java.lang.Number> supplementalGroups)
A list of groups applied to the first process run in each container, in addition to the container's primary GID. If unspecified, no groups will be added to any container.
-
setSysctls
public void setSysctls(java.util.List<Sysctl> sysctls)
Sysctls hold a list of namespaced sysctls used for the pod. Pods with unsupported sysctls (by the container runtime) might fail to launch.
-
setWindowsOptions
public void setWindowsOptions(WindowsSecurityContextOptions windowsOptions)
-
equals
public boolean equals(java.lang.Object o)
- Overrides:
equals
in classjava.lang.Object
-
canEqual
protected boolean canEqual(java.lang.Object other)
-
hashCode
public int hashCode()
- Overrides:
hashCode
in classjava.lang.Object
-
toString
public java.lang.String toString()
- Overrides:
toString
in classjava.lang.Object
-
-