io.kubernetes.client.models

Class PolicyV1beta1PodSecurityPolicySpec

java.lang.Object

io.kubernetes.client.models.PolicyV1beta1PodSecurityPolicySpec

public class PolicyV1beta1PodSecurityPolicySpec
extends Object

PodSecurityPolicySpec defines the policy enforced.

Constructor Summary

Constructors

Constructor and Description
PolicyV1beta1PodSecurityPolicySpec()

Method Summary

Modifier and Type	Method and Description
PolicyV1beta1PodSecurityPolicySpec	addAllowedCapabilitiesItem(String allowedCapabilitiesItem)
PolicyV1beta1PodSecurityPolicySpec	addAllowedFlexVolumesItem(PolicyV1beta1AllowedFlexVolume allowedFlexVolumesItem)
PolicyV1beta1PodSecurityPolicySpec	addAllowedHostPathsItem(PolicyV1beta1AllowedHostPath allowedHostPathsItem)
PolicyV1beta1PodSecurityPolicySpec	addAllowedProcMountTypesItem(String allowedProcMountTypesItem)
PolicyV1beta1PodSecurityPolicySpec	addAllowedUnsafeSysctlsItem(String allowedUnsafeSysctlsItem)
PolicyV1beta1PodSecurityPolicySpec	addDefaultAddCapabilitiesItem(String defaultAddCapabilitiesItem)
PolicyV1beta1PodSecurityPolicySpec	addForbiddenSysctlsItem(String forbiddenSysctlsItem)
PolicyV1beta1PodSecurityPolicySpec	addHostPortsItem(PolicyV1beta1HostPortRange hostPortsItem)
PolicyV1beta1PodSecurityPolicySpec	addRequiredDropCapabilitiesItem(String requiredDropCapabilitiesItem)
PolicyV1beta1PodSecurityPolicySpec	addVolumesItem(String volumesItem)
PolicyV1beta1PodSecurityPolicySpec	allowedCapabilities(List<String> allowedCapabilities)
PolicyV1beta1PodSecurityPolicySpec	allowedFlexVolumes(List<PolicyV1beta1AllowedFlexVolume> allowedFlexVolumes)
PolicyV1beta1PodSecurityPolicySpec	allowedHostPaths(List<PolicyV1beta1AllowedHostPath> allowedHostPaths)
PolicyV1beta1PodSecurityPolicySpec	allowedProcMountTypes(List<String> allowedProcMountTypes)
PolicyV1beta1PodSecurityPolicySpec	allowedUnsafeSysctls(List<String> allowedUnsafeSysctls)
PolicyV1beta1PodSecurityPolicySpec	allowPrivilegeEscalation(Boolean allowPrivilegeEscalation)
PolicyV1beta1PodSecurityPolicySpec	defaultAddCapabilities(List<String> defaultAddCapabilities)
PolicyV1beta1PodSecurityPolicySpec	defaultAllowPrivilegeEscalation(Boolean defaultAllowPrivilegeEscalation)
boolean	equals(Object o)
PolicyV1beta1PodSecurityPolicySpec	forbiddenSysctls(List<String> forbiddenSysctls)
PolicyV1beta1PodSecurityPolicySpec	fsGroup(PolicyV1beta1FSGroupStrategyOptions fsGroup)
List<String>	getAllowedCapabilities() allowedCapabilities is a list of capabilities that can be requested to add to the container.
List<PolicyV1beta1AllowedFlexVolume>	getAllowedFlexVolumes() allowedFlexVolumes is a whitelist of allowed Flexvolumes.
List<PolicyV1beta1AllowedHostPath>	getAllowedHostPaths() allowedHostPaths is a white list of allowed host paths.
List<String>	getAllowedProcMountTypes() AllowedProcMountTypes is a whitelist of allowed ProcMountTypes.
List<String>	getAllowedUnsafeSysctls() allowedUnsafeSysctls is a list of explicitly allowed unsafe sysctls, defaults to none.
List<String>	getDefaultAddCapabilities() defaultAddCapabilities is the default set of capabilities that will be added to the container unless the pod spec specifically drops the capability.
List<String>	getForbiddenSysctls() forbiddenSysctls is a list of explicitly forbidden sysctls, defaults to none.
PolicyV1beta1FSGroupStrategyOptions	getFsGroup() fsGroup is the strategy that will dictate what fs group is used by the SecurityContext.
List<PolicyV1beta1HostPortRange>	getHostPorts() hostPorts determines which host port ranges are allowed to be exposed.
List<String>	getRequiredDropCapabilities() requiredDropCapabilities are the capabilities that will be dropped from the container.
PolicyV1beta1RunAsUserStrategyOptions	getRunAsUser() runAsUser is the strategy that will dictate the allowable RunAsUser values that may be set.
PolicyV1beta1SELinuxStrategyOptions	getSeLinux() seLinux is the strategy that will dictate the allowable labels that may be set.
PolicyV1beta1SupplementalGroupsStrategyOptions	getSupplementalGroups() supplementalGroups is the strategy that will dictate what supplemental groups are used by the SecurityContext.
List<String>	getVolumes() volumes is a white list of allowed volume plugins.
int	hashCode()
PolicyV1beta1PodSecurityPolicySpec	hostIPC(Boolean hostIPC)
PolicyV1beta1PodSecurityPolicySpec	hostNetwork(Boolean hostNetwork)
PolicyV1beta1PodSecurityPolicySpec	hostPID(Boolean hostPID)
PolicyV1beta1PodSecurityPolicySpec	hostPorts(List<PolicyV1beta1HostPortRange> hostPorts)
Boolean	isAllowPrivilegeEscalation() allowPrivilegeEscalation determines if a pod can request to allow privilege escalation.
Boolean	isDefaultAllowPrivilegeEscalation() defaultAllowPrivilegeEscalation controls the default setting for whether a process can gain more privileges than its parent process.
Boolean	isHostIPC() hostIPC determines if the policy allows the use of HostIPC in the pod spec.
Boolean	isHostNetwork() hostNetwork determines if the policy allows the use of HostNetwork in the pod spec.
Boolean	isHostPID() hostPID determines if the policy allows the use of HostPID in the pod spec.
Boolean	isPrivileged() privileged determines if a pod can request to be run as privileged.
Boolean	isReadOnlyRootFilesystem() readOnlyRootFilesystem when set to true will force containers to run with a read only root file system.
PolicyV1beta1PodSecurityPolicySpec	privileged(Boolean privileged)
PolicyV1beta1PodSecurityPolicySpec	readOnlyRootFilesystem(Boolean readOnlyRootFilesystem)
PolicyV1beta1PodSecurityPolicySpec	requiredDropCapabilities(List<String> requiredDropCapabilities)
PolicyV1beta1PodSecurityPolicySpec	runAsUser(PolicyV1beta1RunAsUserStrategyOptions runAsUser)
PolicyV1beta1PodSecurityPolicySpec	seLinux(PolicyV1beta1SELinuxStrategyOptions seLinux)
void	setAllowedCapabilities(List<String> allowedCapabilities)
void	setAllowedFlexVolumes(List<PolicyV1beta1AllowedFlexVolume> allowedFlexVolumes)
void	setAllowedHostPaths(List<PolicyV1beta1AllowedHostPath> allowedHostPaths)
void	setAllowedProcMountTypes(List<String> allowedProcMountTypes)
void	setAllowedUnsafeSysctls(List<String> allowedUnsafeSysctls)
void	setAllowPrivilegeEscalation(Boolean allowPrivilegeEscalation)
void	setDefaultAddCapabilities(List<String> defaultAddCapabilities)
void	setDefaultAllowPrivilegeEscalation(Boolean defaultAllowPrivilegeEscalation)
void	setForbiddenSysctls(List<String> forbiddenSysctls)
void	setFsGroup(PolicyV1beta1FSGroupStrategyOptions fsGroup)
void	setHostIPC(Boolean hostIPC)
void	setHostNetwork(Boolean hostNetwork)
void	setHostPID(Boolean hostPID)
void	setHostPorts(List<PolicyV1beta1HostPortRange> hostPorts)
void	setPrivileged(Boolean privileged)
void	setReadOnlyRootFilesystem(Boolean readOnlyRootFilesystem)
void	setRequiredDropCapabilities(List<String> requiredDropCapabilities)
void	setRunAsUser(PolicyV1beta1RunAsUserStrategyOptions runAsUser)
void	setSeLinux(PolicyV1beta1SELinuxStrategyOptions seLinux)
void	setSupplementalGroups(PolicyV1beta1SupplementalGroupsStrategyOptions supplementalGroups)
void	setVolumes(List<String> volumes)
PolicyV1beta1PodSecurityPolicySpec	supplementalGroups(PolicyV1beta1SupplementalGroupsStrategyOptions supplementalGroups)
String	toString()
PolicyV1beta1PodSecurityPolicySpec	volumes(List<String> volumes)

Methods inherited from class java.lang.Object

clone, finalize, getClass, notify, notifyAll, wait, wait, wait

Constructor Detail

PolicyV1beta1PodSecurityPolicySpec

public PolicyV1beta1PodSecurityPolicySpec()

Method Detail

allowPrivilegeEscalation

public PolicyV1beta1PodSecurityPolicySpec allowPrivilegeEscalation(Boolean allowPrivilegeEscalation)

isAllowPrivilegeEscalation

public Boolean isAllowPrivilegeEscalation()

allowPrivilegeEscalation determines if a pod can request to allow privilege escalation. If unspecified, defaults to true.

Returns:

allowPrivilegeEscalation

setAllowPrivilegeEscalation

public void setAllowPrivilegeEscalation(Boolean allowPrivilegeEscalation)

allowedCapabilities

public PolicyV1beta1PodSecurityPolicySpec allowedCapabilities(List<String> allowedCapabilities)

addAllowedCapabilitiesItem

public PolicyV1beta1PodSecurityPolicySpec addAllowedCapabilitiesItem(String allowedCapabilitiesItem)

getAllowedCapabilities

public List<String> getAllowedCapabilities()

allowedCapabilities is a list of capabilities that can be requested to add to the container. Capabilities in this field may be added at the pod author's discretion. You must not list a capability in both allowedCapabilities and requiredDropCapabilities.

Returns:

allowedCapabilities

setAllowedCapabilities

public void setAllowedCapabilities(List<String> allowedCapabilities)

allowedFlexVolumes

public PolicyV1beta1PodSecurityPolicySpec allowedFlexVolumes(List<PolicyV1beta1AllowedFlexVolume> allowedFlexVolumes)

addAllowedFlexVolumesItem

public PolicyV1beta1PodSecurityPolicySpec addAllowedFlexVolumesItem(PolicyV1beta1AllowedFlexVolume allowedFlexVolumesItem)

getAllowedFlexVolumes

public List<PolicyV1beta1AllowedFlexVolume> getAllowedFlexVolumes()

allowedFlexVolumes is a whitelist of allowed Flexvolumes. Empty or nil indicates that all Flexvolumes may be used. This parameter is effective only when the usage of the Flexvolumes is allowed in the \"volumes\" field.

Returns:

allowedFlexVolumes

setAllowedFlexVolumes

public void setAllowedFlexVolumes(List<PolicyV1beta1AllowedFlexVolume> allowedFlexVolumes)

allowedHostPaths

public PolicyV1beta1PodSecurityPolicySpec allowedHostPaths(List<PolicyV1beta1AllowedHostPath> allowedHostPaths)

addAllowedHostPathsItem

public PolicyV1beta1PodSecurityPolicySpec addAllowedHostPathsItem(PolicyV1beta1AllowedHostPath allowedHostPathsItem)

getAllowedHostPaths

public List<PolicyV1beta1AllowedHostPath> getAllowedHostPaths()

allowedHostPaths is a white list of allowed host paths. Empty indicates that all host paths may be used.

Returns:

allowedHostPaths

setAllowedHostPaths

public void setAllowedHostPaths(List<PolicyV1beta1AllowedHostPath> allowedHostPaths)

allowedProcMountTypes

public PolicyV1beta1PodSecurityPolicySpec allowedProcMountTypes(List<String> allowedProcMountTypes)

addAllowedProcMountTypesItem

public PolicyV1beta1PodSecurityPolicySpec addAllowedProcMountTypesItem(String allowedProcMountTypesItem)

getAllowedProcMountTypes

public List<String> getAllowedProcMountTypes()

AllowedProcMountTypes is a whitelist of allowed ProcMountTypes. Empty or nil indicates that only the DefaultProcMountType may be used. This requires the ProcMountType feature flag to be enabled.

Returns:

allowedProcMountTypes

setAllowedProcMountTypes

public void setAllowedProcMountTypes(List<String> allowedProcMountTypes)

allowedUnsafeSysctls

public PolicyV1beta1PodSecurityPolicySpec allowedUnsafeSysctls(List<String> allowedUnsafeSysctls)

addAllowedUnsafeSysctlsItem

public PolicyV1beta1PodSecurityPolicySpec addAllowedUnsafeSysctlsItem(String allowedUnsafeSysctlsItem)

getAllowedUnsafeSysctls

public List<String> getAllowedUnsafeSysctls()

allowedUnsafeSysctls is a list of explicitly allowed unsafe sysctls, defaults to none. Each entry is either a plain sysctl name or ends in \"*\" in which case it is considered as a prefix of allowed sysctls. Single * means all unsafe sysctls are allowed. Kubelet has to whitelist all allowed unsafe sysctls explicitly to avoid rejection. Examples: e.g. \"foo/_*\" allows \"foo/bar\", \"foo/baz\", etc. e.g. \"foo.*\" allows \"foo.bar\", \"foo.baz\", etc.

Returns:

allowedUnsafeSysctls

setAllowedUnsafeSysctls

public void setAllowedUnsafeSysctls(List<String> allowedUnsafeSysctls)

defaultAddCapabilities

public PolicyV1beta1PodSecurityPolicySpec defaultAddCapabilities(List<String> defaultAddCapabilities)

addDefaultAddCapabilitiesItem

public PolicyV1beta1PodSecurityPolicySpec addDefaultAddCapabilitiesItem(String defaultAddCapabilitiesItem)

getDefaultAddCapabilities

public List<String> getDefaultAddCapabilities()

defaultAddCapabilities is the default set of capabilities that will be added to the container unless the pod spec specifically drops the capability. You may not list a capability in both defaultAddCapabilities and requiredDropCapabilities. Capabilities added here are implicitly allowed, and need not be included in the allowedCapabilities list.

Returns:

defaultAddCapabilities

setDefaultAddCapabilities

public void setDefaultAddCapabilities(List<String> defaultAddCapabilities)

defaultAllowPrivilegeEscalation

public PolicyV1beta1PodSecurityPolicySpec defaultAllowPrivilegeEscalation(Boolean defaultAllowPrivilegeEscalation)

isDefaultAllowPrivilegeEscalation

public Boolean isDefaultAllowPrivilegeEscalation()

defaultAllowPrivilegeEscalation controls the default setting for whether a process can gain more privileges than its parent process.

Returns:

defaultAllowPrivilegeEscalation

setDefaultAllowPrivilegeEscalation

public void setDefaultAllowPrivilegeEscalation(Boolean defaultAllowPrivilegeEscalation)

forbiddenSysctls

public PolicyV1beta1PodSecurityPolicySpec forbiddenSysctls(List<String> forbiddenSysctls)

addForbiddenSysctlsItem

public PolicyV1beta1PodSecurityPolicySpec addForbiddenSysctlsItem(String forbiddenSysctlsItem)

getForbiddenSysctls

public List<String> getForbiddenSysctls()

forbiddenSysctls is a list of explicitly forbidden sysctls, defaults to none. Each entry is either a plain sysctl name or ends in \"*\" in which case it is considered as a prefix of forbidden sysctls. Single * means all sysctls are forbidden. Examples: e.g. \"foo/_*\" forbids \"foo/bar\", \"foo/baz\", etc. e.g. \"foo.*\" forbids \"foo.bar\", \"foo.baz\", etc.

Returns:

forbiddenSysctls

setForbiddenSysctls

public void setForbiddenSysctls(List<String> forbiddenSysctls)

fsGroup

public PolicyV1beta1PodSecurityPolicySpec fsGroup(PolicyV1beta1FSGroupStrategyOptions fsGroup)

getFsGroup

public PolicyV1beta1FSGroupStrategyOptions getFsGroup()

fsGroup is the strategy that will dictate what fs group is used by the SecurityContext.

Returns:

fsGroup

setFsGroup

public void setFsGroup(PolicyV1beta1FSGroupStrategyOptions fsGroup)

hostIPC

public PolicyV1beta1PodSecurityPolicySpec hostIPC(Boolean hostIPC)

isHostIPC

public Boolean isHostIPC()

hostIPC determines if the policy allows the use of HostIPC in the pod spec.

Returns:

hostIPC

setHostIPC

public void setHostIPC(Boolean hostIPC)

hostNetwork

public PolicyV1beta1PodSecurityPolicySpec hostNetwork(Boolean hostNetwork)

isHostNetwork

public Boolean isHostNetwork()

hostNetwork determines if the policy allows the use of HostNetwork in the pod spec.

Returns:

hostNetwork

setHostNetwork

public void setHostNetwork(Boolean hostNetwork)

hostPID

public PolicyV1beta1PodSecurityPolicySpec hostPID(Boolean hostPID)

isHostPID

public Boolean isHostPID()

hostPID determines if the policy allows the use of HostPID in the pod spec.

Returns:

hostPID

setHostPID

public void setHostPID(Boolean hostPID)

hostPorts

public PolicyV1beta1PodSecurityPolicySpec hostPorts(List<PolicyV1beta1HostPortRange> hostPorts)

addHostPortsItem

public PolicyV1beta1PodSecurityPolicySpec addHostPortsItem(PolicyV1beta1HostPortRange hostPortsItem)

getHostPorts

public List<PolicyV1beta1HostPortRange> getHostPorts()

hostPorts determines which host port ranges are allowed to be exposed.

Returns:

hostPorts

setHostPorts

public void setHostPorts(List<PolicyV1beta1HostPortRange> hostPorts)

privileged

public PolicyV1beta1PodSecurityPolicySpec privileged(Boolean privileged)

isPrivileged

public Boolean isPrivileged()

privileged determines if a pod can request to be run as privileged.

Returns:

privileged

setPrivileged

public void setPrivileged(Boolean privileged)

readOnlyRootFilesystem

public PolicyV1beta1PodSecurityPolicySpec readOnlyRootFilesystem(Boolean readOnlyRootFilesystem)

isReadOnlyRootFilesystem

public Boolean isReadOnlyRootFilesystem()

readOnlyRootFilesystem when set to true will force containers to run with a read only root file system. If the container specifically requests to run with a non-read only root file system the PSP should deny the pod. If set to false the container may run with a read only root file system if it wishes but it will not be forced to.

Returns:

readOnlyRootFilesystem

setReadOnlyRootFilesystem

public void setReadOnlyRootFilesystem(Boolean readOnlyRootFilesystem)

requiredDropCapabilities

public PolicyV1beta1PodSecurityPolicySpec requiredDropCapabilities(List<String> requiredDropCapabilities)

addRequiredDropCapabilitiesItem

public PolicyV1beta1PodSecurityPolicySpec addRequiredDropCapabilitiesItem(String requiredDropCapabilitiesItem)

getRequiredDropCapabilities

public List<String> getRequiredDropCapabilities()

requiredDropCapabilities are the capabilities that will be dropped from the container. These are required to be dropped and cannot be added.

Returns:

requiredDropCapabilities

setRequiredDropCapabilities

public void setRequiredDropCapabilities(List<String> requiredDropCapabilities)

runAsUser

public PolicyV1beta1PodSecurityPolicySpec runAsUser(PolicyV1beta1RunAsUserStrategyOptions runAsUser)

getRunAsUser

public PolicyV1beta1RunAsUserStrategyOptions getRunAsUser()

runAsUser is the strategy that will dictate the allowable RunAsUser values that may be set.

Returns:

runAsUser

setRunAsUser

public void setRunAsUser(PolicyV1beta1RunAsUserStrategyOptions runAsUser)

seLinux

public PolicyV1beta1PodSecurityPolicySpec seLinux(PolicyV1beta1SELinuxStrategyOptions seLinux)

getSeLinux

public PolicyV1beta1SELinuxStrategyOptions getSeLinux()

seLinux is the strategy that will dictate the allowable labels that may be set.

Returns:

seLinux

setSeLinux

public void setSeLinux(PolicyV1beta1SELinuxStrategyOptions seLinux)

supplementalGroups

public PolicyV1beta1PodSecurityPolicySpec supplementalGroups(PolicyV1beta1SupplementalGroupsStrategyOptions supplementalGroups)

getSupplementalGroups

public PolicyV1beta1SupplementalGroupsStrategyOptions getSupplementalGroups()

supplementalGroups is the strategy that will dictate what supplemental groups are used by the SecurityContext.

Returns:

supplementalGroups

setSupplementalGroups

public void setSupplementalGroups(PolicyV1beta1SupplementalGroupsStrategyOptions supplementalGroups)

volumes

public PolicyV1beta1PodSecurityPolicySpec volumes(List<String> volumes)

addVolumesItem

public PolicyV1beta1PodSecurityPolicySpec addVolumesItem(String volumesItem)

getVolumes

public List<String> getVolumes()

volumes is a white list of allowed volume plugins. Empty indicates that no volumes may be used. To allow all volumes you may use '*'.

Returns:

volumes

setVolumes

public void setVolumes(List<String> volumes)

equals

public boolean equals(Object o)

Overrides:

equals in class Object

hashCode

public int hashCode()

Overrides:

hashCode in class Object

toString

public String toString()

Overrides:

toString in class Object