Package io.kubernetes.client.proto

Interface V1.SecurityContextOrBuilder

All Superinterfaces:
com.google.protobuf.MessageLiteOrBuilder, com.google.protobuf.MessageOrBuilder
All Known Implementing Classes:
V1.SecurityContext, V1.SecurityContext.Builder
Enclosing class:
V1
public static interface V1.SecurityContextOrBuilder extends com.google.protobuf.MessageOrBuilder

  • Method Details

    • hasCapabilities

      boolean hasCapabilities()
       The capabilities to add/drop when running containers.
 Defaults to the default set of capabilities granted by the container runtime.
 Note that this field cannot be set when spec.os.name is windows.
 +optional
      optional .k8s.io.api.core.v1.Capabilities capabilities = 1;

    • getCapabilities

      V1.Capabilities getCapabilities()
       The capabilities to add/drop when running containers.
 Defaults to the default set of capabilities granted by the container runtime.
 Note that this field cannot be set when spec.os.name is windows.
 +optional
      optional .k8s.io.api.core.v1.Capabilities capabilities = 1;

    • getCapabilitiesOrBuilder

      V1.CapabilitiesOrBuilder getCapabilitiesOrBuilder()
       The capabilities to add/drop when running containers.
 Defaults to the default set of capabilities granted by the container runtime.
 Note that this field cannot be set when spec.os.name is windows.
 +optional
      optional .k8s.io.api.core.v1.Capabilities capabilities = 1;

    • hasPrivileged

      boolean hasPrivileged()
       Run container in privileged mode.
 Processes in privileged containers are essentially equivalent to root on the host.
 Defaults to false.
 Note that this field cannot be set when spec.os.name is windows.
 +optional
      optional bool privileged = 2;

    • getPrivileged

      boolean getPrivileged()
       Run container in privileged mode.
 Processes in privileged containers are essentially equivalent to root on the host.
 Defaults to false.
 Note that this field cannot be set when spec.os.name is windows.
 +optional
      optional bool privileged = 2;

    • hasSeLinuxOptions

      boolean hasSeLinuxOptions()
       The SELinux context to be applied to the container.
 If unspecified, the container runtime will allocate a random SELinux context for each
 container.  May also be set in PodSecurityContext.  If set in both SecurityContext and
 PodSecurityContext, the value specified in SecurityContext takes precedence.
 Note that this field cannot be set when spec.os.name is windows.
 +optional
      optional .k8s.io.api.core.v1.SELinuxOptions seLinuxOptions = 3;

    • getSeLinuxOptions

      V1.SELinuxOptions getSeLinuxOptions()
       The SELinux context to be applied to the container.
 If unspecified, the container runtime will allocate a random SELinux context for each
 container.  May also be set in PodSecurityContext.  If set in both SecurityContext and
 PodSecurityContext, the value specified in SecurityContext takes precedence.
 Note that this field cannot be set when spec.os.name is windows.
 +optional
      optional .k8s.io.api.core.v1.SELinuxOptions seLinuxOptions = 3;

    • getSeLinuxOptionsOrBuilder

      V1.SELinuxOptionsOrBuilder getSeLinuxOptionsOrBuilder()
       The SELinux context to be applied to the container.
 If unspecified, the container runtime will allocate a random SELinux context for each
 container.  May also be set in PodSecurityContext.  If set in both SecurityContext and
 PodSecurityContext, the value specified in SecurityContext takes precedence.
 Note that this field cannot be set when spec.os.name is windows.
 +optional
      optional .k8s.io.api.core.v1.SELinuxOptions seLinuxOptions = 3;

    • hasWindowsOptions

      boolean hasWindowsOptions()
       The Windows specific settings applied to all containers.
 If unspecified, the options from the PodSecurityContext will be used.
 If set in both SecurityContext and PodSecurityContext, the value specified in SecurityContext takes precedence.
 Note that this field cannot be set when spec.os.name is linux.
 +optional
      optional .k8s.io.api.core.v1.WindowsSecurityContextOptions windowsOptions = 10;

    • getWindowsOptions

      V1.WindowsSecurityContextOptions getWindowsOptions()
       The Windows specific settings applied to all containers.
 If unspecified, the options from the PodSecurityContext will be used.
 If set in both SecurityContext and PodSecurityContext, the value specified in SecurityContext takes precedence.
 Note that this field cannot be set when spec.os.name is linux.
 +optional
      optional .k8s.io.api.core.v1.WindowsSecurityContextOptions windowsOptions = 10;

    • getWindowsOptionsOrBuilder

      V1.WindowsSecurityContextOptionsOrBuilder getWindowsOptionsOrBuilder()
       The Windows specific settings applied to all containers.
 If unspecified, the options from the PodSecurityContext will be used.
 If set in both SecurityContext and PodSecurityContext, the value specified in SecurityContext takes precedence.
 Note that this field cannot be set when spec.os.name is linux.
 +optional
      optional .k8s.io.api.core.v1.WindowsSecurityContextOptions windowsOptions = 10;

    • hasRunAsUser

      boolean hasRunAsUser()
       The UID to run the entrypoint of the container process.
 Defaults to user specified in image metadata if unspecified.
 May also be set in PodSecurityContext.  If set in both SecurityContext and
 PodSecurityContext, the value specified in SecurityContext takes precedence.
 Note that this field cannot be set when spec.os.name is windows.
 +optional
      optional int64 runAsUser = 4;

    • getRunAsUser

      long getRunAsUser()
       The UID to run the entrypoint of the container process.
 Defaults to user specified in image metadata if unspecified.
 May also be set in PodSecurityContext.  If set in both SecurityContext and
 PodSecurityContext, the value specified in SecurityContext takes precedence.
 Note that this field cannot be set when spec.os.name is windows.
 +optional
      optional int64 runAsUser = 4;

    • hasRunAsGroup

      boolean hasRunAsGroup()
       The GID to run the entrypoint of the container process.
 Uses runtime default if unset.
 May also be set in PodSecurityContext.  If set in both SecurityContext and
 PodSecurityContext, the value specified in SecurityContext takes precedence.
 Note that this field cannot be set when spec.os.name is windows.
 +optional
      optional int64 runAsGroup = 8;

    • getRunAsGroup

      long getRunAsGroup()
       The GID to run the entrypoint of the container process.
 Uses runtime default if unset.
 May also be set in PodSecurityContext.  If set in both SecurityContext and
 PodSecurityContext, the value specified in SecurityContext takes precedence.
 Note that this field cannot be set when spec.os.name is windows.
 +optional
      optional int64 runAsGroup = 8;

    • hasRunAsNonRoot

      boolean hasRunAsNonRoot()
       Indicates that the container must run as a non-root user.
 If true, the Kubelet will validate the image at runtime to ensure that it
 does not run as UID 0 (root) and fail to start the container if it does.
 If unset or false, no such validation will be performed.
 May also be set in PodSecurityContext.  If set in both SecurityContext and
 PodSecurityContext, the value specified in SecurityContext takes precedence.
 +optional
      optional bool runAsNonRoot = 5;

    • getRunAsNonRoot

      boolean getRunAsNonRoot()
       Indicates that the container must run as a non-root user.
 If true, the Kubelet will validate the image at runtime to ensure that it
 does not run as UID 0 (root) and fail to start the container if it does.
 If unset or false, no such validation will be performed.
 May also be set in PodSecurityContext.  If set in both SecurityContext and
 PodSecurityContext, the value specified in SecurityContext takes precedence.
 +optional
      optional bool runAsNonRoot = 5;

    • hasReadOnlyRootFilesystem

      boolean hasReadOnlyRootFilesystem()
       Whether this container has a read-only root filesystem.
 Default is false.
 Note that this field cannot be set when spec.os.name is windows.
 +optional
      optional bool readOnlyRootFilesystem = 6;

    • getReadOnlyRootFilesystem

      boolean getReadOnlyRootFilesystem()
       Whether this container has a read-only root filesystem.
 Default is false.
 Note that this field cannot be set when spec.os.name is windows.
 +optional
      optional bool readOnlyRootFilesystem = 6;

    • hasAllowPrivilegeEscalation

      boolean hasAllowPrivilegeEscalation()
       AllowPrivilegeEscalation controls whether a process can gain more
 privileges than its parent process. This bool directly controls if
 the no_new_privs flag will be set on the container process.
 AllowPrivilegeEscalation is true always when the container is:
 1) run as Privileged
 2) has CAP_SYS_ADMIN
 Note that this field cannot be set when spec.os.name is windows.
 +optional
      optional bool allowPrivilegeEscalation = 7;

    • getAllowPrivilegeEscalation

      boolean getAllowPrivilegeEscalation()
       AllowPrivilegeEscalation controls whether a process can gain more
 privileges than its parent process. This bool directly controls if
 the no_new_privs flag will be set on the container process.
 AllowPrivilegeEscalation is true always when the container is:
 1) run as Privileged
 2) has CAP_SYS_ADMIN
 Note that this field cannot be set when spec.os.name is windows.
 +optional
      optional bool allowPrivilegeEscalation = 7;

    • hasProcMount

      boolean hasProcMount()
       procMount denotes the type of proc mount to use for the containers.
 The default is DefaultProcMount which uses the container runtime defaults for
 readonly paths and masked paths.
 This requires the ProcMountType feature flag to be enabled.
 Note that this field cannot be set when spec.os.name is windows.
 +optional
      optional string procMount = 9;

    • getProcMount

      String getProcMount()
       procMount denotes the type of proc mount to use for the containers.
 The default is DefaultProcMount which uses the container runtime defaults for
 readonly paths and masked paths.
 This requires the ProcMountType feature flag to be enabled.
 Note that this field cannot be set when spec.os.name is windows.
 +optional
      optional string procMount = 9;

    • getProcMountBytes

      com.google.protobuf.ByteString getProcMountBytes()
       procMount denotes the type of proc mount to use for the containers.
 The default is DefaultProcMount which uses the container runtime defaults for
 readonly paths and masked paths.
 This requires the ProcMountType feature flag to be enabled.
 Note that this field cannot be set when spec.os.name is windows.
 +optional
      optional string procMount = 9;

    • hasSeccompProfile

      boolean hasSeccompProfile()
       The seccomp options to use by this container. If seccomp options are
 provided at both the pod & container level, the container options
 override the pod options.
 Note that this field cannot be set when spec.os.name is windows.
 +optional
      optional .k8s.io.api.core.v1.SeccompProfile seccompProfile = 11;

    • getSeccompProfile

      V1.SeccompProfile getSeccompProfile()
       The seccomp options to use by this container. If seccomp options are
 provided at both the pod & container level, the container options
 override the pod options.
 Note that this field cannot be set when spec.os.name is windows.
 +optional
      optional .k8s.io.api.core.v1.SeccompProfile seccompProfile = 11;

    • getSeccompProfileOrBuilder

      V1.SeccompProfileOrBuilder getSeccompProfileOrBuilder()
       The seccomp options to use by this container. If seccomp options are
 provided at both the pod & container level, the container options
 override the pod options.
 Note that this field cannot be set when spec.os.name is windows.
 +optional
      optional .k8s.io.api.core.v1.SeccompProfile seccompProfile = 11;