Class PodSecurityPolicySpecV1Beta1.Jsii$Proxy
- java.lang.Object
-
- software.amazon.jsii.JsiiObject
-
- org.cdk8s.plus24.k8s.PodSecurityPolicySpecV1Beta1.Jsii$Proxy
-
- All Implemented Interfaces:
PodSecurityPolicySpecV1Beta1
,software.amazon.jsii.JsiiSerializable
- Enclosing interface:
- PodSecurityPolicySpecV1Beta1
@Stability(Stable) @Internal public static final class PodSecurityPolicySpecV1Beta1.Jsii$Proxy extends software.amazon.jsii.JsiiObject implements PodSecurityPolicySpecV1Beta1
An implementation forPodSecurityPolicySpecV1Beta1
-
-
Nested Class Summary
-
Nested classes/interfaces inherited from class software.amazon.jsii.JsiiObject
software.amazon.jsii.JsiiObject.InitializationMode
-
Nested classes/interfaces inherited from interface org.cdk8s.plus24.k8s.PodSecurityPolicySpecV1Beta1
PodSecurityPolicySpecV1Beta1.Builder, PodSecurityPolicySpecV1Beta1.Jsii$Proxy
-
-
Constructor Summary
Constructors Modifier Constructor Description protected
Jsii$Proxy(PodSecurityPolicySpecV1Beta1.Builder builder)
Constructor that initializes the object based on literal property values passed by thePodSecurityPolicySpecV1Beta1.Builder
.protected
Jsii$Proxy(software.amazon.jsii.JsiiObjectRef objRef)
Constructor that initializes the object based on values retrieved from the JsiiObject.
-
Method Summary
All Methods Instance Methods Concrete Methods Modifier and Type Method Description com.fasterxml.jackson.databind.JsonNode
$jsii$toJson()
boolean
equals(Object o)
List<String>
getAllowedCapabilities()
allowedCapabilities is a list of capabilities that can be requested to add to the container.List<AllowedCsiDriverV1Beta1>
getAllowedCsiDrivers()
AllowedCSIDrivers is an allowlist of inline CSI drivers that must be explicitly set to be embedded within a pod spec.List<AllowedFlexVolumeV1Beta1>
getAllowedFlexVolumes()
allowedFlexVolumes is an allowlist of Flexvolumes.List<AllowedHostPathV1Beta1>
getAllowedHostPaths()
allowedHostPaths is an allowlist of host paths.List<String>
getAllowedProcMountTypes()
AllowedProcMountTypes is an allowlist of allowed ProcMountTypes.List<String>
getAllowedUnsafeSysctls()
allowedUnsafeSysctls is a list of explicitly allowed unsafe sysctls, defaults to none.Boolean
getAllowPrivilegeEscalation()
allowPrivilegeEscalation determines if a pod can request to allow privilege escalation.List<String>
getDefaultAddCapabilities()
defaultAddCapabilities is the default set of capabilities that will be added to the container unless the pod spec specifically drops the capability.Boolean
getDefaultAllowPrivilegeEscalation()
defaultAllowPrivilegeEscalation controls the default setting for whether a process can gain more privileges than its parent process.List<String>
getForbiddenSysctls()
forbiddenSysctls is a list of explicitly forbidden sysctls, defaults to none.FsGroupStrategyOptionsV1Beta1
getFsGroup()
fsGroup is the strategy that will dictate what fs group is used by the SecurityContext.Boolean
getHostIpc()
hostIPC determines if the policy allows the use of HostIPC in the pod spec.Boolean
getHostNetwork()
hostNetwork determines if the policy allows the use of HostNetwork in the pod spec.Boolean
getHostPid()
hostPID determines if the policy allows the use of HostPID in the pod spec.List<HostPortRangeV1Beta1>
getHostPorts()
hostPorts determines which host port ranges are allowed to be exposed.Boolean
getPrivileged()
privileged determines if a pod can request to be run as privileged.Boolean
getReadOnlyRootFilesystem()
readOnlyRootFilesystem when set to true will force containers to run with a read only root file system.List<String>
getRequiredDropCapabilities()
requiredDropCapabilities are the capabilities that will be dropped from the container.RunAsGroupStrategyOptionsV1Beta1
getRunAsGroup()
RunAsGroup is the strategy that will dictate the allowable RunAsGroup values that may be set.RunAsUserStrategyOptionsV1Beta1
getRunAsUser()
runAsUser is the strategy that will dictate the allowable RunAsUser values that may be set.RuntimeClassStrategyOptionsV1Beta1
getRuntimeClass()
runtimeClass is the strategy that will dictate the allowable RuntimeClasses for a pod.SeLinuxStrategyOptionsV1Beta1
getSeLinux()
seLinux is the strategy that will dictate the allowable labels that may be set.SupplementalGroupsStrategyOptionsV1Beta1
getSupplementalGroups()
supplementalGroups is the strategy that will dictate what supplemental groups are used by the SecurityContext.List<String>
getVolumes()
volumes is an allowlist of volume plugins.int
hashCode()
-
-
-
Constructor Detail
-
Jsii$Proxy
protected Jsii$Proxy(software.amazon.jsii.JsiiObjectRef objRef)
Constructor that initializes the object based on values retrieved from the JsiiObject.- Parameters:
objRef
- Reference to the JSII managed object.
-
Jsii$Proxy
protected Jsii$Proxy(PodSecurityPolicySpecV1Beta1.Builder builder)
Constructor that initializes the object based on literal property values passed by thePodSecurityPolicySpecV1Beta1.Builder
.
-
-
Method Detail
-
getFsGroup
public final FsGroupStrategyOptionsV1Beta1 getFsGroup()
Description copied from interface:PodSecurityPolicySpecV1Beta1
fsGroup is the strategy that will dictate what fs group is used by the SecurityContext.- Specified by:
getFsGroup
in interfacePodSecurityPolicySpecV1Beta1
-
getRunAsUser
public final RunAsUserStrategyOptionsV1Beta1 getRunAsUser()
Description copied from interface:PodSecurityPolicySpecV1Beta1
runAsUser is the strategy that will dictate the allowable RunAsUser values that may be set.- Specified by:
getRunAsUser
in interfacePodSecurityPolicySpecV1Beta1
-
getSeLinux
public final SeLinuxStrategyOptionsV1Beta1 getSeLinux()
Description copied from interface:PodSecurityPolicySpecV1Beta1
seLinux is the strategy that will dictate the allowable labels that may be set.- Specified by:
getSeLinux
in interfacePodSecurityPolicySpecV1Beta1
-
getSupplementalGroups
public final SupplementalGroupsStrategyOptionsV1Beta1 getSupplementalGroups()
Description copied from interface:PodSecurityPolicySpecV1Beta1
supplementalGroups is the strategy that will dictate what supplemental groups are used by the SecurityContext.- Specified by:
getSupplementalGroups
in interfacePodSecurityPolicySpecV1Beta1
-
getAllowedCapabilities
public final List<String> getAllowedCapabilities()
Description copied from interface:PodSecurityPolicySpecV1Beta1
allowedCapabilities is a list of capabilities that can be requested to add to the container.Capabilities in this field may be added at the pod author's discretion. You must not list a capability in both allowedCapabilities and requiredDropCapabilities.
- Specified by:
getAllowedCapabilities
in interfacePodSecurityPolicySpecV1Beta1
-
getAllowedCsiDrivers
public final List<AllowedCsiDriverV1Beta1> getAllowedCsiDrivers()
Description copied from interface:PodSecurityPolicySpecV1Beta1
AllowedCSIDrivers is an allowlist of inline CSI drivers that must be explicitly set to be embedded within a pod spec.An empty value indicates that any CSI driver can be used for inline ephemeral volumes. This is a beta field, and is only honored if the API server enables the CSIInlineVolume feature gate.
- Specified by:
getAllowedCsiDrivers
in interfacePodSecurityPolicySpecV1Beta1
-
getAllowedFlexVolumes
public final List<AllowedFlexVolumeV1Beta1> getAllowedFlexVolumes()
Description copied from interface:PodSecurityPolicySpecV1Beta1
allowedFlexVolumes is an allowlist of Flexvolumes.Empty or nil indicates that all Flexvolumes may be used. This parameter is effective only when the usage of the Flexvolumes is allowed in the "volumes" field.
- Specified by:
getAllowedFlexVolumes
in interfacePodSecurityPolicySpecV1Beta1
-
getAllowedHostPaths
public final List<AllowedHostPathV1Beta1> getAllowedHostPaths()
Description copied from interface:PodSecurityPolicySpecV1Beta1
allowedHostPaths is an allowlist of host paths.Empty indicates that all host paths may be used.
- Specified by:
getAllowedHostPaths
in interfacePodSecurityPolicySpecV1Beta1
-
getAllowedProcMountTypes
public final List<String> getAllowedProcMountTypes()
Description copied from interface:PodSecurityPolicySpecV1Beta1
AllowedProcMountTypes is an allowlist of allowed ProcMountTypes.Empty or nil indicates that only the DefaultProcMountType may be used. This requires the ProcMountType feature flag to be enabled.
- Specified by:
getAllowedProcMountTypes
in interfacePodSecurityPolicySpecV1Beta1
-
getAllowedUnsafeSysctls
public final List<String> getAllowedUnsafeSysctls()
Description copied from interface:PodSecurityPolicySpecV1Beta1
allowedUnsafeSysctls is a list of explicitly allowed unsafe sysctls, defaults to none.Each entry is either a plain sysctl name or ends in "*" in which case it is considered as a prefix of allowed sysctls. Single * means all unsafe sysctls are allowed. Kubelet has to allowlist all allowed unsafe sysctls explicitly to avoid rejection.
Examples: e.g. "foo/" allows "foo/bar", "foo/baz", etc. e.g. "foo." allows "foo.bar", "foo.baz", etc.
- Specified by:
getAllowedUnsafeSysctls
in interfacePodSecurityPolicySpecV1Beta1
-
getAllowPrivilegeEscalation
public final Boolean getAllowPrivilegeEscalation()
Description copied from interface:PodSecurityPolicySpecV1Beta1
allowPrivilegeEscalation determines if a pod can request to allow privilege escalation.If unspecified, defaults to true.
- Specified by:
getAllowPrivilegeEscalation
in interfacePodSecurityPolicySpecV1Beta1
-
getDefaultAddCapabilities
public final List<String> getDefaultAddCapabilities()
Description copied from interface:PodSecurityPolicySpecV1Beta1
defaultAddCapabilities is the default set of capabilities that will be added to the container unless the pod spec specifically drops the capability.You may not list a capability in both defaultAddCapabilities and requiredDropCapabilities. Capabilities added here are implicitly allowed, and need not be included in the allowedCapabilities list.
- Specified by:
getDefaultAddCapabilities
in interfacePodSecurityPolicySpecV1Beta1
-
getDefaultAllowPrivilegeEscalation
public final Boolean getDefaultAllowPrivilegeEscalation()
Description copied from interface:PodSecurityPolicySpecV1Beta1
defaultAllowPrivilegeEscalation controls the default setting for whether a process can gain more privileges than its parent process.- Specified by:
getDefaultAllowPrivilegeEscalation
in interfacePodSecurityPolicySpecV1Beta1
-
getForbiddenSysctls
public final List<String> getForbiddenSysctls()
Description copied from interface:PodSecurityPolicySpecV1Beta1
forbiddenSysctls is a list of explicitly forbidden sysctls, defaults to none.Each entry is either a plain sysctl name or ends in "*" in which case it is considered as a prefix of forbidden sysctls. Single * means all sysctls are forbidden.
Examples: e.g. "foo/" forbids "foo/bar", "foo/baz", etc. e.g. "foo." forbids "foo.bar", "foo.baz", etc.
- Specified by:
getForbiddenSysctls
in interfacePodSecurityPolicySpecV1Beta1
-
getHostIpc
public final Boolean getHostIpc()
Description copied from interface:PodSecurityPolicySpecV1Beta1
hostIPC determines if the policy allows the use of HostIPC in the pod spec.- Specified by:
getHostIpc
in interfacePodSecurityPolicySpecV1Beta1
-
getHostNetwork
public final Boolean getHostNetwork()
Description copied from interface:PodSecurityPolicySpecV1Beta1
hostNetwork determines if the policy allows the use of HostNetwork in the pod spec.- Specified by:
getHostNetwork
in interfacePodSecurityPolicySpecV1Beta1
-
getHostPid
public final Boolean getHostPid()
Description copied from interface:PodSecurityPolicySpecV1Beta1
hostPID determines if the policy allows the use of HostPID in the pod spec.- Specified by:
getHostPid
in interfacePodSecurityPolicySpecV1Beta1
-
getHostPorts
public final List<HostPortRangeV1Beta1> getHostPorts()
Description copied from interface:PodSecurityPolicySpecV1Beta1
hostPorts determines which host port ranges are allowed to be exposed.- Specified by:
getHostPorts
in interfacePodSecurityPolicySpecV1Beta1
-
getPrivileged
public final Boolean getPrivileged()
Description copied from interface:PodSecurityPolicySpecV1Beta1
privileged determines if a pod can request to be run as privileged.- Specified by:
getPrivileged
in interfacePodSecurityPolicySpecV1Beta1
-
getReadOnlyRootFilesystem
public final Boolean getReadOnlyRootFilesystem()
Description copied from interface:PodSecurityPolicySpecV1Beta1
readOnlyRootFilesystem when set to true will force containers to run with a read only root file system.If the container specifically requests to run with a non-read only root file system the PSP should deny the pod. If set to false the container may run with a read only root file system if it wishes but it will not be forced to.
- Specified by:
getReadOnlyRootFilesystem
in interfacePodSecurityPolicySpecV1Beta1
-
getRequiredDropCapabilities
public final List<String> getRequiredDropCapabilities()
Description copied from interface:PodSecurityPolicySpecV1Beta1
requiredDropCapabilities are the capabilities that will be dropped from the container.These are required to be dropped and cannot be added.
- Specified by:
getRequiredDropCapabilities
in interfacePodSecurityPolicySpecV1Beta1
-
getRunAsGroup
public final RunAsGroupStrategyOptionsV1Beta1 getRunAsGroup()
Description copied from interface:PodSecurityPolicySpecV1Beta1
RunAsGroup is the strategy that will dictate the allowable RunAsGroup values that may be set.If this field is omitted, the pod's RunAsGroup can take any value. This field requires the RunAsGroup feature gate to be enabled.
- Specified by:
getRunAsGroup
in interfacePodSecurityPolicySpecV1Beta1
-
getRuntimeClass
public final RuntimeClassStrategyOptionsV1Beta1 getRuntimeClass()
Description copied from interface:PodSecurityPolicySpecV1Beta1
runtimeClass is the strategy that will dictate the allowable RuntimeClasses for a pod.If this field is omitted, the pod's runtimeClassName field is unrestricted. Enforcement of this field depends on the RuntimeClass feature gate being enabled.
- Specified by:
getRuntimeClass
in interfacePodSecurityPolicySpecV1Beta1
-
getVolumes
public final List<String> getVolumes()
Description copied from interface:PodSecurityPolicySpecV1Beta1
volumes is an allowlist of volume plugins.Empty indicates that no volumes may be used. To allow all volumes you may use '*'.
- Specified by:
getVolumes
in interfacePodSecurityPolicySpecV1Beta1
-
$jsii$toJson
@Internal public com.fasterxml.jackson.databind.JsonNode $jsii$toJson()
- Specified by:
$jsii$toJson
in interfacesoftware.amazon.jsii.JsiiSerializable
-
-