Resource Type: kubernetes_security_context

Defined in:

lib/puppet/type/kubernetes_security_context.rb

Providers:

swagger

Overview

SecurityContext holds security configuration that will be applied to a container. Some fields are present in both SecurityContext and PodSecurityContext. When both are set, the values in SecurityContext take precedence.

Properties

• capabilities

  The capabilities to add/drop when running containers. Defaults to the default set of capabilities granted by the container runtime.

• ensure (defaults to: present)

  The basic property that the resource should be in.

  Supported values:

  • present
  • absent
• privileged

  Run container in privileged mode. Processes in privileged containers are essentially equivalent to root on the host. Defaults to false.

• read_only_root_filesystem

  Whether this container has a read-only root filesystem. Default is false.

• run_as_non_root

  Indicates that the container must run as a non-root user. If true, the Kubelet will validate the image at runtime to ensure that it does not run as UID 0 (root) and fail to start the container if it does. If unset or false, no such validation will be performed. May also be set in PodSecurityContext. If set in both SecurityContext and PodSecurityContext, the value specified in SecurityContext takes precedence.

• run_as_user

  The UID to run the entrypoint of the container process. Defaults to user specified in image metadata if unspecified. May also be set in PodSecurityContext. If set in both SecurityContext and PodSecurityContext, the value specified in SecurityContext takes precedence.

• se_linux_options

  The SELinux context to be applied to the container. If unspecified, the container runtime will allocate a random SELinux context for each container. May also be set in PodSecurityContext. If set in both SecurityContext and PodSecurityContext, the value specified in SecurityContext takes precedence.

Parameters

• name (namevar)

  Name of the security_context.

• provider

  The specific backend to use for this ‘kubernetes_security_context` resource. You will seldom need to specify this — Puppet will usually discover the appropriate provider for your platform.