kubespray/roles/kubernetes-apps/external_provisioner/local_volume_provisioner/templates/local-volume-provisioner-ps...

---
apiVersion: policy/v1beta1
kind: PodSecurityPolicy
metadata:
  name: local-volume-provisioner
  annotations:
    seccomp.security.alpha.kubernetes.io/defaultProfileName:  'docker/default'
    seccomp.security.alpha.kubernetes.io/allowedProfileNames: 'docker/default'
{% if apparmor_enabled %}
    apparmor.security.beta.kubernetes.io/defaultProfileName:  'runtime/default'
    apparmor.security.beta.kubernetes.io/allowedProfileNames: 'runtime/default'
{% endif %}
  labels:
    addonmanager.kubernetes.io/mode: Reconcile
spec:
  privileged: true
  allowPrivilegeEscalation: true
  requiredDropCapabilities:
    - ALL
  volumes:
    - 'configMap'
    - 'emptyDir'
    - 'secret'
    - 'downwardAPI'
    - 'hostPath'
  allowedHostPaths:
{% for class_name, class_config in local_volume_provisioner_storage_classes.items() %}
    - pathPrefix: "{{ class_config.host_dir }}"
      readOnly: false
{% endfor %}
  hostNetwork: false
  hostIPC: false
  hostPID: false
  runAsUser:
    rule: 'RunAsAny'
  seLinux:
    rule: 'RunAsAny'
  supplementalGroups:
    rule: 'MustRunAs'
    ranges:
      - min: 1
        max: 65535
  fsGroup:
    rule: 'RunAsAny'
  readOnlyRootFilesystem: false
psp, roles and rbs for PodSecurityPolicy when podsecuritypolicy_enabled is true 2018-08-23 00:16:13 +08:00			`---`
			`apiVersion: policy/v1beta1`
			`kind: PodSecurityPolicy`
			`metadata:`
			`name: local-volume-provisioner`
			`annotations:`
			`seccomp.security.alpha.kubernetes.io/defaultProfileName: 'docker/default'`
			`seccomp.security.alpha.kubernetes.io/allowedProfileNames: 'docker/default'`
			`{% if apparmor_enabled %}`
			`apparmor.security.beta.kubernetes.io/defaultProfileName: 'runtime/default'`
			`apparmor.security.beta.kubernetes.io/allowedProfileNames: 'runtime/default'`
			`{% endif %}`
			`labels:`
			`addonmanager.kubernetes.io/mode: Reconcile`
			`spec:`
			`privileged: true`
			`allowPrivilegeEscalation: true`
			`requiredDropCapabilities:`
			`- ALL`
			`volumes:`
			`- 'configMap'`
			`- 'emptyDir'`
			`- 'secret'`
			`- 'downwardAPI'`
			`- 'hostPath'`
			`allowedHostPaths:`
Replace iteritems() to items() in Jinja2 templates (#4437) The iteritems() dictionary's method has been removed in Python3. Using this method in Jinja2 templates limits the execution to Python2 which will be deprecated in 2020[1]. This change replaces that method for the items() method as it's suggested in the official website[2]. [1] https://pythonclock.org/ [2] https://docs.ansible.com/ansible/latest/user_guide/playbooks_python_version.html#dict-iteritems 2019-04-08 15:32:26 +08:00			`{% for class_name, class_config in local_volume_provisioner_storage_classes.items() %}`
More dynamic local-storage-provisioner approach (#3472) * Makes local volume provisioner more dynamic * Correct variable name in local storage provisioner defaults * Updates external-provisioner readme * Updates variable naming to be more clear, more documentation, fixes sample inventory * Variable refactor, untangled some jinja2 loops * Corrects variable name * No variable substitution in dict keys, replaced with anchor * Fixes default storage_classes dict, inline docs * Fixes spelling in inline docs * Addresses comments in review * Updates all the defaults * Fix failing CI task * Fixes external provisioner daemonset 2019-01-09 04:36:44 +08:00			`- pathPrefix: "{{ class_config.host_dir }}"`
psp, roles and rbs for PodSecurityPolicy when podsecuritypolicy_enabled is true 2018-08-23 00:16:13 +08:00			`readOnly: false`
Support multiple local volume provisioner StorageClasses (#3450) - Local Volume StorageClass configuration is now manged by `local_volume_provisioner_storage_classes`, a list of maps that specifies local storage classes with `name` `host_dir` and `mount_dir` keys per entry - Tasks and templates updated to loop through local volume storage classes - Previous defaults for path/class names were not changed - Fixed an issue where a `kubernetes/preinstall` was creating directories inconsistently with the `kubernetes-apps/external_provisioner/local_volume_provisioner` task 2018-10-05 20:52:25 +08:00			`{% endfor %}`
psp, roles and rbs for PodSecurityPolicy when podsecuritypolicy_enabled is true 2018-08-23 00:16:13 +08:00			`hostNetwork: false`
			`hostIPC: false`
			`hostPID: false`
			`runAsUser:`
			`rule: 'RunAsAny'`
			`seLinux:`
			`rule: 'RunAsAny'`
			`supplementalGroups:`
			`rule: 'MustRunAs'`
			`ranges:`
			`- min: 1`
			`max: 65535`
			`fsGroup:`
			`rule: 'RunAsAny'`
			`readOnlyRootFilesystem: false`