| {{- if .Values.rbac.pspEnabled }} |
| apiVersion: policy/v1beta1 |
| kind: PodSecurityPolicy |
| metadata: |
| name: {{ include "loki.name" . }} |
| labels: |
| {{- include "loki.labels" . | nindent 4 }} |
| {{- if .Values.rbac.pspAnnotations }} |
| annotations: |
| {{ toYaml .Values.rbac.pspAnnotations | indent 4 }} |
| {{- end }} |
| spec: |
| privileged: false |
| allowPrivilegeEscalation: false |
| volumes: |
| - 'configMap' |
| - 'emptyDir' |
| - 'persistentVolumeClaim' |
| - 'secret' |
| - 'projected' |
| hostNetwork: false |
| hostIPC: false |
| hostPID: false |
| runAsUser: |
| rule: 'MustRunAsNonRoot' |
| seLinux: |
| rule: 'RunAsAny' |
| supplementalGroups: |
| rule: 'MustRunAs' |
| ranges: |
| - min: 1 |
| max: 65535 |
| fsGroup: |
| rule: 'MustRunAs' |
| ranges: |
| - min: 1 |
| max: 65535 |
| readOnlyRootFilesystem: true |
| requiredDropCapabilities: |
| - ALL |
| {{- end }} |