Class: Kubernetes::PolicyV1beta1PodSecurityPolicySpec

Inherits:
Object
  • Object
show all
Defined in:
lib/kubernetes/models/policy_v1beta1_pod_security_policy_spec.rb

Overview

PodSecurityPolicySpec defines the policy enforced.

Instance Attribute Summary collapse

Class Method Summary collapse

Instance Method Summary collapse

Constructor Details

#initialize(attributes = {}) ⇒ PolicyV1beta1PodSecurityPolicySpec

Initializes the object

Parameters:

  • attributes (Hash) (defaults to: {}) —

    Model attributes in the form of hash



142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
 
# File 'lib/kubernetes/models/policy_v1beta1_pod_security_policy_spec.rb', line 142

def initialize(attributes = {})
  return unless attributes.is_a?(Hash)

  # convert string to symbol for hash key
  attributes = attributes.transform_keys(&:to_sym)

  if attributes.key?(:allowPrivilegeEscalation)
    self.allow_privilege_escalation = attributes[:allowPrivilegeEscalation]
  end

  if attributes.key?(:allowedCapabilities) && (value = attributes[:allowedCapabilities]).is_a?(Array)
    self.allowed_capabilities = value
  end

  if attributes.key?(:allowedFlexVolumes) && (value = attributes[:allowedFlexVolumes]).is_a?(Array)
    self.allowed_flex_volumes = value
  end

  if attributes.key?(:allowedHostPaths) && (value = attributes[:allowedHostPaths]).is_a?(Array)
    self.allowed_host_paths = value
  end

  if attributes.key?(:allowedProcMountTypes) && (value = attributes[:allowedProcMountTypes]).is_a?(Array)
    self.allowed_proc_mount_types = value
  end

  if attributes.key?(:allowedUnsafeSysctls) && (value = attributes[:allowedUnsafeSysctls]).is_a?(Array)
    self.allowed_unsafe_sysctls = value
  end

  if attributes.key?(:defaultAddCapabilities) && (value = attributes[:defaultAddCapabilities]).is_a?(Array)
    self.default_add_capabilities = value
  end

  if attributes.key?(:defaultAllowPrivilegeEscalation)
    self.default_allow_privilege_escalation = attributes[:defaultAllowPrivilegeEscalation]
  end

  if attributes.key?(:forbiddenSysctls) && (value = attributes[:forbiddenSysctls]).is_a?(Array)
    self.forbidden_sysctls = value
  end

  self.fs_group = attributes[:fsGroup] if attributes.key?(:fsGroup)

  self.host_ipc = attributes[:hostIPC] if attributes.key?(:hostIPC)

  self.host_network = attributes[:hostNetwork] if attributes.key?(:hostNetwork)

  self.host_pid = attributes[:hostPID] if attributes.key?(:hostPID)

  if attributes.key?(:hostPorts) && (value = attributes[:hostPorts]).is_a?(Array)
    self.host_ports = value
  end

  self.privileged = attributes[:privileged] if attributes.key?(:privileged)

  if attributes.key?(:readOnlyRootFilesystem)
    self.read_only_root_filesystem = attributes[:readOnlyRootFilesystem]
  end

  if attributes.key?(:requiredDropCapabilities) && (value = attributes[:requiredDropCapabilities]).is_a?(Array)
    self.required_drop_capabilities = value
  end

  self.run_as_group = attributes[:runAsGroup] if attributes.key?(:runAsGroup)

  self.run_as_user = attributes[:runAsUser] if attributes.key?(:runAsUser)

  self.se_linux = attributes[:seLinux] if attributes.key?(:seLinux)

  if attributes.key?(:supplementalGroups)
    self.supplemental_groups = attributes[:supplementalGroups]
  end

  return unless attributes.key?(:volumes)
  return unless (value = attributes[:volumes]).is_a?(Array)

  self.volumes = value
end

Instance Attribute Details

#allow_privilege_escalation ⇒ Object

allowPrivilegeEscalation determines if a pod can request to allow privilege escalation. If unspecified, defaults to true.



19
20
21
 
# File 'lib/kubernetes/models/policy_v1beta1_pod_security_policy_spec.rb', line 19

def allow_privilege_escalation
  @allow_privilege_escalation
end

#allowed_capabilities ⇒ Object

allowedCapabilities is a list of capabilities that can be requested to add to the container. Capabilities in this field may be added at the pod author’s discretion. You must not list a capability in both allowedCapabilities and requiredDropCapabilities.



22
23
24
 
# File 'lib/kubernetes/models/policy_v1beta1_pod_security_policy_spec.rb', line 22

def allowed_capabilities
  @allowed_capabilities
end

#allowed_flex_volumes ⇒ Object

allowedFlexVolumes is a whitelist of allowed Flexvolumes. Empty or nil indicates that all Flexvolumes may be used. This parameter is effective only when the usage of the Flexvolumes is allowed in the "volumes" field.



25
26
27
 
# File 'lib/kubernetes/models/policy_v1beta1_pod_security_policy_spec.rb', line 25

def allowed_flex_volumes
  @allowed_flex_volumes
end

#allowed_host_paths ⇒ Object

allowedHostPaths is a white list of allowed host paths. Empty indicates that all host paths may be used.



28
29
30
 
# File 'lib/kubernetes/models/policy_v1beta1_pod_security_policy_spec.rb', line 28

def allowed_host_paths
  @allowed_host_paths
end

#allowed_proc_mount_types ⇒ Object

AllowedProcMountTypes is a whitelist of allowed ProcMountTypes. Empty or nil indicates that only the DefaultProcMountType may be used. This requires the ProcMountType feature flag to be enabled.



31
32
33
 
# File 'lib/kubernetes/models/policy_v1beta1_pod_security_policy_spec.rb', line 31

def allowed_proc_mount_types
  @allowed_proc_mount_types
end

#allowed_unsafe_sysctls ⇒ Object

allowedUnsafeSysctls is a list of explicitly allowed unsafe sysctls, defaults to none. Each entry is either a plain sysctl name or ends in "*" in which case it is considered as a prefix of allowed sysctls. Single * means all unsafe sysctls are allowed. Kubelet has to whitelist all allowed unsafe sysctls explicitly to avoid rejection. Examples: e.g. "foo/*" allows "foo/bar", "foo/baz", etc. e.g. "foo.*" allows "foo.bar", "foo.baz", etc.



34
35
36
 
# File 'lib/kubernetes/models/policy_v1beta1_pod_security_policy_spec.rb', line 34

def allowed_unsafe_sysctls
  @allowed_unsafe_sysctls
end

#default_add_capabilities ⇒ Object

defaultAddCapabilities is the default set of capabilities that will be added to the container unless the pod spec specifically drops the capability. You may not list a capability in both defaultAddCapabilities and requiredDropCapabilities. Capabilities added here are implicitly allowed, and need not be included in the allowedCapabilities list.



37
38
39
 
# File 'lib/kubernetes/models/policy_v1beta1_pod_security_policy_spec.rb', line 37

def default_add_capabilities
  @default_add_capabilities
end

#default_allow_privilege_escalation ⇒ Object

defaultAllowPrivilegeEscalation controls the default setting for whether a process can gain more privileges than its parent process.



40
41
42
 
# File 'lib/kubernetes/models/policy_v1beta1_pod_security_policy_spec.rb', line 40

def default_allow_privilege_escalation
  @default_allow_privilege_escalation
end

#forbidden_sysctls ⇒ Object

forbiddenSysctls is a list of explicitly forbidden sysctls, defaults to none. Each entry is either a plain sysctl name or ends in "*" in which case it is considered as a prefix of forbidden sysctls. Single * means all sysctls are forbidden. Examples: e.g. "foo/*" forbids "foo/bar", "foo/baz", etc. e.g. "foo.*" forbids "foo.bar", "foo.baz", etc.



43
44
45
 
# File 'lib/kubernetes/models/policy_v1beta1_pod_security_policy_spec.rb', line 43

def forbidden_sysctls
  @forbidden_sysctls
end

#fs_group ⇒ Object

fsGroup is the strategy that will dictate what fs group is used by the SecurityContext.



46
47
48
 
# File 'lib/kubernetes/models/policy_v1beta1_pod_security_policy_spec.rb', line 46

def fs_group
  @fs_group
end

#host_ipc ⇒ Object

hostIPC determines if the policy allows the use of HostIPC in the pod spec.



49
50
51
 
# File 'lib/kubernetes/models/policy_v1beta1_pod_security_policy_spec.rb', line 49

def host_ipc
  @host_ipc
end

#host_network ⇒ Object

hostNetwork determines if the policy allows the use of HostNetwork in the pod spec.



52
53
54
 
# File 'lib/kubernetes/models/policy_v1beta1_pod_security_policy_spec.rb', line 52

def host_network
  @host_network
end

#host_pid ⇒ Object

hostPID determines if the policy allows the use of HostPID in the pod spec.



55
56
57
 
# File 'lib/kubernetes/models/policy_v1beta1_pod_security_policy_spec.rb', line 55

def host_pid
  @host_pid
end

#host_ports ⇒ Object

hostPorts determines which host port ranges are allowed to be exposed.



58
59
60
 
# File 'lib/kubernetes/models/policy_v1beta1_pod_security_policy_spec.rb', line 58

def host_ports
  @host_ports
end

#privileged ⇒ Object

privileged determines if a pod can request to be run as privileged.



61
62
63
 
# File 'lib/kubernetes/models/policy_v1beta1_pod_security_policy_spec.rb', line 61

def privileged
  @privileged
end

#read_only_root_filesystem ⇒ Object

readOnlyRootFilesystem when set to true will force containers to run with a read only root file system. If the container specifically requests to run with a non-read only root file system the PSP should deny the pod. If set to false the container may run with a read only root file system if it wishes but it will not be forced to.



64
65
66
 
# File 'lib/kubernetes/models/policy_v1beta1_pod_security_policy_spec.rb', line 64

def read_only_root_filesystem
  @read_only_root_filesystem
end

#required_drop_capabilities ⇒ Object

requiredDropCapabilities are the capabilities that will be dropped from the container. These are required to be dropped and cannot be added.



67
68
69
 
# File 'lib/kubernetes/models/policy_v1beta1_pod_security_policy_spec.rb', line 67

def required_drop_capabilities
  @required_drop_capabilities
end

#run_as_group ⇒ Object

RunAsGroup is the strategy that will dictate the allowable RunAsGroup values that may be set. If this field is omitted, the pod’s RunAsGroup can take any value. This field requires the RunAsGroup feature gate to be enabled.



70
71
72
 
# File 'lib/kubernetes/models/policy_v1beta1_pod_security_policy_spec.rb', line 70

def run_as_group
  @run_as_group
end

#run_as_user ⇒ Object

runAsUser is the strategy that will dictate the allowable RunAsUser values that may be set.



73
74
75
 
# File 'lib/kubernetes/models/policy_v1beta1_pod_security_policy_spec.rb', line 73

def run_as_user
  @run_as_user
end

#se_linux ⇒ Object

seLinux is the strategy that will dictate the allowable labels that may be set.



76
77
78
 
# File 'lib/kubernetes/models/policy_v1beta1_pod_security_policy_spec.rb', line 76

def se_linux
  @se_linux
end

#supplemental_groups ⇒ Object

supplementalGroups is the strategy that will dictate what supplemental groups are used by the SecurityContext.



79
80
81
 
# File 'lib/kubernetes/models/policy_v1beta1_pod_security_policy_spec.rb', line 79

def supplemental_groups
  @supplemental_groups
end

#volumes ⇒ Object

volumes is a white list of allowed volume plugins. Empty indicates that no volumes may be used. To allow all volumes you may use ‘*’.



82
83
84
 
# File 'lib/kubernetes/models/policy_v1beta1_pod_security_policy_spec.rb', line 82

def volumes
  @volumes
end

Class Method Details

.attribute_map ⇒ Object

Attribute mapping from ruby-style variable name to JSON key.



85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
 
# File 'lib/kubernetes/models/policy_v1beta1_pod_security_policy_spec.rb', line 85

def self.attribute_map
  {
    allow_privilege_escalation: :allowPrivilegeEscalation,
    allowed_capabilities: :allowedCapabilities,
    allowed_flex_volumes: :allowedFlexVolumes,
    allowed_host_paths: :allowedHostPaths,
    allowed_proc_mount_types: :allowedProcMountTypes,
    allowed_unsafe_sysctls: :allowedUnsafeSysctls,
    default_add_capabilities: :defaultAddCapabilities,
    default_allow_privilege_escalation: :defaultAllowPrivilegeEscalation,
    forbidden_sysctls: :forbiddenSysctls,
    fs_group: :fsGroup,
    host_ipc: :hostIPC,
    host_network: :hostNetwork,
    host_pid: :hostPID,
    host_ports: :hostPorts,
    privileged: :privileged,
    read_only_root_filesystem: :readOnlyRootFilesystem,
    required_drop_capabilities: :requiredDropCapabilities,
    run_as_group: :runAsGroup,
    run_as_user: :runAsUser,
    se_linux: :seLinux,
    supplemental_groups: :supplementalGroups,
    volumes: :volumes
  }
end

.swagger_types ⇒ Object

Attribute type mapping.



113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
 
# File 'lib/kubernetes/models/policy_v1beta1_pod_security_policy_spec.rb', line 113

def self.swagger_types
  {
    allow_privilege_escalation: :BOOLEAN,
    allowed_capabilities: :'Array<String>',
    allowed_flex_volumes: :'Array<PolicyV1beta1AllowedFlexVolume>',
    allowed_host_paths: :'Array<PolicyV1beta1AllowedHostPath>',
    allowed_proc_mount_types: :'Array<String>',
    allowed_unsafe_sysctls: :'Array<String>',
    default_add_capabilities: :'Array<String>',
    default_allow_privilege_escalation: :BOOLEAN,
    forbidden_sysctls: :'Array<String>',
    fs_group: :PolicyV1beta1FSGroupStrategyOptions,
    host_ipc: :BOOLEAN,
    host_network: :BOOLEAN,
    host_pid: :BOOLEAN,
    host_ports: :'Array<PolicyV1beta1HostPortRange>',
    privileged: :BOOLEAN,
    read_only_root_filesystem: :BOOLEAN,
    required_drop_capabilities: :'Array<String>',
    run_as_group: :PolicyV1beta1RunAsGroupStrategyOptions,
    run_as_user: :PolicyV1beta1RunAsUserStrategyOptions,
    se_linux: :PolicyV1beta1SELinuxStrategyOptions,
    supplemental_groups: :PolicyV1beta1SupplementalGroupsStrategyOptions,
    volumes: :'Array<String>'
  }
end

Instance Method Details

#==(other) ⇒ Object

Checks equality by comparing each attribute.

Parameters:

  • Object (Object) —

    to be compared



258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
 
# File 'lib/kubernetes/models/policy_v1beta1_pod_security_policy_spec.rb', line 258

def ==(other)
  return true if equal?(other)

  self.class == other.class &&
    allow_privilege_escalation == other.allow_privilege_escalation &&
    allowed_capabilities == other.allowed_capabilities &&
    allowed_flex_volumes == other.allowed_flex_volumes &&
    allowed_host_paths == other.allowed_host_paths &&
    allowed_proc_mount_types == other.allowed_proc_mount_types &&
    allowed_unsafe_sysctls == other.allowed_unsafe_sysctls &&
    default_add_capabilities == other.default_add_capabilities &&
    default_allow_privilege_escalation == other.default_allow_privilege_escalation &&
    forbidden_sysctls == other.forbidden_sysctls &&
    fs_group == other.fs_group &&
    host_ipc == other.host_ipc &&
    host_network == other.host_network &&
    host_pid == other.host_pid &&
    host_ports == other.host_ports &&
    privileged == other.privileged &&
    read_only_root_filesystem == other.read_only_root_filesystem &&
    required_drop_capabilities == other.required_drop_capabilities &&
    run_as_group == other.run_as_group &&
    run_as_user == other.run_as_user &&
    se_linux == other.se_linux &&
    supplemental_groups == other.supplemental_groups &&
    volumes == other.volumes
end

#_deserialize(type, value) ⇒ Object

Deserializes the data based on type

Parameters:

  • string —

    type Data type

  • string —

    value Value to be deserialized

Returns:

  • (Object) —

    Deserialized data



326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
 
# File 'lib/kubernetes/models/policy_v1beta1_pod_security_policy_spec.rb', line 326

def _deserialize(type, value)
  case type.to_sym
  when :DateTime
    DateTime.parse(value)
  when :Date
    Date.parse(value)
  when :String
    value.to_s
  when :Integer
    value.to_i
  when :Float
    value.to_f
  when :BOOLEAN
    if value.to_s =~ /\A(true|t|yes|y|1)\z/i
      true
    else
      false
    end
  when :Object
    # generic object (usually a Hash), return directly
    value
  when /\AArray<(?<inner_type>.+)>\z/
    inner_type = Regexp.last_match[:inner_type]
    value.map { |v| _deserialize(inner_type, v) }
  when /\AHash<(?<k_type>.+?), (?<v_type>.+)>\z/
    k_type = Regexp.last_match[:k_type]
    v_type = Regexp.last_match[:v_type]
    {}.tap do |hash|
      value.each do |k, v|
        hash[_deserialize(k_type, k)] = _deserialize(v_type, v)
      end
    end
  else # model
    temp_model = Kubernetes.const_get(type).new
    temp_model.build_from_hash(value)
  end
end

#_to_hash(value) ⇒ Hash

Outputs non-array value in the form of hash For object, use to_hash. Otherwise, just return the value

Parameters:

  • value (Object) —

    Any valid value

Returns:

  • (Hash) —

    Returns the value in the form of hash



393
394
395
396
397
398
399
400
401
402
403
404
405
 
# File 'lib/kubernetes/models/policy_v1beta1_pod_security_policy_spec.rb', line 393

def _to_hash(value)
  if value.is_a?(Array)
    value.compact.map { |v| _to_hash(v) }
  elsif value.is_a?(Hash)
    {}.tap do |hash|
      value.each { |k, v| hash[k] = _to_hash(v) }
    end
  elsif value.respond_to? :to_hash
    value.to_hash
  else
    value
  end
end

#build_from_hash(attributes) ⇒ Object

Builds the object from hash

Parameters:

  • attributes (Hash) —

    Model attributes in the form of hash

Returns:

  • (Object) —

    Returns the model itself



302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
 
# File 'lib/kubernetes/models/policy_v1beta1_pod_security_policy_spec.rb', line 302

def build_from_hash(attributes)
  return nil unless attributes.is_a?(Hash)

  self.class.swagger_types.each_pair do |key, type|
    if type =~ /\AArray<(.*)>/i
      # check to ensure the input is an array given that the the attribute
      # is documented as an array but the input is not
      if attributes[self.class.attribute_map[key]].is_a?(Array)
        send("#{key}=", attributes[self.class.attribute_map[key]].map do |v|
                          _deserialize(Regexp.last_match(1), v)
                        end)
      end
    elsif !attributes[self.class.attribute_map[key]].nil?
      send("#{key}=", _deserialize(type, attributes[self.class.attribute_map[key]]))
    end
  end

  self
end

#eql?(other) ⇒ Boolean

Parameters:

  • Object (Object) —

    to be compared

Returns:

  • (Boolean)

See Also:

  • `==` method


288
289
290
 
# File 'lib/kubernetes/models/policy_v1beta1_pod_security_policy_spec.rb', line 288

def eql?(other)
  self == other
end

#hash ⇒ Fixnum

Calculates hash code according to all attributes.

Returns:

  • (Fixnum) —

    Hash code



294
295
296
297
 
# File 'lib/kubernetes/models/policy_v1beta1_pod_security_policy_spec.rb', line 294

def hash
  [allow_privilege_escalation, allowed_capabilities, allowed_flex_volumes, allowed_host_paths,
   allowed_proc_mount_types, allowed_unsafe_sysctls, default_add_capabilities, default_allow_privilege_escalation, forbidden_sysctls, fs_group, host_ipc, host_network, host_pid, host_ports, privileged, read_only_root_filesystem, required_drop_capabilities, run_as_group, run_as_user, se_linux, supplemental_groups, volumes].hash
end

#list_invalid_properties ⇒ Object

Show invalid properties with the reasons. Usually used together with valid?

Returns:

  • Array for valid properies with the reasons



224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
 
# File 'lib/kubernetes/models/policy_v1beta1_pod_security_policy_spec.rb', line 224

def list_invalid_properties
  invalid_properties = []
  if @fs_group.nil?
    invalid_properties.push("invalid value for 'fs_group', fs_group cannot be nil.")
  end

  if @run_as_user.nil?
    invalid_properties.push("invalid value for 'run_as_user', run_as_user cannot be nil.")
  end

  if @se_linux.nil?
    invalid_properties.push("invalid value for 'se_linux', se_linux cannot be nil.")
  end

  if @supplemental_groups.nil?
    invalid_properties.push("invalid value for 'supplemental_groups', supplemental_groups cannot be nil.")
  end

  invalid_properties
end

#to_body ⇒ Hash

to_body is an alias to to_hash (backward compatibility)

Returns:

  • (Hash) —

    Returns the object in the form of hash



372
373
374
 
# File 'lib/kubernetes/models/policy_v1beta1_pod_security_policy_spec.rb', line 372

def to_body
  to_hash
end

#to_hash ⇒ Hash

Returns the object in the form of hash

Returns:

  • (Hash) —

    Returns the object in the form of hash



378
379
380
381
382
383
384
385
386
387
 
# File 'lib/kubernetes/models/policy_v1beta1_pod_security_policy_spec.rb', line 378

def to_hash
  hash = {}
  self.class.attribute_map.each_pair do |attr, param|
    value = send(attr)
    next if value.nil?

    hash[param] = _to_hash(value)
  end
  hash
end

#to_s ⇒ String

Returns the string representation of the object

Returns:

  • (String) —

    String presentation of the object



366
367
368
 
# File 'lib/kubernetes/models/policy_v1beta1_pod_security_policy_spec.rb', line 366

def to_s
  to_hash.to_s
end

#valid? ⇒ Boolean

Check to see if the all the properties in the model are valid

Returns:

  • (Boolean) —

    true if the model is valid



247
248
249
250
251
252
253
254
 
# File 'lib/kubernetes/models/policy_v1beta1_pod_security_policy_spec.rb', line 247

def valid?
  return false if @fs_group.nil?
  return false if @run_as_user.nil?
  return false if @se_linux.nil?
  return false if @supplemental_groups.nil?

  true
end