commit 725bb396274d8cd1f7ce2d28c63da3f53c9427b1
author Giorgi Lekveishvili <lekva@gl-mbp-m1-max.local> Fri May 05 18:24:27 2023 +0400
committer Giorgi Lekveishvili <lekva@gl-mbp-m1-max.local> Fri May 05 18:24:27 2023 +0400
tree 79e2b7014fee9fdbd9ba9024d75bfed2d96d2782
parent d5f3820b4c1617018bcde63216b8b114f87bb813

charts

charts/ingress-nginx/templates/default-backend-psp.yaml

diff --git a/charts/ingress-nginx/templates/default-backend-psp.yaml b/charts/ingress-nginx/templates/default-backend-psp.yaml
new file mode 100644
index 0000000..716dbf1
--- /dev/null
+++ b/charts/ingress-nginx/templates/default-backend-psp.yaml
@@ -0,0 +1,33 @@
+{{- if and .Values.podSecurityPolicy.enabled .Values.defaultBackend.enabled (empty .Values.defaultBackend.existingPsp) -}}
+apiVersion: policy/v1beta1
+kind: PodSecurityPolicy
+metadata:
+  name: {{ include "ingress-nginx.fullname" . }}-backend
+  labels:
+    {{- include "ingress-nginx.labels" . | nindent 4 }}
+    app.kubernetes.io/component: default-backend
+spec:
+  allowPrivilegeEscalation: false
+  fsGroup:
+    ranges:
+    - max: 65535
+      min: 1
+    rule: MustRunAs
+  requiredDropCapabilities:
+  - ALL
+  runAsUser:
+    rule: MustRunAsNonRoot
+  seLinux:
+    rule: RunAsAny
+  supplementalGroups:
+    ranges:
+    - max: 65535
+      min: 1
+    rule: MustRunAs
+  volumes:
+  - configMap
+  - emptyDir
+  - projected
+  - secret
+  - downwardAPI
+{{- end }}