Package k8s.io.api.core.v1

Interface Generated.SecurityContextOrBuilder

    • Method Detail

      • hasCapabilities

        boolean hasCapabilities()
         The capabilities to add/drop when running containers.
 Defaults to the default set of capabilities granted by the container runtime.
 Note that this field cannot be set when spec.os.name is windows.
 +optional
        optional .k8s.io.api.core.v1.Capabilities capabilities = 1;
        Returns:
        Whether the capabilities field is set.

      • getCapabilities

        Generated.Capabilities getCapabilities()
         The capabilities to add/drop when running containers.
 Defaults to the default set of capabilities granted by the container runtime.
 Note that this field cannot be set when spec.os.name is windows.
 +optional
        optional .k8s.io.api.core.v1.Capabilities capabilities = 1;
        Returns:
        The capabilities.

      • getCapabilitiesOrBuilder

        Generated.CapabilitiesOrBuilder getCapabilitiesOrBuilder()
         The capabilities to add/drop when running containers.
 Defaults to the default set of capabilities granted by the container runtime.
 Note that this field cannot be set when spec.os.name is windows.
 +optional
        optional .k8s.io.api.core.v1.Capabilities capabilities = 1;

      • hasPrivileged

        boolean hasPrivileged()
         Run container in privileged mode.
 Processes in privileged containers are essentially equivalent to root on the host.
 Defaults to false.
 Note that this field cannot be set when spec.os.name is windows.
 +optional
        optional bool privileged = 2;
        Returns:
        Whether the privileged field is set.

      • getPrivileged

        boolean getPrivileged()
         Run container in privileged mode.
 Processes in privileged containers are essentially equivalent to root on the host.
 Defaults to false.
 Note that this field cannot be set when spec.os.name is windows.
 +optional
        optional bool privileged = 2;
        Returns:
        The privileged.

      • hasSeLinuxOptions

        boolean hasSeLinuxOptions()
         The SELinux context to be applied to the container.
 If unspecified, the container runtime will allocate a random SELinux context for each
 container.  May also be set in PodSecurityContext.  If set in both SecurityContext and
 PodSecurityContext, the value specified in SecurityContext takes precedence.
 Note that this field cannot be set when spec.os.name is windows.
 +optional
        optional .k8s.io.api.core.v1.SELinuxOptions seLinuxOptions = 3;
        Returns:
        Whether the seLinuxOptions field is set.

      • getSeLinuxOptions

        Generated.SELinuxOptions getSeLinuxOptions()
         The SELinux context to be applied to the container.
 If unspecified, the container runtime will allocate a random SELinux context for each
 container.  May also be set in PodSecurityContext.  If set in both SecurityContext and
 PodSecurityContext, the value specified in SecurityContext takes precedence.
 Note that this field cannot be set when spec.os.name is windows.
 +optional
        optional .k8s.io.api.core.v1.SELinuxOptions seLinuxOptions = 3;
        Returns:
        The seLinuxOptions.

      • getSeLinuxOptionsOrBuilder

        Generated.SELinuxOptionsOrBuilder getSeLinuxOptionsOrBuilder()
         The SELinux context to be applied to the container.
 If unspecified, the container runtime will allocate a random SELinux context for each
 container.  May also be set in PodSecurityContext.  If set in both SecurityContext and
 PodSecurityContext, the value specified in SecurityContext takes precedence.
 Note that this field cannot be set when spec.os.name is windows.
 +optional
        optional .k8s.io.api.core.v1.SELinuxOptions seLinuxOptions = 3;

      • hasWindowsOptions

        boolean hasWindowsOptions()
         The Windows specific settings applied to all containers.
 If unspecified, the options from the PodSecurityContext will be used.
 If set in both SecurityContext and PodSecurityContext, the value specified in SecurityContext takes precedence.
 Note that this field cannot be set when spec.os.name is linux.
 +optional
        optional .k8s.io.api.core.v1.WindowsSecurityContextOptions windowsOptions = 10;
        Returns:
        Whether the windowsOptions field is set.

      • getWindowsOptions

        Generated.WindowsSecurityContextOptions getWindowsOptions()
         The Windows specific settings applied to all containers.
 If unspecified, the options from the PodSecurityContext will be used.
 If set in both SecurityContext and PodSecurityContext, the value specified in SecurityContext takes precedence.
 Note that this field cannot be set when spec.os.name is linux.
 +optional
        optional .k8s.io.api.core.v1.WindowsSecurityContextOptions windowsOptions = 10;
        Returns:
        The windowsOptions.

      • getWindowsOptionsOrBuilder

        Generated.WindowsSecurityContextOptionsOrBuilder getWindowsOptionsOrBuilder()
         The Windows specific settings applied to all containers.
 If unspecified, the options from the PodSecurityContext will be used.
 If set in both SecurityContext and PodSecurityContext, the value specified in SecurityContext takes precedence.
 Note that this field cannot be set when spec.os.name is linux.
 +optional
        optional .k8s.io.api.core.v1.WindowsSecurityContextOptions windowsOptions = 10;

      • hasRunAsUser

        boolean hasRunAsUser()
         The UID to run the entrypoint of the container process.
 Defaults to user specified in image metadata if unspecified.
 May also be set in PodSecurityContext.  If set in both SecurityContext and
 PodSecurityContext, the value specified in SecurityContext takes precedence.
 Note that this field cannot be set when spec.os.name is windows.
 +optional
        optional int64 runAsUser = 4;
        Returns:
        Whether the runAsUser field is set.

      • getRunAsUser

        long getRunAsUser()
         The UID to run the entrypoint of the container process.
 Defaults to user specified in image metadata if unspecified.
 May also be set in PodSecurityContext.  If set in both SecurityContext and
 PodSecurityContext, the value specified in SecurityContext takes precedence.
 Note that this field cannot be set when spec.os.name is windows.
 +optional
        optional int64 runAsUser = 4;
        Returns:
        The runAsUser.

      • hasRunAsGroup

        boolean hasRunAsGroup()
         The GID to run the entrypoint of the container process.
 Uses runtime default if unset.
 May also be set in PodSecurityContext.  If set in both SecurityContext and
 PodSecurityContext, the value specified in SecurityContext takes precedence.
 Note that this field cannot be set when spec.os.name is windows.
 +optional
        optional int64 runAsGroup = 8;
        Returns:
        Whether the runAsGroup field is set.

      • getRunAsGroup

        long getRunAsGroup()
         The GID to run the entrypoint of the container process.
 Uses runtime default if unset.
 May also be set in PodSecurityContext.  If set in both SecurityContext and
 PodSecurityContext, the value specified in SecurityContext takes precedence.
 Note that this field cannot be set when spec.os.name is windows.
 +optional
        optional int64 runAsGroup = 8;
        Returns:
        The runAsGroup.

      • hasRunAsNonRoot

        boolean hasRunAsNonRoot()
         Indicates that the container must run as a non-root user.
 If true, the Kubelet will validate the image at runtime to ensure that it
 does not run as UID 0 (root) and fail to start the container if it does.
 If unset or false, no such validation will be performed.
 May also be set in PodSecurityContext.  If set in both SecurityContext and
 PodSecurityContext, the value specified in SecurityContext takes precedence.
 +optional
        optional bool runAsNonRoot = 5;
        Returns:
        Whether the runAsNonRoot field is set.

      • getRunAsNonRoot

        boolean getRunAsNonRoot()
         Indicates that the container must run as a non-root user.
 If true, the Kubelet will validate the image at runtime to ensure that it
 does not run as UID 0 (root) and fail to start the container if it does.
 If unset or false, no such validation will be performed.
 May also be set in PodSecurityContext.  If set in both SecurityContext and
 PodSecurityContext, the value specified in SecurityContext takes precedence.
 +optional
        optional bool runAsNonRoot = 5;
        Returns:
        The runAsNonRoot.

      • hasReadOnlyRootFilesystem

        boolean hasReadOnlyRootFilesystem()
         Whether this container has a read-only root filesystem.
 Default is false.
 Note that this field cannot be set when spec.os.name is windows.
 +optional
        optional bool readOnlyRootFilesystem = 6;
        Returns:
        Whether the readOnlyRootFilesystem field is set.

      • getReadOnlyRootFilesystem

        boolean getReadOnlyRootFilesystem()
         Whether this container has a read-only root filesystem.
 Default is false.
 Note that this field cannot be set when spec.os.name is windows.
 +optional
        optional bool readOnlyRootFilesystem = 6;
        Returns:
        The readOnlyRootFilesystem.

      • hasAllowPrivilegeEscalation

        boolean hasAllowPrivilegeEscalation()
         AllowPrivilegeEscalation controls whether a process can gain more
 privileges than its parent process. This bool directly controls if
 the no_new_privs flag will be set on the container process.
 AllowPrivilegeEscalation is true always when the container is:
 1) run as Privileged
 2) has CAP_SYS_ADMIN
 Note that this field cannot be set when spec.os.name is windows.
 +optional
        optional bool allowPrivilegeEscalation = 7;
        Returns:
        Whether the allowPrivilegeEscalation field is set.

      • getAllowPrivilegeEscalation

        boolean getAllowPrivilegeEscalation()
         AllowPrivilegeEscalation controls whether a process can gain more
 privileges than its parent process. This bool directly controls if
 the no_new_privs flag will be set on the container process.
 AllowPrivilegeEscalation is true always when the container is:
 1) run as Privileged
 2) has CAP_SYS_ADMIN
 Note that this field cannot be set when spec.os.name is windows.
 +optional
        optional bool allowPrivilegeEscalation = 7;
        Returns:
        The allowPrivilegeEscalation.

      • hasProcMount

        boolean hasProcMount()
         procMount denotes the type of proc mount to use for the containers.
 The default value is Default which uses the container runtime defaults for
 readonly paths and masked paths.
 This requires the ProcMountType feature flag to be enabled.
 Note that this field cannot be set when spec.os.name is windows.
 +optional
        optional string procMount = 9;
        Returns:
        Whether the procMount field is set.

      • getProcMount

        String getProcMount()
         procMount denotes the type of proc mount to use for the containers.
 The default value is Default which uses the container runtime defaults for
 readonly paths and masked paths.
 This requires the ProcMountType feature flag to be enabled.
 Note that this field cannot be set when spec.os.name is windows.
 +optional
        optional string procMount = 9;
        Returns:
        The procMount.

      • getProcMountBytes

        com.google.protobuf.ByteString getProcMountBytes()
         procMount denotes the type of proc mount to use for the containers.
 The default value is Default which uses the container runtime defaults for
 readonly paths and masked paths.
 This requires the ProcMountType feature flag to be enabled.
 Note that this field cannot be set when spec.os.name is windows.
 +optional
        optional string procMount = 9;
        Returns:
        The bytes for procMount.

      • hasSeccompProfile

        boolean hasSeccompProfile()
         The seccomp options to use by this container. If seccomp options are
 provided at both the pod & container level, the container options
 override the pod options.
 Note that this field cannot be set when spec.os.name is windows.
 +optional
        optional .k8s.io.api.core.v1.SeccompProfile seccompProfile = 11;
        Returns:
        Whether the seccompProfile field is set.

      • getSeccompProfile

        Generated.SeccompProfile getSeccompProfile()
         The seccomp options to use by this container. If seccomp options are
 provided at both the pod & container level, the container options
 override the pod options.
 Note that this field cannot be set when spec.os.name is windows.
 +optional
        optional .k8s.io.api.core.v1.SeccompProfile seccompProfile = 11;
        Returns:
        The seccompProfile.

      • getSeccompProfileOrBuilder

        Generated.SeccompProfileOrBuilder getSeccompProfileOrBuilder()
         The seccomp options to use by this container. If seccomp options are
 provided at both the pod & container level, the container options
 override the pod options.
 Note that this field cannot be set when spec.os.name is windows.
 +optional
        optional .k8s.io.api.core.v1.SeccompProfile seccompProfile = 11;

      • hasAppArmorProfile

        boolean hasAppArmorProfile()
         appArmorProfile is the AppArmor options to use by this container. If set, this profile
 overrides the pod's appArmorProfile.
 Note that this field cannot be set when spec.os.name is windows.
 +optional
        optional .k8s.io.api.core.v1.AppArmorProfile appArmorProfile = 12;
        Returns:
        Whether the appArmorProfile field is set.

      • getAppArmorProfile

        Generated.AppArmorProfile getAppArmorProfile()
         appArmorProfile is the AppArmor options to use by this container. If set, this profile
 overrides the pod's appArmorProfile.
 Note that this field cannot be set when spec.os.name is windows.
 +optional
        optional .k8s.io.api.core.v1.AppArmorProfile appArmorProfile = 12;
        Returns:
        The appArmorProfile.

      • getAppArmorProfileOrBuilder

        Generated.AppArmorProfileOrBuilder getAppArmorProfileOrBuilder()
         appArmorProfile is the AppArmor options to use by this container. If set, this profile
 overrides the pod's appArmorProfile.
 Note that this field cannot be set when spec.os.name is windows.
 +optional
        optional .k8s.io.api.core.v1.AppArmorProfile appArmorProfile = 12;