package kubecaml

  1. Overview
  2. Docs
package kubecaml
Legend:
Library
Module
Module type
Parameter
Class
Class type

Pod_security_context holds pod_level security attributes and common container settings. Some fields are also present in container.security_context. Field values of container.security_context take precedence over field values of Pod_security_context.

type t
val to_yojson : t -> Yojson.Safe.t
val make : ?supplemental_groups:int list -> ?se_linux_options:Kubernetes.Definitions.Api.Core.V1.Se_linux_options.t -> ?run_as_user:int -> ?run_as_non_root:bool -> ?run_as_group:int -> ?fs_group:int -> unit -> t
val fs_group : t -> int option

A special supplemental group that applies to all containers in a pod. Some volume types allow the Kubelet to change the ownership of that volume to be owned by the pod:

1. The owning Gid will be the Fs_group 2. The setgid bit is set (new files created in the volume will be owned by Fs_group) 3. The permission bits are Or'd with rw_rw____

if unset, the Kubelet will not modify the ownership and permissions of any volume.

val run_as_group : t -> int option

The Gid to run the entrypoint of the container process. Uses runtime default if unset. May also be set in Security_context. If set in both Security_context and Pod_security_context, the value specified in Security_context takes precedence for that container.

val run_as_non_root : t -> bool option

Indicates that the container must run as a non_root user. If true, the Kubelet will validate the image at runtime to ensure that it does not run as Uid 0 (root) and fail to start the container if it does. If unset or false, no such validation will be performed. May also be set in Security_context. If set in both Security_context and Pod_security_context, the value specified in Security_context takes precedence.

val run_as_user : t -> int option

The Uid to run the entrypoint of the container process. Defaults to user specified in image metadata if unspecified. May also be set in Security_context. If set in both Security_context and Pod_security_context, the value specified in Security_context takes precedence for that container.

The Se_linux context to be applied to all containers. If unspecified, the container runtime will allocate a random Se_linux context for each container. May also be set in Security_context. If set in both Security_context and Pod_security_context, the value specified in Security_context takes precedence for that container.

val supplemental_groups : t -> int list option

A list of groups applied to the first process run in each container, in addition to the container's primary Gid. If unspecified, no groups will be added to any container.

module Object : Object.S with type value := t
OCaml

Innovation. Community. Security.

GitHub Discord Twitter Peertube RSS
About
Changelog Releases Industrial Users Academic Users Why OCaml
Ecosystem
Packages Community Events Blog Jobs
Resources
Install OCaml Get Started Platform Tools Language Manual Standard Library API Books Exercises Papers OCaml Playground Logo
Policies
Carbon Footprint Governance Privacy Code of Conduct