Class: CDK8sPlus25::PodSecurityContextProps

Inherits:
Jsii::Struct
  • Object
show all
Defined in:
pod_security_context_props.rb

Overview

Properties for PodSecurityContext.

Instance Attribute Summary collapse

Class Method Summary collapse

Instance Method Summary collapse

Constructor Details

#initialize(ensure_non_root: nil, fs_group: nil, fs_group_change_policy: nil, group: nil, sysctls: nil, user: nil) ⇒ PodSecurityContextProps

Returns a new instance of PodSecurityContextProps.

Parameters:

  • ensure_non_root (Boolean, nil) (defaults to: nil) —

    Indicates that the container must run as a non-root user.

  • fs_group (Numeric, nil) (defaults to: nil) —

    Modify the ownership and permissions of pod volumes to this GID.

  • fs_group_change_policy (CDK8sPlus25::FsGroupChangePolicy, nil) (defaults to: nil) —

    Defines behavior of changing ownership and permission of the volume before being exposed inside Pod.

  • group (Numeric, nil) (defaults to: nil) —

    The GID to run the entrypoint of the container process.

  • sysctls (Array<CDK8sPlus25::Sysctl>, nil) (defaults to: nil) —

    Sysctls hold a list of namespaced sysctls used for the pod.

  • user (Numeric, nil) (defaults to: nil) —

    The UID to run the entrypoint of the container process.



13
14
15
16
17
18
19
20
21
22
23
24
25
26
 
# File 'pod_security_context_props.rb', line 13

def initialize(ensure_non_root: nil, fs_group: nil, fs_group_change_policy: nil, group: nil, sysctls: nil, user: nil)
  @ensure_non_root = ensure_non_root
  Jsii::Type.check_type(@ensure_non_root, "eyJwcmltaXRpdmUiOiJib29sZWFuIn0=", "ensureNonRoot") unless @ensure_non_root.nil?
  @fs_group = fs_group
  Jsii::Type.check_type(@fs_group, "eyJwcmltaXRpdmUiOiJudW1iZXIifQ==", "fsGroup") unless @fs_group.nil?
  @fs_group_change_policy = fs_group_change_policy
  Jsii::Type.check_type(@fs_group_change_policy, "eyJmcW4iOiJjZGs4cy1wbHVzLTI1LkZzR3JvdXBDaGFuZ2VQb2xpY3kifQ==", "fsGroupChangePolicy") unless @fs_group_change_policy.nil?
  @group = group
  Jsii::Type.check_type(@group, "eyJwcmltaXRpdmUiOiJudW1iZXIifQ==", "group") unless @group.nil?
  @sysctls = sysctls.is_a?(Array) ? sysctls.map { |jsii_v0| jsii_v0.is_a?(Hash) ? ::CDK8sPlus25::Sysctl.new(**jsii_v0.transform_keys(&:to_sym)) : jsii_v0 } : sysctls
  Jsii::Type.check_type(@sysctls, "eyJjb2xsZWN0aW9uIjp7ImVsZW1lbnR0eXBlIjp7ImZxbiI6ImNkazhzLXBsdXMtMjUuU3lzY3RsIn0sImtpbmQiOiJhcnJheSJ9fQ==", "sysctls") unless @sysctls.nil?
  @user = user
  Jsii::Type.check_type(@user, "eyJwcmltaXRpdmUiOiJudW1iZXIifQ==", "user") unless @user.nil?
end

Instance Attribute Details

#ensure_non_root ⇒ Boolean? (readonly)

Note:

Default: true

Indicates that the container must run as a non-root user.

If true, the Kubelet will validate the image at runtime to ensure that it does not run as UID 0 (root) and fail to start the container if it does.

Returns:

  • (Boolean, nil) 


35
36
37
 
# File 'pod_security_context_props.rb', line 35

def ensure_non_root
  @ensure_non_root
end

#fs_group ⇒ Numeric? (readonly)

Note:

Default: - Volume ownership is not changed.

Modify the ownership and permissions of pod volumes to this GID.

Returns:

  • (Numeric, nil) 


40
41
42
 
# File 'pod_security_context_props.rb', line 40

def fs_group
  @fs_group
end

#fs_group_change_policy ⇒ CDK8sPlus25::FsGroupChangePolicy? (readonly)

Note:

Default: FsGroupChangePolicy.ALWAYS

Defines behavior of changing ownership and permission of the volume before being exposed inside Pod.

This field will only apply to volume types which support fsGroup based ownership(and permissions). It will have no effect on ephemeral volume types such as: secret, configmaps and emptydir.

Returns:



48
49
50
 
# File 'pod_security_context_props.rb', line 48

def fs_group_change_policy
  @fs_group_change_policy
end

#group ⇒ Numeric? (readonly)

Note:

Default: - Group configured by container runtime

The GID to run the entrypoint of the container process.

Returns:

  • (Numeric, nil) 


53
54
55
 
# File 'pod_security_context_props.rb', line 53

def group
  @group
end

#sysctls ⇒ Array<CDK8sPlus25::Sysctl>? (readonly)

Note:

Default: - No sysctls

Sysctls hold a list of namespaced sysctls used for the pod.

Pods with unsupported sysctls (by the container runtime) might fail to launch.

Returns:



60
61
62
 
# File 'pod_security_context_props.rb', line 60

def sysctls
  @sysctls
end

#user ⇒ Numeric? (readonly)

Note:

Default: - User specified in image metadata

The UID to run the entrypoint of the container process.

Returns:

  • (Numeric, nil) 


65
66
67
 
# File 'pod_security_context_props.rb', line 65

def user
  @user
end

Class Method Details

.jsii_properties ⇒ Object 



67
68
69
70
71
72
73
74
75
76
 
# File 'pod_security_context_props.rb', line 67

def self.jsii_properties
  {
    :ensure_non_root => "ensureNonRoot",
    :fs_group => "fsGroup",
    :fs_group_change_policy => "fsGroupChangePolicy",
    :group => "group",
    :sysctls => "sysctls",
    :user => "user",
  }
end

Instance Method Details

#to_jsii ⇒ Object 



78
79
80
81
82
83
84
85
86
87
88
89
 
# File 'pod_security_context_props.rb', line 78

def to_jsii
  result = {}
  result.merge!({
    "ensureNonRoot" => @ensure_non_root,
    "fsGroup" => @fs_group,
    "fsGroupChangePolicy" => @fs_group_change_policy,
    "group" => @group,
    "sysctls" => @sysctls,
    "user" => @user,
  })
  result.compact
end