v1.PodSecurityPolicySubjectReview

You are viewing documentation for a release that is no longer supported. The latest supported version of version 3 is [3.11]. For the most recent version 4, see [4]

You are viewing documentation for a release that is no longer supported. The latest supported version of version 3 is [3.11]. For the most recent version 4, see [4]

Description

PodSecurityPolicySubjectReview checks whether a particular user/SA tuple can create the PodTemplateSpec.

Object Schema

Expand or mouse-over a field for more information about it.

apiVersion:
kind:
spec:
  groups:
  - [string]:
  template:
    metadata:
      annotations:
        [string]:
      clusterName:
      creationTimestamp:
      deletionGracePeriodSeconds:
      deletionTimestamp:
      finalizers:
      - [string]:
      generateName:
      generation:
      initializers:
        pending:
        - name:
        result:
          apiVersion:
          code:
          details:
            causes:
            - field:
              message:
              reason:
            group:
            kind:
            name:
            retryAfterSeconds:
            uid:
          kind:
          message:
          metadata:
            resourceVersion:
            selfLink:
          reason:
          status:
      labels:
        [string]:
      name:
      namespace:
      ownerReferences:
      - apiVersion:
        blockOwnerDeletion:
        controller:
        kind:
        name:
        uid:
      resourceVersion:
      selfLink:
      uid:
    spec:
      activeDeadlineSeconds:
      affinity:
        nodeAffinity:
          preferredDuringSchedulingIgnoredDuringExecution:
          - preference:
          -   matchExpressions:
          -   - key:
                operator:
                values:
                - [string]:
            weight:
          requiredDuringSchedulingIgnoredDuringExecution:
            nodeSelectorTerms:
            - matchExpressions:
            - - key:
                operator:
                values:
                - [string]:
        podAffinity:
          preferredDuringSchedulingIgnoredDuringExecution:
          - podAffinityTerm:
          -   labelSelector:
          -     matchExpressions:
          -     - key:
                  operator:
                  values:
                  - [string]:
                matchLabels:
                  [string]:
              namespaces:
              - [string]:
              topologyKey:
            weight:
          requiredDuringSchedulingIgnoredDuringExecution:
          - labelSelector:
          -   matchExpressions:
          -   - key:
                operator:
                values:
                - [string]:
              matchLabels:
                [string]:
            namespaces:
            - [string]:
            topologyKey:
        podAntiAffinity:
          preferredDuringSchedulingIgnoredDuringExecution:
          - podAffinityTerm:
          -   labelSelector:
          -     matchExpressions:
          -     - key:
                  operator:
                  values:
                  - [string]:
                matchLabels:
                  [string]:
              namespaces:
              - [string]:
              topologyKey:
            weight:
          requiredDuringSchedulingIgnoredDuringExecution:
          - labelSelector:
          -   matchExpressions:
          -   - key:
                operator:
                values:
                - [string]:
              matchLabels:
                [string]:
            namespaces:
            - [string]:
            topologyKey:
      automountServiceAccountToken:
      containers:
      - args:
      - - [string]:
        command:
        - [string]:
        env:
        - name:
          value:
          valueFrom:
            configMapKeyRef:
              key:
              name:
              optional:
            fieldRef:
              apiVersion:
              fieldPath:
            resourceFieldRef:
              containerName:
              divisor:
              resource:
            secretKeyRef:
              key:
              name:
              optional:
        envFrom:
        - configMapRef:
        -   name:
            optional:
          prefix:
          secretRef:
            name:
            optional:
        image:
        imagePullPolicy:
        lifecycle:
          postStart:
            exec:
              command:
              - [string]:
            httpGet:
              host:
              httpHeaders:
              - name:
                value:
              path:
              port:
              scheme:
            tcpSocket:
              host:
              port:
          preStop:
            exec:
              command:
              - [string]:
            httpGet:
              host:
              httpHeaders:
              - name:
                value:
              path:
              port:
              scheme:
            tcpSocket:
              host:
              port:
        livenessProbe:
          exec:
            command:
            - [string]:
          failureThreshold:
          httpGet:
            host:
            httpHeaders:
            - name:
              value:
            path:
            port:
            scheme:
          initialDelaySeconds:
          periodSeconds:
          successThreshold:
          tcpSocket:
            host:
            port:
          timeoutSeconds:
        name:
        ports:
        - containerPort:
          hostIP:
          hostPort:
          name:
          protocol:
        readinessProbe:
          exec:
            command:
            - [string]:
          failureThreshold:
          httpGet:
            host:
            httpHeaders:
            - name:
              value:
            path:
            port:
            scheme:
          initialDelaySeconds:
          periodSeconds:
          successThreshold:
          tcpSocket:
            host:
            port:
          timeoutSeconds:
        resources:
          limits:
            [string]:
          requests:
            [string]:
        securityContext:
          capabilities:
            add:
            - [string]:
            drop:
            - [string]:
          privileged:
          readOnlyRootFilesystem:
          runAsNonRoot:
          runAsUser:
          seLinuxOptions:
            level:
            role:
            type:
            user:
        stdin:
        stdinOnce:
        terminationMessagePath:
        terminationMessagePolicy:
        tty:
        volumeMounts:
        - mountPath:
          name:
          readOnly:
          subPath:
        workingDir:
      dnsPolicy:
      hostAliases:
      - hostnames:
      - - [string]:
        ip:
      hostIPC:
      hostNetwork:
      hostPID:
      hostname:
      imagePullSecrets:
      - name:
      initContainers:
      - args:
      - - [string]:
        command:
        - [string]:
        env:
        - name:
          value:
          valueFrom:
            configMapKeyRef:
              key:
              name:
              optional:
            fieldRef:
              apiVersion:
              fieldPath:
            resourceFieldRef:
              containerName:
              divisor:
              resource:
            secretKeyRef:
              key:
              name:
              optional:
        envFrom:
        - configMapRef:
        -   name:
            optional:
          prefix:
          secretRef:
            name:
            optional:
        image:
        imagePullPolicy:
        lifecycle:
          postStart:
            exec:
              command:
              - [string]:
            httpGet:
              host:
              httpHeaders:
              - name:
                value:
              path:
              port:
              scheme:
            tcpSocket:
              host:
              port:
          preStop:
            exec:
              command:
              - [string]:
            httpGet:
              host:
              httpHeaders:
              - name:
                value:
              path:
              port:
              scheme:
            tcpSocket:
              host:
              port:
        livenessProbe:
          exec:
            command:
            - [string]:
          failureThreshold:
          httpGet:
            host:
            httpHeaders:
            - name:
              value:
            path:
            port:
            scheme:
          initialDelaySeconds:
          periodSeconds:
          successThreshold:
          tcpSocket:
            host:
            port:
          timeoutSeconds:
        name:
        ports:
        - containerPort:
          hostIP:
          hostPort:
          name:
          protocol:
        readinessProbe:
          exec:
            command:
            - [string]:
          failureThreshold:
          httpGet:
            host:
            httpHeaders:
            - name:
              value:
            path:
            port:
            scheme:
          initialDelaySeconds:
          periodSeconds:
          successThreshold:
          tcpSocket:
            host:
            port:
          timeoutSeconds:
        resources:
          limits:
            [string]:
          requests:
            [string]:
        securityContext:
          capabilities:
            add:
            - [string]:
            drop:
            - [string]:
          privileged:
          readOnlyRootFilesystem:
          runAsNonRoot:
          runAsUser:
          seLinuxOptions:
            level:
            role:
            type:
            user:
        stdin:
        stdinOnce:
        terminationMessagePath:
        terminationMessagePolicy:
        tty:
        volumeMounts:
        - mountPath:
          name:
          readOnly:
          subPath:
        workingDir:
      nodeName:
      nodeSelector:
        [string]:
      restartPolicy:
      schedulerName:
      securityContext:
        fsGroup:
        runAsNonRoot:
        runAsUser:
        seLinuxOptions:
          level:
          role:
          type:
          user:
        supplementalGroups:
        - [integer]:
      serviceAccount:
      serviceAccountName:
      subdomain:
      terminationGracePeriodSeconds:
      tolerations:
      - effect:
        key:
        operator:
        tolerationSeconds:
        value:
      volumes:
      - awsElasticBlockStore:
      -   fsType:
          partition:
          readOnly:
          volumeID:
        azureDisk:
          cachingMode:
          diskName:
          diskURI:
          fsType:
          kind:
          readOnly:
        azureFile:
          readOnly:
          secretName:
          shareName:
        cephfs:
          monitors:
          - [string]:
          path:
          readOnly:
          secretFile:
          secretRef:
            name:
          user:
        cinder:
          fsType:
          readOnly:
          volumeID:
        configMap:
          defaultMode:
          items:
          - key:
            mode:
            path:
          name:
          optional:
        downwardAPI:
          defaultMode:
          items:
          - fieldRef:
          -   apiVersion:
              fieldPath:
            mode:
            path:
            resourceFieldRef:
              containerName:
              divisor:
              resource:
        emptyDir:
          medium:
          sizeLimit:
        fc:
          fsType:
          lun:
          readOnly:
          targetWWNs:
          - [string]:
        flexVolume:
          driver:
          fsType:
          options:
            [string]:
          readOnly:
          secretRef:
            name:
        flocker:
          datasetName:
          datasetUUID:
        gcePersistentDisk:
          fsType:
          partition:
          pdName:
          readOnly:
        gitRepo:
          directory:
          repository:
          revision:
        glusterfs:
          endpoints:
          path:
          readOnly:
        hostPath:
          path:
        iscsi:
          chapAuthDiscovery:
          chapAuthSession:
          fsType:
          iqn:
          iscsiInterface:
          lun:
          portals:
          - [string]:
          readOnly:
          secretRef:
            name:
          targetPortal:
        name:
        nfs:
          path:
          readOnly:
          server:
        persistentVolumeClaim:
          claimName:
          readOnly:
        photonPersistentDisk:
          fsType:
          pdID:
        portworxVolume:
          fsType:
          readOnly:
          volumeID:
        projected:
          defaultMode:
          sources:
          - configMap:
          -   items:
          -   - key:
                mode:
                path:
              name:
              optional:
            downwardAPI:
              items:
              - fieldRef:
              -   apiVersion:
                  fieldPath:
                mode:
                path:
                resourceFieldRef:
                  containerName:
                  divisor:
                  resource:
            secret:
              items:
              - key:
                mode:
                path:
              name:
              optional:
        quobyte:
          group:
          readOnly:
          registry:
          user:
          volume:
        rbd:
          fsType:
          image:
          keyring:
          monitors:
          - [string]:
          pool:
          readOnly:
          secretRef:
            name:
          user:
        scaleIO:
          fsType:
          gateway:
          protectionDomain:
          readOnly:
          secretRef:
            name:
          sslEnabled:
          storageMode:
          storagePool:
          system:
          volumeName:
        secret:
          defaultMode:
          items:
          - key:
            mode:
            path:
          optional:
          secretName:
        storageos:
          fsType:
          readOnly:
          secretRef:
            name:
          volumeName:
          volumeNamespace:
        vsphereVolume:
          fsType:
          storagePolicyID:
          storagePolicyName:
          volumePath:
  user:
status:
  allowedBy:
    apiVersion:
    fieldPath:
    kind:
    name:
    namespace:
    resourceVersion:
    uid:
  reason:
  template:
    metadata:
      annotations:
        [string]:
      clusterName:
      creationTimestamp:
      deletionGracePeriodSeconds:
      deletionTimestamp:
      finalizers:
      - [string]:
      generateName:
      generation:
      initializers:
        pending:
        - name:
        result:
          apiVersion:
          code:
          details:
            causes:
            - field:
              message:
              reason:
            group:
            kind:
            name:
            retryAfterSeconds:
            uid:
          kind:
          message:
          metadata:
            resourceVersion:
            selfLink:
          reason:
          status:
      labels:
        [string]:
      name:
      namespace:
      ownerReferences:
      - apiVersion:
        blockOwnerDeletion:
        controller:
        kind:
        name:
        uid:
      resourceVersion:
      selfLink:
      uid:
    spec:
      activeDeadlineSeconds:
      affinity:
        nodeAffinity:
          preferredDuringSchedulingIgnoredDuringExecution:
          - preference:
          -   matchExpressions:
          -   - key:
                operator:
                values:
                - [string]:
            weight:
          requiredDuringSchedulingIgnoredDuringExecution:
            nodeSelectorTerms:
            - matchExpressions:
            - - key:
                operator:
                values:
                - [string]:
        podAffinity:
          preferredDuringSchedulingIgnoredDuringExecution:
          - podAffinityTerm:
          -   labelSelector:
          -     matchExpressions:
          -     - key:
                  operator:
                  values:
                  - [string]:
                matchLabels:
                  [string]:
              namespaces:
              - [string]:
              topologyKey:
            weight:
          requiredDuringSchedulingIgnoredDuringExecution:
          - labelSelector:
          -   matchExpressions:
          -   - key:
                operator:
                values:
                - [string]:
              matchLabels:
                [string]:
            namespaces:
            - [string]:
            topologyKey:
        podAntiAffinity:
          preferredDuringSchedulingIgnoredDuringExecution:
          - podAffinityTerm:
          -   labelSelector:
          -     matchExpressions:
          -     - key:
                  operator:
                  values:
                  - [string]:
                matchLabels:
                  [string]:
              namespaces:
              - [string]:
              topologyKey:
            weight:
          requiredDuringSchedulingIgnoredDuringExecution:
          - labelSelector:
          -   matchExpressions:
          -   - key:
                operator:
                values:
                - [string]:
              matchLabels:
                [string]:
            namespaces:
            - [string]:
            topologyKey:
      automountServiceAccountToken:
      containers:
      - args:
      - - [string]:
        command:
        - [string]:
        env:
        - name:
          value:
          valueFrom:
            configMapKeyRef:
              key:
              name:
              optional:
            fieldRef:
              apiVersion:
              fieldPath:
            resourceFieldRef:
              containerName:
              divisor:
              resource:
            secretKeyRef:
              key:
              name:
              optional:
        envFrom:
        - configMapRef:
        -   name:
            optional:
          prefix:
          secretRef:
            name:
            optional:
        image:
        imagePullPolicy:
        lifecycle:
          postStart:
            exec:
              command:
              - [string]:
            httpGet:
              host:
              httpHeaders:
              - name:
                value:
              path:
              port:
              scheme:
            tcpSocket:
              host:
              port:
          preStop:
            exec:
              command:
              - [string]:
            httpGet:
              host:
              httpHeaders:
              - name:
                value:
              path:
              port:
              scheme:
            tcpSocket:
              host:
              port:
        livenessProbe:
          exec:
            command:
            - [string]:
          failureThreshold:
          httpGet:
            host:
            httpHeaders:
            - name:
              value:
            path:
            port:
            scheme:
          initialDelaySeconds:
          periodSeconds:
          successThreshold:
          tcpSocket:
            host:
            port:
          timeoutSeconds:
        name:
        ports:
        - containerPort:
          hostIP:
          hostPort:
          name:
          protocol:
        readinessProbe:
          exec:
            command:
            - [string]:
          failureThreshold:
          httpGet:
            host:
            httpHeaders:
            - name:
              value:
            path:
            port:
            scheme:
          initialDelaySeconds:
          periodSeconds:
          successThreshold:
          tcpSocket:
            host:
            port:
          timeoutSeconds:
        resources:
          limits:
            [string]:
          requests:
            [string]:
        securityContext:
          capabilities:
            add:
            - [string]:
            drop:
            - [string]:
          privileged:
          readOnlyRootFilesystem:
          runAsNonRoot:
          runAsUser:
          seLinuxOptions:
            level:
            role:
            type:
            user:
        stdin:
        stdinOnce:
        terminationMessagePath:
        terminationMessagePolicy:
        tty:
        volumeMounts:
        - mountPath:
          name:
          readOnly:
          subPath:
        workingDir:
      dnsPolicy:
      hostAliases:
      - hostnames:
      - - [string]:
        ip:
      hostIPC:
      hostNetwork:
      hostPID:
      hostname:
      imagePullSecrets:
      - name:
      initContainers:
      - args:
      - - [string]:
        command:
        - [string]:
        env:
        - name:
          value:
          valueFrom:
            configMapKeyRef:
              key:
              name:
              optional:
            fieldRef:
              apiVersion:
              fieldPath:
            resourceFieldRef:
              containerName:
              divisor:
              resource:
            secretKeyRef:
              key:
              name:
              optional:
        envFrom:
        - configMapRef:
        -   name:
            optional:
          prefix:
          secretRef:
            name:
            optional:
        image:
        imagePullPolicy:
        lifecycle:
          postStart:
            exec:
              command:
              - [string]:
            httpGet:
              host:
              httpHeaders:
              - name:
                value:
              path:
              port:
              scheme:
            tcpSocket:
              host:
              port:
          preStop:
            exec:
              command:
              - [string]:
            httpGet:
              host:
              httpHeaders:
              - name:
                value:
              path:
              port:
              scheme:
            tcpSocket:
              host:
              port:
        livenessProbe:
          exec:
            command:
            - [string]:
          failureThreshold:
          httpGet:
            host:
            httpHeaders:
            - name:
              value:
            path:
            port:
            scheme:
          initialDelaySeconds:
          periodSeconds:
          successThreshold:
          tcpSocket:
            host:
            port:
          timeoutSeconds:
        name:
        ports:
        - containerPort:
          hostIP:
          hostPort:
          name:
          protocol:
        readinessProbe:
          exec:
            command:
            - [string]:
          failureThreshold:
          httpGet:
            host:
            httpHeaders:
            - name:
              value:
            path:
            port:
            scheme:
          initialDelaySeconds:
          periodSeconds:
          successThreshold:
          tcpSocket:
            host:
            port:
          timeoutSeconds:
        resources:
          limits:
            [string]:
          requests:
            [string]:
        securityContext:
          capabilities:
            add:
            - [string]:
            drop:
            - [string]:
          privileged:
          readOnlyRootFilesystem:
          runAsNonRoot:
          runAsUser:
          seLinuxOptions:
            level:
            role:
            type:
            user:
        stdin:
        stdinOnce:
        terminationMessagePath:
        terminationMessagePolicy:
        tty:
        volumeMounts:
        - mountPath:
          name:
          readOnly:
          subPath:
        workingDir:
      nodeName:
      nodeSelector:
        [string]:
      restartPolicy:
      schedulerName:
      securityContext:
        fsGroup:
        runAsNonRoot:
        runAsUser:
        seLinuxOptions:
          level:
          role:
          type:
          user:
        supplementalGroups:
        - [integer]:
      serviceAccount:
      serviceAccountName:
      subdomain:
      terminationGracePeriodSeconds:
      tolerations:
      - effect:
        key:
        operator:
        tolerationSeconds:
        value:
      volumes:
      - awsElasticBlockStore:
      -   fsType:
          partition:
          readOnly:
          volumeID:
        azureDisk:
          cachingMode:
          diskName:
          diskURI:
          fsType:
          kind:
          readOnly:
        azureFile:
          readOnly:
          secretName:
          shareName:
        cephfs:
          monitors:
          - [string]:
          path:
          readOnly:
          secretFile:
          secretRef:
            name:
          user:
        cinder:
          fsType:
          readOnly:
          volumeID:
        configMap:
          defaultMode:
          items:
          - key:
            mode:
            path:
          name:
          optional:
        downwardAPI:
          defaultMode:
          items:
          - fieldRef:
          -   apiVersion:
              fieldPath:
            mode:
            path:
            resourceFieldRef:
              containerName:
              divisor:
              resource:
        emptyDir:
          medium:
          sizeLimit:
        fc:
          fsType:
          lun:
          readOnly:
          targetWWNs:
          - [string]:
        flexVolume:
          driver:
          fsType:
          options:
            [string]:
          readOnly:
          secretRef:
            name:
        flocker:
          datasetName:
          datasetUUID:
        gcePersistentDisk:
          fsType:
          partition:
          pdName:
          readOnly:
        gitRepo:
          directory:
          repository:
          revision:
        glusterfs:
          endpoints:
          path:
          readOnly:
        hostPath:
          path:
        iscsi:
          chapAuthDiscovery:
          chapAuthSession:
          fsType:
          iqn:
          iscsiInterface:
          lun:
          portals:
          - [string]:
          readOnly:
          secretRef:
            name:
          targetPortal:
        name:
        nfs:
          path:
          readOnly:
          server:
        persistentVolumeClaim:
          claimName:
          readOnly:
        photonPersistentDisk:
          fsType:
          pdID:
        portworxVolume:
          fsType:
          readOnly:
          volumeID:
        projected:
          defaultMode:
          sources:
          - configMap:
          -   items:
          -   - key:
                mode:
                path:
              name:
              optional:
            downwardAPI:
              items:
              - fieldRef:
              -   apiVersion:
                  fieldPath:
                mode:
                path:
                resourceFieldRef:
                  containerName:
                  divisor:
                  resource:
            secret:
              items:
              - key:
                mode:
                path:
              name:
              optional:
        quobyte:
          group:
          readOnly:
          registry:
          user:
          volume:
        rbd:
          fsType:
          image:
          keyring:
          monitors:
          - [string]:
          pool:
          readOnly:
          secretRef:
            name:
          user:
        scaleIO:
          fsType:
          gateway:
          protectionDomain:
          readOnly:
          secretRef:
            name:
          sslEnabled:
          storageMode:
          storagePool:
          system:
          volumeName:
        secret:
          defaultMode:
          items:
          - key:
            mode:
            path:
          optional:
          secretName:
        storageos:
          fsType:
          readOnly:
          secretRef:
            name:
          volumeName:
          volumeNamespace:
        vsphereVolume:
          fsType:
          storagePolicyID:
          storagePolicyName:
          volumePath:

Operations

Create a PodSecurityPolicySubjectReview

Create a PodSecurityPolicySubjectReview

HTTP request

POST /apis/security.openshift.io/v1/podsecuritypolicysubjectreviews HTTP/1.1
Authorization: Bearer $TOKEN
Accept: application/json
Connection: close
Content-Type: application/json'
{
  "kind": "PodSecurityPolicySubjectReview",
  "apiVersion": "security.openshift.io/v1",
  ...
}

Curl request

$ curl -k \
    -X POST \
    -d @- \
    -H "Authorization: Bearer $TOKEN" \
    -H 'Accept: application/json' \
    -H 'Content-Type: application/json' \
    https://$ENDPOINT/apis/security.openshift.io/v1/podsecuritypolicysubjectreviews <<'EOF'
{
  "kind": "PodSecurityPolicySubjectReview",
  "apiVersion": "security.openshift.io/v1",
  ...
}
EOF

HTTP body

Query parameters

Responses

Consumes

• */*

Produces

• application/json

• application/yaml

• application/vnd.kubernetes.protobuf

Create a PodSecurityPolicySubjectReview in a namespace

Create a PodSecurityPolicySubjectReview

HTTP request

POST /apis/security.openshift.io/v1/namespaces/$NAMESPACE/podsecuritypolicysubjectreviews HTTP/1.1
Authorization: Bearer $TOKEN
Accept: application/json
Connection: close
Content-Type: application/json'
{
  "kind": "PodSecurityPolicySubjectReview",
  "apiVersion": "security.openshift.io/v1",
  ...
}

Curl request

$ curl -k \
    -X POST \
    -d @- \
    -H "Authorization: Bearer $TOKEN" \
    -H 'Accept: application/json' \
    -H 'Content-Type: application/json' \
    https://$ENDPOINT/apis/security.openshift.io/v1/namespaces/$NAMESPACE/podsecuritypolicysubjectreviews <<'EOF'
{
  "kind": "PodSecurityPolicySubjectReview",
  "apiVersion": "security.openshift.io/v1",
  ...
}
EOF

HTTP body

Path parameters

Query parameters

Responses

Consumes

• */*

Produces

• application/json

• application/yaml

• application/vnd.kubernetes.protobuf