test_admin - Code Search

samples/security/psp/sidecar-psp.yaml

apiVersion: policy/v1
kind: PodSecurityPolicy
metadata:
  name: istio-sidecar
spec:
  # Allow the istio sidecar injector to work
  allowedCapabilities:
    - NET_ADMIN
    - NET_RAW
  seLinux:
    rule: RunAsAny
  supplementalGroups:
    rule: RunAsAny
  runAsUser:
    rule: RunAsAny
  fsGroup:
    rule: RunAsAny
  volumes:
    - '*'
---
kind: ClusterRole
apiVersion: rbac.authorization.k8s.io/v1
metadata:

Registered: Fri Jun 14 15:00:06 UTC 2024

- Last Modified: Mon Nov 27 17:55:37 UTC 2023

- 881 bytes

- Viewed (0)

github.com/istio/istio

pkg/kube/inject/testdata/inject/proxy-override-runas.yaml.tproxy.injected

          requests:
            cpu: 100m
            memory: 128Mi
        securityContext:
          allowPrivilegeEscalation: false
          capabilities:
            add:
            - NET_ADMIN
            drop:
            - ALL
          privileged: false
          readOnlyRootFilesystem: true
          runAsGroup: 4321
          runAsNonRoot: false
          runAsUser: 0
        startupProbe:

Registered: Fri Jun 14 15:00:06 UTC 2024

- Last Modified: Tue May 14 17:59:39 UTC 2024

- 6.6K bytes

- Viewed (0)

github.com/istio/istio

pkg/kube/inject/testdata/inject/hello-tproxy.yaml.injected

          requests:
            cpu: 100m
            memory: 128Mi
        securityContext:
          allowPrivilegeEscalation: false
          capabilities:
            add:
            - NET_ADMIN
            drop:
            - ALL
          privileged: false
          readOnlyRootFilesystem: true
          runAsGroup: 1337
          runAsNonRoot: false
          runAsUser: 0
        startupProbe:

Registered: Fri Jun 14 15:00:06 UTC 2024

- Last Modified: Tue Feb 27 16:55:16 UTC 2024

- 6.6K bytes

- Viewed (0)

github.com/istio/istio

operator/cmd/mesh/testdata/manifest-generate/output/ztunnel.golden.yaml

          requests:
            cpu: 100m
            memory: 100Mi
        securityContext:
          allowPrivilegeEscalation: false
          capabilities:
            add:
            - NET_ADMIN
            drop:
            - ALL
          privileged: false
          readOnlyRootFilesystem: true
          runAsGroup: 1337
          runAsNonRoot: false
          runAsUser: 0
        volumeMounts:

Registered: Fri Jun 14 15:00:06 UTC 2024

- Last Modified: Wed Jan 31 23:49:40 UTC 2024

- 3K bytes

- Viewed (0)

github.com/kubernetes/kubernetes

plugin/pkg/admission/storage/storageobjectinuseprotection/admission_test.go

	"k8s.io/apimachinery/pkg/runtime/schema"
	"k8s.io/apimachinery/pkg/util/dump"
	"k8s.io/apiserver/pkg/admission"
	api "k8s.io/kubernetes/pkg/apis/core"
	volumeutil "k8s.io/kubernetes/pkg/volume/util"
)

func TestAdmit(t *testing.T) {
	claim := &api.PersistentVolumeClaim{
		TypeMeta: metav1.TypeMeta{
			Kind: "PersistentVolumeClaim",
		},
		ObjectMeta: metav1.ObjectMeta{
			Name:      "claim",
			Namespace: "ns",
		},
	}

Registered: Sat Jun 15 01:39:40 UTC 2024

- Last Modified: Fri Apr 14 00:05:53 UTC 2023

- 3.2K bytes

- Viewed (0)

github.com/istio/istio

tools/istio-iptables/pkg/log/nflog.go

	"istio.io/istio/pkg/env"
	"istio.io/istio/pkg/log"
)

var TraceLoggingEnabled = env.Register(
	"IPTABLES_TRACE_LOGGING",
	false,
	"When enable, all iptables actions will be logged. "+
		"This requires NET_ADMIN privilege and has noisy logs; as a result, this is intended for debugging only").Get()

var iptablesTrace = log.RegisterScope("iptables", "trace logs for iptables")

Registered: Fri Jun 14 15:00:06 UTC 2024

- Last Modified: Thu Jun 06 15:59:40 UTC 2024

- 2.8K bytes

- Viewed (0)

github.com/istio/istio

manifests/charts/ztunnel/templates/daemonset.yaml

          privileged: false
          capabilities:
            drop:
            - ALL
            add: # See https://man7.org/linux/man-pages/man7/capabilities.7.html
            - NET_ADMIN # Required for TPROXY and setsockopt
            - SYS_ADMIN # Required for `setns` - doing things in other netns
            - NET_RAW # Required for RAW/PACKET sockets, TPROXY
          readOnlyRootFilesystem: true

Registered: Fri Jun 14 15:00:06 UTC 2024

- Last Modified: Tue Jun 11 01:33:52 UTC 2024

- 5.6K bytes

- Viewed (0)

github.com/istio/istio

pkg/kube/inject/testdata/inject/only-proxy-container.yaml.injected

          requests:
            cpu: 100m
            memory: 128Mi
        securityContext:
          allowPrivilegeEscalation: false
          capabilities:
            add:
            - NET_ADMIN
            - NET_RAW
            drop:
            - ALL
          privileged: false
          readOnlyRootFilesystem: false
          runAsGroup: 0
          runAsNonRoot: false
          runAsUser: 0

Registered: Fri Jun 14 15:00:06 UTC 2024

- Last Modified: Tue Feb 27 16:55:16 UTC 2024

- 6.3K bytes

- Viewed (0)

github.com/istio/istio

pkg/kube/inject/testdata/inject/proxy-override-runas.yaml.injected

          requests:
            cpu: 100m
            memory: 128Mi
        securityContext:
          allowPrivilegeEscalation: false
          capabilities:
            add:
            - NET_ADMIN
            - NET_RAW
            drop:
            - ALL
          privileged: false
          readOnlyRootFilesystem: false
          runAsGroup: 0
          runAsNonRoot: false
          runAsUser: 0

Registered: Fri Jun 14 15:00:06 UTC 2024

- Last Modified: Tue May 14 17:59:39 UTC 2024

- 6.5K bytes

- Viewed (0)

github.com/istio/istio

pkg/kube/inject/testdata/inject/job.yaml.injected

          requests:
            cpu: 100m
            memory: 128Mi
        securityContext:
          allowPrivilegeEscalation: false
          capabilities:
            add:
            - NET_ADMIN
            - NET_RAW
            drop:
            - ALL
          privileged: false
          readOnlyRootFilesystem: false
          runAsGroup: 0
          runAsNonRoot: false
          runAsUser: 0

Registered: Fri Jun 14 15:00:06 UTC 2024

- Last Modified: Tue Feb 27 16:55:16 UTC 2024

- 6.4K bytes

- Viewed (0)

Search Options