rityCon }} {{- toYaml .Values.containerSecurityCon | nindent 12 }} {{- else if (semverCompare ">=1.22-0" .Capabilities.KubeVersion.GitVersion) }} # Safe since 1.22: https://github.com/kubernetes/kubernetes/pull/103326 capabilities: drop: - ALL allowPrivilegeEscala: false privileged: false readOnlyRootFilesyst: true runAsUser: 1337 runAsGroup: 1337 runAsNonRoot: true {{- else }} capabilities: drop: - ALL add: - NET_BIND_SERVICE runAsUser: 0 runAsGroup: 1337 runAsNonRoot: false allowPrivilegeEscala:...

         * to(overrides negotiatedCapabilities).
         */

        /* We really should do the referral before this in case
         * the redirected target has different capabilities. But
         * the way we have been doing that is to call exists() which
         * calls this method so another technique will be necessary
         * to support DFS referral _to_ Win95/98/ME.
         */

  - Easier to understand a cluster (eg: API audit logs, server-based API defaults)
- **Stateful Application Support**
  - Enhanced persistence capabilities (eg: `StorageClasses`, new volume plugins)
  - New resources and scheduler features (eg: `ScheduledJob` resource, pod/node affinity/anti-affinity)
- **Cluster Federation**