fsGroup - Code Search

helm/minio/templates/statefulset.yaml

      securityContext:
        runAsUser: {{ .Values.securityContext.runAsUser }}
        runAsGroup: {{ .Values.securityContext.runAsGroup }}
        fsGroup: {{ .Values.securityContext.fsGroup }}
        {{- if and (ge .Capabilities.KubeVersion.Major "1") (ge .Capabilities.KubeVersion.Minor "20") }}
        fsGroupChangePolicy: {{ .Values.securityContext.fsGroupChangePolicy }}
        {{- end }}

Registered: Sun Jun 16 00:44:34 UTC 2024

- Last Modified: Fri Apr 26 07:50:24 UTC 2024

- 10.7K bytes

- Viewed (0)

github.com/kubernetes/kubernetes

staging/src/k8s.io/api/storage/v1/types.go

	// to determine if the volume ownership and permissions
	// should be modified. If a fstype is defined and the volume's access mode
	// contains ReadWriteOnce, then the defined fsGroup will be applied.
	// This mode should be defined if it's expected that the
	// fsGroup may need to be modified depending on the pod's SecurityPolicy.
	// This is the default behavior if no other FSGroupPolicy is defined.

Registered: Sat Jun 15 01:39:40 UTC 2024

- Last Modified: Thu May 23 17:42:49 UTC 2024

- 32K bytes

- Viewed (0)

github.com/istio/istio

pkg/kube/inject/testdata/inject/explicit-security-context.yaml.injected

            - ALL
          privileged: false
          readOnlyRootFilesystem: false
          runAsGroup: 0
          runAsNonRoot: false
          runAsUser: 0
      securityContext:
        fsGroup: 1234
      volumes:
      - name: workload-socket
      - name: credential-socket
      - name: workload-certs
      - emptyDir:
          medium: Memory
        name: istio-envoy
      - emptyDir: {}

Registered: Fri Jun 14 15:00:06 UTC 2024

- Last Modified: Tue Feb 27 16:55:16 UTC 2024

- 6.4K bytes

- Viewed (0)

github.com/minio/minio

helm-releases/minio-5.0.15.tgz

false allowPrivilegeEscala: true allowPrivilegedConta: false allowedCapabilities: [] readOnlyRootFilesyst: false defaultAddCapabiliti: [] requiredDropCapabili: - KILL - MKNOD - SETUID - SETGID fsGroup: type: MustRunAs ranges: - max: {{ .Values.securityContext.fsGroup }} min: {{ .Values.securityContext.fsGroup }} runAsUser: type: MustRunAs uid: {{ .Values.securityContext.runAsUser }} seLinuxContext: type: MustRunAs supplementalGroups: type: RunAsAny volumes: - configMap - downwardAPI - emptyDir - persistentVolumeClai...

Registered: Sun Jun 16 00:44:34 UTC 2024

- Last Modified: Fri Jan 12 18:18:57 UTC 2024

- 20.8K bytes

- Viewed (0)

github.com/kubernetes/kubernetes

cluster/addons/dns/kube-dns/kube-dns.yaml.in

    spec:
      priorityClassName: system-cluster-critical
      securityContext:
        seccompProfile:
          type: RuntimeDefault
        supplementalGroups: [ 65534 ]
        fsGroup: 65534
      affinity:
        podAntiAffinity:
          preferredDuringSchedulingIgnoredDuringExecution:
          - weight: 100
            podAffinityTerm:
              labelSelector:

Registered: Sat Jun 15 01:39:40 UTC 2024

- Last Modified: Mon Jun 03 03:19:02 UTC 2024

- 7K bytes

- Viewed (0)

github.com/istio/istio

common-protos/k8s.io/api/policy/v1beta1/generated.proto

  optional SupplementalGroupsStrategyOptions supplementalGroups = 12;

  // fsGroup is the strategy that will dictate what fs group is used by the SecurityContext.
  optional FSGroupStrategyOptions fsGroup = 13;

  // readOnlyRootFilesystem when set to true will force containers to run with a read only root file

Registered: Fri Jun 14 15:00:06 UTC 2024

- Last Modified: Mon Mar 11 18:43:24 UTC 2024

- 19.6K bytes

- Viewed (0)

github.com/kubernetes/kubernetes

cluster/addons/dns/kube-dns/kube-dns.yaml.base

    spec:
      priorityClassName: system-cluster-critical
      securityContext:
        seccompProfile:
          type: RuntimeDefault
        supplementalGroups: [ 65534 ]
        fsGroup: 65534
      affinity:
        podAntiAffinity:
          preferredDuringSchedulingIgnoredDuringExecution:
          - weight: 100
            podAffinityTerm:
              labelSelector:

Registered: Sat Jun 15 01:39:40 UTC 2024

- Last Modified: Mon Jun 03 03:19:02 UTC 2024

- 7K bytes

- Viewed (0)

github.com/minio/minio

helm-releases/minio-5.1.0.tgz

false allowPrivilegeEscala: true allowPrivilegedConta: false allowedCapabilities: [] readOnlyRootFilesyst: false defaultAddCapabiliti: [] requiredDropCapabili: - KILL - MKNOD - SETUID - SETGID fsGroup: type: MustRunAs ranges: - max: {{ .Values.securityContext.fsGroup }} min: {{ .Values.securityContext.fsGroup }} runAsUser: type: MustRunAs uid: {{ .Values.securityContext.runAsUser }} seLinuxContext: type: MustRunAs supplementalGroups: type: RunAsAny volumes: - configMap - downwardAPI - emptyDir - persistentVolumeClai...

Registered: Sun Jun 16 00:44:34 UTC 2024

- Last Modified: Sun Mar 03 18:49:37 UTC 2024

- 21.3K bytes

- Viewed (0)

github.com/minio/minio

helm-releases/minio-5.2.0.tgz

false allowPrivilegeEscala: true allowPrivilegedConta: false allowedCapabilities: [] readOnlyRootFilesyst: false defaultAddCapabiliti: [] requiredDropCapabili: - KILL - MKNOD - SETUID - SETGID fsGroup: type: MustRunAs ranges: - max: {{ .Values.securityContext.fsGroup }} min: {{ .Values.securityContext.fsGroup }} runAsUser: type: MustRunAs uid: {{ .Values.securityContext.runAsUser }} seLinuxContext: type: MustRunAs supplementalGroups: type: RunAsAny volumes: - configMap - downwardAPI - emptyDir - persistentVolumeClai...

Registered: Sun Jun 16 00:44:34 UTC 2024

- Last Modified: Sun Apr 28 10:14:37 UTC 2024

- 21.7K bytes

- Viewed (0)

github.com/kubernetes/kubernetes

pkg/kubelet/kuberuntime/kuberuntime_sandbox.go

		if err != nil {
			return nil, err
		}
		lc.SecurityContext.NamespaceOptions = namespaceOptions

		if sc.FSGroup != nil && runtime.GOOS != "windows" {
			lc.SecurityContext.SupplementalGroups = append(lc.SecurityContext.SupplementalGroups, int64(*sc.FSGroup))
		}
		if groups := m.runtimeHelper.GetExtraSupplementalGroupsForPod(pod); len(groups) > 0 {

Registered: Sat Jun 15 01:39:40 UTC 2024

- Last Modified: Wed May 29 22:40:29 UTC 2024

- 13.6K bytes

- Viewed (0)

Search Options