WorkloadAllowlist
auto.gke.io / v1
apiVersion: auto.gke.io/v1
kind: WorkloadAllowlist
metadata:
name: example
apiVersion
string
APIVersion defines the versioned schema of this representation of an object.
Servers should convert recognized schemas to the latest internal value, and
may reject unrecognized values.
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
containerImageDigests []object
ContainerImageDigests contains an optional list of accepted image digests
for each container in the MatchingCriteria.
A workload's image will match the allowlist's image if either they
match directly, or the workload's image (1) specifies a hash, and
(2) that hash is present in the container's ImageDigests.
containerName
string required
The name of the container which accepts the image digests.
imageDigests
[]string required
The image SHA256 image digests that will be accepted.
exemptions
[]string required
GKE Warden constraints that this workload allowlist exempts.
kind
string
Kind is a string value representing the REST resource this object represents.
Servers may infer this from the endpoint the client submits requests to.
Cannot be updated.
In CamelCase.
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
matchingCriteria object required
MatchingCriteria is a subset of podSpec containing criteria that a workload's
pod spec needs to match in order to be admitted into the cluster
containers []object required
args
[]string
Arguments to the entrypoint.
Must contain all of the arguments in the workload's container
The arguments in a workload's container may be a subset of the arguments in an allowlist.
Supports using regex patterns for arguments that may have multiple possible values & permutations
In order for an arg to be treated as a regex pattern it must be anchored with a caret (^)
at the beginning of the string and a dollar sign ($) at the end of the string.
command
[]string
Entrypoint array. Not executed within a shell.
Must be an exact match to the command's in the workload's container
env []object
List of environment variables to set in the container.
Each env name can be a plain string or regex (for matching with multiple envs that follow a similar pattern)
Each individual env in the workload’s container must have name equal to an env in the allowlist’s container (or regex match).
All other sub-fields of env are ignored.
The envs in a workload container may be a subset of the envs in an allowlist container.
name
string required
Name of the environment variable. Must be a C_IDENTIFIER.
Supports using regex to match with multiple envs that follow a similar pattern
Env name present in the workload must be an exact match or follow regex pattern of the allowlist's env name
In order for an ENV name to be treated as a regex pattern it must be anchored with a caret (^)
at the beginning of the string and a dollar sign ($) at the end of the string.
envFrom []object
List of sources to populate environment variables in the container.
Each individual envFrom in the allowlist's container must have the configMapRef.Name or secretMapRef.Name values equal to the envFrom values in the workload’s container.
All other sub-fields of env are ignored.
The envFroms in a workload container may be a subset of the envFroms in an allowlist container.
configMapRef object
The ConfigMap to select from
name
string
The name of the ConfigMap to select from.
Must be exact match to value present in workload
secretRef object
The Secret to select from
name
string
The name of the Secret to select from.
Must be exact match to value present in workload
image
string
Container image name.
More info: https://kubernetes.io/docs/concepts/containers/images
Include only the image path and exclude digest/image tag.
This can either be an exact string match or a matching regex pattern to the workload's container image.
In order for the image path to be treated as a regex pattern it must be anchored with a caret (^)
at the beginning of the string and a dollar sign ($) at the end of the string.
lifecycle object
LifecycleSubset is functionally a subset of core/v1 Lifecycle, preserving only
fields used for allowlisting.
postStart object
Only exec field is required if present in workload container.
All other sub-fields ignored.
exec object
Exec specifies the action to take.
Must match value present in workload container
command
[]string
Must be an exact match to the commands specified in the workload
preStop object
Only exec field is required if present in workload container.
All other sub-fields ignored.
exec object
Exec specifies the action to take.
Must match value present in workload container
command
[]string
Must be an exact match to the commands specified in the workload
livenessProbe object
Periodic probe of container liveness.
Must be an exact match to the LivenessProbe value in the workload's container
exec object
Exec specifies the action to take.
Must match value present in workload container
command
[]string
Must be an exact match to the commands specified in the workload
name
string required
Name of the container specified as a DNS_LABEL.
Each container in a pod must have a unique name (DNS_LABEL).
Cannot be updated.
readinessProbe object
Periodic probe of container service readiness.
Must be an exact match to the readinessProbe value in the workload's container
exec object
Exec specifies the action to take.
Must match value present in workload container
command
[]string
Must be an exact match to the commands specified in the workload
securityContext object
SecurityContext is functionally a subset of core/v1 SecurityContext,
preserving only fields used for allowlisting.
Only Capabilities, Privileged, and appArmorProfile subfields
are used for workload matching
appArmorProfile object
AppArmorProfile defines the minimum level of security for the AppArmorProfile of
allowlisted workloads. Valid configurations are summarized in this table:
| Allowlist | Workload |
| omit | omit, RuntimeDefault |
| Unconfined | omit,Unconfined,RuntimeDefault,LocalHost |
| RuntimeDefault | RuntimeDefault |
| LocalHost | LocalHost (plus exact match of profile name) |
localhostProfile
string
The profile loaded on the node that matching workloads must specify.
Must be set if and only if type is "Localhost".
type
string required
Type indicates which kind of AppArmor profile will be applied.
capabilities object
The capabilities to add/drop when running containers.
add
[]string
Added capabilities
This should contain a list of all of capabilities that a workload may add.
A workload may contain fewer added capabilities than what is present in the allowlist.
drop
[]string
Removed capabilities
Should contain a list of all of capabilities that a workload is required to drop.
A workload may contain additional dropped capabilities than what is present in the allowlist.
privileged
boolean
Run container in privileged mode.
Must be true if workload has this set to true. Otherwise, it can be omitted or explicitly set to false.
startupProbe object
StartupProbe indicates that the Pod has successfully initialized.
Must be an exact match to the startupProbe value in the workload's container
exec object
Exec specifies the action to take.
Must match value present in workload container
command
[]string
Must be an exact match to the commands specified in the workload
volumeDevices []object
volumeDevices is the list of block devices to be used by the container.
The volumeDevices in a workload’s container may be a subset of the volumeMounts in an allowlist’s container.
devicePath
string required
devicePath is the path inside of the container that the device will be mapped to.
Must be exact match to devicePath present in the workload
name
string required
Must be exact match to name present in the worklaod
volumeMounts []object
Pod volumes to mount into the container's filesystem.
The VolumeMounts in a workload’s container may be a subset of the volumeMounts in an allowlist’s container.
mountPath
string required
Path within the container at which the volume should be mounted. Must
not contain ':'.
Must be exact match to value present in the workload
name
string required
This must match the Name of a Volume.
Must be exact match to a volumeMount name in the workload container
readOnly
boolean
Mounted read-only if true, read-write otherwise (false or unspecified).
Defaults to false.
The allowlist must have this field omitted or explicitly set to false if the workload does not have readOnly set to true.
Value is ignored if workload has this set to true
subPath
string
Path within the volume from which the container's volume should be mounted.
Defaults to "" (volume's root).
If present in allowlist, workload must have an exact match.
hostIPC
boolean
Must be true if workload has this set to true. Otherwise, it can be omitted or explicitly set to false.
hostNetwork
boolean
Must be true if workload has this set to true. Otherwise, it can be omitted or explicitly set to false.
hostPID
boolean
Must be true if workload has this set to true. Otherwise, it can be omitted or explicitly set to false.
hostUsers
boolean
Must be true if workload has this set to true. Otherwise, it can be omitted or explicitly set to false.
initContainers []object
args
[]string
Arguments to the entrypoint.
Must contain all of the arguments in the workload's container
The arguments in a workload's container may be a subset of the arguments in an allowlist.
Supports using regex patterns for arguments that may have multiple possible values & permutations
In order for an arg to be treated as a regex pattern it must be anchored with a caret (^)
at the beginning of the string and a dollar sign ($) at the end of the string.
command
[]string
Entrypoint array. Not executed within a shell.
Must be an exact match to the command's in the workload's container
env []object
List of environment variables to set in the container.
Each env name can be a plain string or regex (for matching with multiple envs that follow a similar pattern)
Each individual env in the workload’s container must have name equal to an env in the allowlist’s container (or regex match).
All other sub-fields of env are ignored.
The envs in a workload container may be a subset of the envs in an allowlist container.
name
string required
Name of the environment variable. Must be a C_IDENTIFIER.
Supports using regex to match with multiple envs that follow a similar pattern
Env name present in the workload must be an exact match or follow regex pattern of the allowlist's env name
In order for an ENV name to be treated as a regex pattern it must be anchored with a caret (^)
at the beginning of the string and a dollar sign ($) at the end of the string.
envFrom []object
List of sources to populate environment variables in the container.
Each individual envFrom in the allowlist's container must have the configMapRef.Name or secretMapRef.Name values equal to the envFrom values in the workload’s container.
All other sub-fields of env are ignored.
The envFroms in a workload container may be a subset of the envFroms in an allowlist container.
configMapRef object
The ConfigMap to select from
name
string
The name of the ConfigMap to select from.
Must be exact match to value present in workload
secretRef object
The Secret to select from
name
string
The name of the Secret to select from.
Must be exact match to value present in workload
image
string
Container image name.
More info: https://kubernetes.io/docs/concepts/containers/images
Include only the image path and exclude digest/image tag.
This can either be an exact string match or a matching regex pattern to the workload's container image.
In order for the image path to be treated as a regex pattern it must be anchored with a caret (^)
at the beginning of the string and a dollar sign ($) at the end of the string.
lifecycle object
LifecycleSubset is functionally a subset of core/v1 Lifecycle, preserving only
fields used for allowlisting.
postStart object
Only exec field is required if present in workload container.
All other sub-fields ignored.
exec object
Exec specifies the action to take.
Must match value present in workload container
command
[]string
Must be an exact match to the commands specified in the workload
preStop object
Only exec field is required if present in workload container.
All other sub-fields ignored.
exec object
Exec specifies the action to take.
Must match value present in workload container
command
[]string
Must be an exact match to the commands specified in the workload
livenessProbe object
Periodic probe of container liveness.
Must be an exact match to the LivenessProbe value in the workload's container
exec object
Exec specifies the action to take.
Must match value present in workload container
command
[]string
Must be an exact match to the commands specified in the workload
name
string required
Name of the container specified as a DNS_LABEL.
Each container in a pod must have a unique name (DNS_LABEL).
Cannot be updated.
readinessProbe object
Periodic probe of container service readiness.
Must be an exact match to the readinessProbe value in the workload's container
exec object
Exec specifies the action to take.
Must match value present in workload container
command
[]string
Must be an exact match to the commands specified in the workload
securityContext object
SecurityContext is functionally a subset of core/v1 SecurityContext,
preserving only fields used for allowlisting.
Only Capabilities, Privileged, and appArmorProfile subfields
are used for workload matching
appArmorProfile object
AppArmorProfile defines the minimum level of security for the AppArmorProfile of
allowlisted workloads. Valid configurations are summarized in this table:
| Allowlist | Workload |
| omit | omit, RuntimeDefault |
| Unconfined | omit,Unconfined,RuntimeDefault,LocalHost |
| RuntimeDefault | RuntimeDefault |
| LocalHost | LocalHost (plus exact match of profile name) |
localhostProfile
string
The profile loaded on the node that matching workloads must specify.
Must be set if and only if type is "Localhost".
type
string required
Type indicates which kind of AppArmor profile will be applied.
capabilities object
The capabilities to add/drop when running containers.
add
[]string
Added capabilities
This should contain a list of all of capabilities that a workload may add.
A workload may contain fewer added capabilities than what is present in the allowlist.
drop
[]string
Removed capabilities
Should contain a list of all of capabilities that a workload is required to drop.
A workload may contain additional dropped capabilities than what is present in the allowlist.
privileged
boolean
Run container in privileged mode.
Must be true if workload has this set to true. Otherwise, it can be omitted or explicitly set to false.
startupProbe object
StartupProbe indicates that the Pod has successfully initialized.
Must be an exact match to the startupProbe value in the workload's container
exec object
Exec specifies the action to take.
Must match value present in workload container
command
[]string
Must be an exact match to the commands specified in the workload
volumeDevices []object
volumeDevices is the list of block devices to be used by the container.
The volumeDevices in a workload’s container may be a subset of the volumeMounts in an allowlist’s container.
devicePath
string required
devicePath is the path inside of the container that the device will be mapped to.
Must be exact match to devicePath present in the workload
name
string required
Must be exact match to name present in the worklaod
volumeMounts []object
Pod volumes to mount into the container's filesystem.
The VolumeMounts in a workload’s container may be a subset of the volumeMounts in an allowlist’s container.
mountPath
string required
Path within the container at which the volume should be mounted. Must
not contain ':'.
Must be exact match to value present in the workload
name
string required
This must match the Name of a Volume.
Must be exact match to a volumeMount name in the workload container
readOnly
boolean
Mounted read-only if true, read-write otherwise (false or unspecified).
Defaults to false.
The allowlist must have this field omitted or explicitly set to false if the workload does not have readOnly set to true.
Value is ignored if workload has this set to true
subPath
string
Path within the volume from which the container's volume should be mounted.
Defaults to "" (volume's root).
If present in allowlist, workload must have an exact match.
securityContext object
PodSecurityContext is a subset of core/v1 PodSecurityContext,
preserving only fields used for allowlisting.
appArmorProfile object
AppArmorProfile defines the minimum level of security for the AppArmorProfile of
allowlisted workloads. Valid configurations are summarized in this table:
| Allowlist | Workload |
| omit | omit, RuntimeDefault |
| Unconfined | omit,Unconfined,RuntimeDefault,LocalHost |
| RuntimeDefault | RuntimeDefault |
| LocalHost | LocalHost (plus exact match of profile name) |
localhostProfile
string
The profile loaded on the node that matching workloads must specify.
Must be set if and only if type is "Localhost".
type
string required
Type indicates which kind of AppArmor profile will be applied.
volumes []object
Each individual volume in the workload must match with a volume present in the allowlist
The volumes in a workload may be a subset of the volumes in an allowlist.
configMap object
configMap represents a configMap that should populate this volume.
An allowlist only needs to include this field if wants to specify the use
of a non-default value for the defaultMode subfield.
defaultMode
integer
defaultMode is optional: mode bits used to set permissions on created files by default.
Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511.
YAML accepts both octal and decimal values, JSON requires decimal values for mode bits.
If omitted, any workloads must use the default value (0644) or omit.
If included, a workload configMap must have an exactly matching DefaultMode value.
format:
int32
name
string
gcePersistentDisk object
GCEPersistentDiskVolumeSource is functionally a subset of core/v1
GCEPersistentDiskVolumeSource, preserving only fields used for allowlisting.
fsType
string
fsType is filesystem type of the volume that you want to mount.
Must be exact match to value present in the workload's volume
partition
integer
partition is the partition in the volume that you want to mount.
Must be exact match to value present in the workload's volume
format:
int32
readOnly
boolean
readOnly here will force the ReadOnly setting in VolumeMounts.
Defaults to false.
The allowlist must have this field omitted or explicitly set to false if the workload does not have readOnly set to true.
Value is ignored if workload has this set to true
hostPath object
HostPathVolumeSource is functionally a subset of core/v1
HostPathVolumeSource, preserving only fields used for allowlisting.
path
string required
path of the directory on the host.
Must be exact match to value present in the workload's volume
name
string required
name of the volume.
Must match name of volume present in the workload
nfs object
NFSVolumeSource is functionally a subset of core/v1 NFSVolumeSource,
preserving only fields used for allowlisting.
path
string required
path that is exported by the NFS server.
Must be exact match to value present in the workload's volume
readOnly
boolean
readOnly here will force the NFS export to be mounted with read-only permissions.
Defaults to false.
The allowlist must have this field omitted or explicitly set to false if the workload does not have readOnly set to true.
Value is ignored if workload has this set to true
persistentVolumeClaim object
PersistentVolumeClaimVolumeSource is functionally a subset of
core/v1 PersistentVolumeClaimVolumeSource, preserving only fields
used for allowlisting.
readOnly
boolean
readOnly Will force the ReadOnly setting in VolumeMounts.
Default false.
The allowlist must have this field omitted or explicitly set to false if the workload does not have readOnly set to true.
Value is ignored if workload has this set to true
metadata
object
minGKEVersion
string
Minimum GKE Version that this workload allowlist qualifies for.
Should be set if the workload needing to be allowlisted requires fields
introduced in a particular GKE version
No matches. Try .containerImageDigests[].containerName for an exact path