{ "description": "WorkloadAllowlist describes a workload pattern that should be exempt from\ncertain Autopilot policies \u0026 constraints.", "properties": { "apiVersion": { "description": "APIVersion defines the versioned schema of this representation of an object.\nServers should convert recognized schemas to the latest internal value, and\nmay reject unrecognized values.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources", "type": [ "string", "null" ] }, "containerImageDigests": { "description": "ContainerImageDigests contains an optional list of accepted image digests\nfor each container in the MatchingCriteria.\nA workload's image will match the allowlist's image if either they\nmatch directly, or the workload's image (1) specifies a hash, and\n(2) that hash is present in the container's ImageDigests.", "items": { "additionalProperties": false, "properties": { "containerName": { "description": "The name of the container which accepts the image digests.", "type": "string" }, "imageDigests": { "description": "The image SHA256 image digests that will be accepted.", "items": { "type": "string" }, "type": "array" } }, "required": [ "containerName", "imageDigests" ], "type": "object" }, "type": [ "array", "null" ] }, "exemptions": { "description": "GKE Warden constraints that this workload allowlist exempts.", "items": { "type": "string" }, "type": "array" }, "kind": { "description": "Kind is a string value representing the REST resource this object represents.\nServers may infer this from the endpoint the client submits requests to.\nCannot be updated.\nIn CamelCase.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds", "type": [ "string", "null" ] }, "matchingCriteria": { "additionalProperties": false, "description": "MatchingCriteria is a subset of podSpec containing criteria that a workload's\npod spec needs to match in order to be admitted into the cluster", "properties": { "containers": { "items": { "additionalProperties": false, "description": "Container is a subset of the properties used to define a running container.\nEach individiual container in the workload must meet container match criteria.\nThe containers/initContainers in a workload may be a subset of the containers/initContainers in an allowlist.", "properties": { "args": { "description": "Arguments to the entrypoint.\nMust contain all of the arguments in the workload's container\nThe arguments in a workload's container may be a subset of the arguments in an allowlist.\nSupports using regex patterns for arguments that may have multiple possible values \u0026 permutations\n\n\nIn order for an arg to be treated as a regex pattern it must be anchored with a caret (^)\nat the beginning of the string and a dollar sign ($) at the end of the string.", "items": { "type": "string" }, "type": [ "array", "null" ] }, "command": { "description": "Entrypoint array. Not executed within a shell.\nMust be an exact match to the command's in the workload's container", "items": { "type": "string" }, "type": [ "array", "null" ] }, "env": { "description": "List of environment variables to set in the container.\nEach env name can be a plain string or regex (for matching with multiple envs that follow a similar pattern)\nEach individual env in the workload’s container must have name equal to an env in the allowlist’s container (or regex match).\nAll other sub-fields of env are ignored.\nThe envs in a workload container may be a subset of the envs in an allowlist container.", "items": { "additionalProperties": false, "description": "EnvVar represents an environment variable present in a Container.", "properties": { "name": { "description": "Name of the environment variable. Must be a C_IDENTIFIER.\nSupports using regex to match with multiple envs that follow a similar pattern\nEnv name present in the workload must be an exact match or follow regex pattern of the allowlist's env name\n\n\nIn order for an ENV name to be treated as a regex pattern it must be anchored with a caret (^)\nat the beginning of the string and a dollar sign ($) at the end of the string.", "type": "string" } }, "required": [ "name" ], "type": "object" }, "type": [ "array", "null" ] }, "envFrom": { "description": "List of sources to populate environment variables in the container.\nEach individual envFrom in the allowlist's container must have the configMapRef.Name or secretMapRef.Name values equal to the envFrom values in the workload’s container.\nAll other sub-fields of env are ignored.\nThe envFroms in a workload container may be a subset of the envFroms in an allowlist container.", "items": { "additionalProperties": false, "description": "EnvFromSource is a subset of core/v1 EnvFromSource\npreserving fields used for allowlisting.", "properties": { "configMapRef": { "additionalProperties": false, "description": "The ConfigMap to select from", "properties": { "name": { "description": "The name of the ConfigMap to select from.\nMust be exact match to value present in workload", "type": [ "string", "null" ] } }, "type": [ "object", "null" ] }, "secretRef": { "additionalProperties": false, "description": "The Secret to select from", "properties": { "name": { "description": "The name of the Secret to select from.\nMust be exact match to value present in workload", "type": [ "string", "null" ] } }, "type": [ "object", "null" ] } }, "type": "object" }, "type": [ "array", "null" ] }, "image": { "description": "Container image name.\nMore info: https://kubernetes.io/docs/concepts/containers/images\nInclude only the image path and exclude digest/image tag.\nThis can either be an exact string match or a matching regex pattern to the workload's container image.\n\n\nIn order for the image path to be treated as a regex pattern it must be anchored with a caret (^)\nat the beginning of the string and a dollar sign ($) at the end of the string.", "type": [ "string", "null" ] }, "lifecycle": { "additionalProperties": false, "description": "LifecycleSubset is functionally a subset of core/v1 Lifecycle, preserving only\nfields used for allowlisting.", "properties": { "postStart": { "additionalProperties": false, "description": "Only exec field is required if present in workload container.\nAll other sub-fields ignored.", "properties": { "exec": { "additionalProperties": false, "description": "Exec specifies the action to take.\nMust match value present in workload container", "properties": { "command": { "description": "Must be an exact match to the commands specified in the workload", "items": { "type": "string" }, "type": [ "array", "null" ] } }, "type": [ "object", "null" ] } }, "type": [ "object", "null" ] }, "preStop": { "additionalProperties": false, "description": "Only exec field is required if present in workload container.\nAll other sub-fields ignored.", "properties": { "exec": { "additionalProperties": false, "description": "Exec specifies the action to take.\nMust match value present in workload container", "properties": { "command": { "description": "Must be an exact match to the commands specified in the workload", "items": { "type": "string" }, "type": [ "array", "null" ] } }, "type": [ "object", "null" ] } }, "type": [ "object", "null" ] } }, "type": [ "object", "null" ] }, "livenessProbe": { "additionalProperties": false, "description": "Periodic probe of container liveness.\nMust be an exact match to the LivenessProbe value in the workload's container", "properties": { "exec": { "additionalProperties": false, "description": "Exec specifies the action to take.\nMust match value present in workload container", "properties": { "command": { "description": "Must be an exact match to the commands specified in the workload", "items": { "type": "string" }, "type": [ "array", "null" ] } }, "type": [ "object", "null" ] } }, "type": [ "object", "null" ] }, "name": { "description": "Name of the container specified as a DNS_LABEL.\nEach container in a pod must have a unique name (DNS_LABEL).\nCannot be updated.", "type": "string" }, "readinessProbe": { "additionalProperties": false, "description": "Periodic probe of container service readiness.\nMust be an exact match to the readinessProbe value in the workload's container", "properties": { "exec": { "additionalProperties": false, "description": "Exec specifies the action to take.\nMust match value present in workload container", "properties": { "command": { "description": "Must be an exact match to the commands specified in the workload", "items": { "type": "string" }, "type": [ "array", "null" ] } }, "type": [ "object", "null" ] } }, "type": [ "object", "null" ] }, "securityContext": { "additionalProperties": false, "description": "SecurityContext is functionally a subset of core/v1 SecurityContext,\npreserving only fields used for allowlisting.\nOnly Capabilities, Privileged, and appArmorProfile subfields\nare used for workload matching", "properties": { "appArmorProfile": { "additionalProperties": false, "description": "AppArmorProfile defines the minimum level of security for the AppArmorProfile of\nallowlisted workloads. Valid configurations are summarized in this table:\n| Allowlist | Workload |\n| omit | omit, RuntimeDefault |\n| Unconfined | omit,Unconfined,RuntimeDefault,LocalHost |\n| RuntimeDefault | RuntimeDefault |\n| LocalHost | LocalHost (plus exact match of profile name) |", "properties": { "localhostProfile": { "description": "The profile loaded on the node that matching workloads must specify.\nMust be set if and only if type is \"Localhost\".", "type": [ "string", "null" ] }, "type": { "description": "Type indicates which kind of AppArmor profile will be applied.", "type": "string" } }, "required": [ "type" ], "type": [ "object", "null" ] }, "capabilities": { "additionalProperties": false, "description": "The capabilities to add/drop when running containers.", "properties": { "add": { "description": "Added capabilities\nThis should contain a list of all of capabilities that a workload may add.\nA workload may contain fewer added capabilities than what is present in the allowlist.", "items": { "description": "Capability represent POSIX capabilities type", "type": "string" }, "type": [ "array", "null" ] }, "drop": { "description": "Removed capabilities\nShould contain a list of all of capabilities that a workload is required to drop.\nA workload may contain additional dropped capabilities than what is present in the allowlist.", "items": { "description": "Capability represent POSIX capabilities type", "type": "string" }, "type": [ "array", "null" ] } }, "type": [ "object", "null" ] }, "privileged": { "description": "Run container in privileged mode.\nMust be true if workload has this set to true. Otherwise, it can be omitted or explicitly set to false.", "type": [ "boolean", "null" ] } }, "type": [ "object", "null" ] }, "startupProbe": { "additionalProperties": false, "description": "StartupProbe indicates that the Pod has successfully initialized.\nMust be an exact match to the startupProbe value in the workload's container", "properties": { "exec": { "additionalProperties": false, "description": "Exec specifies the action to take.\nMust match value present in workload container", "properties": { "command": { "description": "Must be an exact match to the commands specified in the workload", "items": { "type": "string" }, "type": [ "array", "null" ] } }, "type": [ "object", "null" ] } }, "type": [ "object", "null" ] }, "volumeDevices": { "description": "volumeDevices is the list of block devices to be used by the container.\nThe volumeDevices in a workload’s container may be a subset of the volumeMounts in an allowlist’s container.", "items": { "additionalProperties": false, "description": "VolumeDevice describes a mapping of a raw block device within a container.\nMust be an exact match to value present in the workload", "properties": { "devicePath": { "description": "devicePath is the path inside of the container that the device will be mapped to.\nMust be exact match to devicePath present in the workload", "type": "string" }, "name": { "description": "Must be exact match to name present in the worklaod", "type": "string" } }, "required": [ "devicePath", "name" ], "type": "object" }, "type": [ "array", "null" ] }, "volumeMounts": { "description": "Pod volumes to mount into the container's filesystem.\nThe VolumeMounts in a workload’s container may be a subset of the volumeMounts in an allowlist’s container.", "items": { "additionalProperties": false, "description": "VolumeMount is functionally a subset of core/v1 VolumeMount,\npreserving only fields used for allowlisting.\nOnly name, readOnly, and mountPath subfields required for workload matching.\nAll other sub-fields are ignored.", "properties": { "mountPath": { "description": "Path within the container at which the volume should be mounted. Must\nnot contain ':'.\nMust be exact match to value present in the workload", "type": "string" }, "name": { "description": "This must match the Name of a Volume.\nMust be exact match to a volumeMount name in the workload container", "type": "string" }, "readOnly": { "description": "Mounted read-only if true, read-write otherwise (false or unspecified).\nDefaults to false.\nThe allowlist must have this field omitted or explicitly set to false if the workload does not have readOnly set to true.\nValue is ignored if workload has this set to true", "type": [ "boolean", "null" ] }, "subPath": { "description": "Path within the volume from which the container's volume should be mounted.\nDefaults to \"\" (volume's root).\nIf present in allowlist, workload must have an exact match.", "type": [ "string", "null" ] } }, "required": [ "mountPath", "name" ], "type": "object" }, "type": [ "array", "null" ] } }, "required": [ "name" ], "type": "object" }, "type": "array" }, "hostIPC": { "description": "Must be true if workload has this set to true. Otherwise, it can be omitted or explicitly set to false.", "type": [ "boolean", "null" ] }, "hostNetwork": { "description": "Must be true if workload has this set to true. Otherwise, it can be omitted or explicitly set to false.", "type": [ "boolean", "null" ] }, "hostPID": { "description": "Must be true if workload has this set to true. Otherwise, it can be omitted or explicitly set to false.", "type": [ "boolean", "null" ] }, "hostUsers": { "description": "Must be true if workload has this set to true. Otherwise, it can be omitted or explicitly set to false.", "type": [ "boolean", "null" ] }, "initContainers": { "items": { "additionalProperties": false, "description": "Container is a subset of the properties used to define a running container.\nEach individiual container in the workload must meet container match criteria.\nThe containers/initContainers in a workload may be a subset of the containers/initContainers in an allowlist.", "properties": { "args": { "description": "Arguments to the entrypoint.\nMust contain all of the arguments in the workload's container\nThe arguments in a workload's container may be a subset of the arguments in an allowlist.\nSupports using regex patterns for arguments that may have multiple possible values \u0026 permutations\n\n\nIn order for an arg to be treated as a regex pattern it must be anchored with a caret (^)\nat the beginning of the string and a dollar sign ($) at the end of the string.", "items": { "type": "string" }, "type": [ "array", "null" ] }, "command": { "description": "Entrypoint array. Not executed within a shell.\nMust be an exact match to the command's in the workload's container", "items": { "type": "string" }, "type": [ "array", "null" ] }, "env": { "description": "List of environment variables to set in the container.\nEach env name can be a plain string or regex (for matching with multiple envs that follow a similar pattern)\nEach individual env in the workload’s container must have name equal to an env in the allowlist’s container (or regex match).\nAll other sub-fields of env are ignored.\nThe envs in a workload container may be a subset of the envs in an allowlist container.", "items": { "additionalProperties": false, "description": "EnvVar represents an environment variable present in a Container.", "properties": { "name": { "description": "Name of the environment variable. Must be a C_IDENTIFIER.\nSupports using regex to match with multiple envs that follow a similar pattern\nEnv name present in the workload must be an exact match or follow regex pattern of the allowlist's env name\n\n\nIn order for an ENV name to be treated as a regex pattern it must be anchored with a caret (^)\nat the beginning of the string and a dollar sign ($) at the end of the string.", "type": "string" } }, "required": [ "name" ], "type": "object" }, "type": [ "array", "null" ] }, "envFrom": { "description": "List of sources to populate environment variables in the container.\nEach individual envFrom in the allowlist's container must have the configMapRef.Name or secretMapRef.Name values equal to the envFrom values in the workload’s container.\nAll other sub-fields of env are ignored.\nThe envFroms in a workload container may be a subset of the envFroms in an allowlist container.", "items": { "additionalProperties": false, "description": "EnvFromSource is a subset of core/v1 EnvFromSource\npreserving fields used for allowlisting.", "properties": { "configMapRef": { "additionalProperties": false, "description": "The ConfigMap to select from", "properties": { "name": { "description": "The name of the ConfigMap to select from.\nMust be exact match to value present in workload", "type": [ "string", "null" ] } }, "type": [ "object", "null" ] }, "secretRef": { "additionalProperties": false, "description": "The Secret to select from", "properties": { "name": { "description": "The name of the Secret to select from.\nMust be exact match to value present in workload", "type": [ "string", "null" ] } }, "type": [ "object", "null" ] } }, "type": "object" }, "type": [ "array", "null" ] }, "image": { "description": "Container image name.\nMore info: https://kubernetes.io/docs/concepts/containers/images\nInclude only the image path and exclude digest/image tag.\nThis can either be an exact string match or a matching regex pattern to the workload's container image.\n\n\nIn order for the image path to be treated as a regex pattern it must be anchored with a caret (^)\nat the beginning of the string and a dollar sign ($) at the end of the string.", "type": [ "string", "null" ] }, "lifecycle": { "additionalProperties": false, "description": "LifecycleSubset is functionally a subset of core/v1 Lifecycle, preserving only\nfields used for allowlisting.", "properties": { "postStart": { "additionalProperties": false, "description": "Only exec field is required if present in workload container.\nAll other sub-fields ignored.", "properties": { "exec": { "additionalProperties": false, "description": "Exec specifies the action to take.\nMust match value present in workload container", "properties": { "command": { "description": "Must be an exact match to the commands specified in the workload", "items": { "type": "string" }, "type": [ "array", "null" ] } }, "type": [ "object", "null" ] } }, "type": [ "object", "null" ] }, "preStop": { "additionalProperties": false, "description": "Only exec field is required if present in workload container.\nAll other sub-fields ignored.", "properties": { "exec": { "additionalProperties": false, "description": "Exec specifies the action to take.\nMust match value present in workload container", "properties": { "command": { "description": "Must be an exact match to the commands specified in the workload", "items": { "type": "string" }, "type": [ "array", "null" ] } }, "type": [ "object", "null" ] } }, "type": [ "object", "null" ] } }, "type": [ "object", "null" ] }, "livenessProbe": { "additionalProperties": false, "description": "Periodic probe of container liveness.\nMust be an exact match to the LivenessProbe value in the workload's container", "properties": { "exec": { "additionalProperties": false, "description": "Exec specifies the action to take.\nMust match value present in workload container", "properties": { "command": { "description": "Must be an exact match to the commands specified in the workload", "items": { "type": "string" }, "type": [ "array", "null" ] } }, "type": [ "object", "null" ] } }, "type": [ "object", "null" ] }, "name": { "description": "Name of the container specified as a DNS_LABEL.\nEach container in a pod must have a unique name (DNS_LABEL).\nCannot be updated.", "type": "string" }, "readinessProbe": { "additionalProperties": false, "description": "Periodic probe of container service readiness.\nMust be an exact match to the readinessProbe value in the workload's container", "properties": { "exec": { "additionalProperties": false, "description": "Exec specifies the action to take.\nMust match value present in workload container", "properties": { "command": { "description": "Must be an exact match to the commands specified in the workload", "items": { "type": "string" }, "type": [ "array", "null" ] } }, "type": [ "object", "null" ] } }, "type": [ "object", "null" ] }, "securityContext": { "additionalProperties": false, "description": "SecurityContext is functionally a subset of core/v1 SecurityContext,\npreserving only fields used for allowlisting.\nOnly Capabilities, Privileged, and appArmorProfile subfields\nare used for workload matching", "properties": { "appArmorProfile": { "additionalProperties": false, "description": "AppArmorProfile defines the minimum level of security for the AppArmorProfile of\nallowlisted workloads. Valid configurations are summarized in this table:\n| Allowlist | Workload |\n| omit | omit, RuntimeDefault |\n| Unconfined | omit,Unconfined,RuntimeDefault,LocalHost |\n| RuntimeDefault | RuntimeDefault |\n| LocalHost | LocalHost (plus exact match of profile name) |", "properties": { "localhostProfile": { "description": "The profile loaded on the node that matching workloads must specify.\nMust be set if and only if type is \"Localhost\".", "type": [ "string", "null" ] }, "type": { "description": "Type indicates which kind of AppArmor profile will be applied.", "type": "string" } }, "required": [ "type" ], "type": [ "object", "null" ] }, "capabilities": { "additionalProperties": false, "description": "The capabilities to add/drop when running containers.", "properties": { "add": { "description": "Added capabilities\nThis should contain a list of all of capabilities that a workload may add.\nA workload may contain fewer added capabilities than what is present in the allowlist.", "items": { "description": "Capability represent POSIX capabilities type", "type": "string" }, "type": [ "array", "null" ] }, "drop": { "description": "Removed capabilities\nShould contain a list of all of capabilities that a workload is required to drop.\nA workload may contain additional dropped capabilities than what is present in the allowlist.", "items": { "description": "Capability represent POSIX capabilities type", "type": "string" }, "type": [ "array", "null" ] } }, "type": [ "object", "null" ] }, "privileged": { "description": "Run container in privileged mode.\nMust be true if workload has this set to true. Otherwise, it can be omitted or explicitly set to false.", "type": [ "boolean", "null" ] } }, "type": [ "object", "null" ] }, "startupProbe": { "additionalProperties": false, "description": "StartupProbe indicates that the Pod has successfully initialized.\nMust be an exact match to the startupProbe value in the workload's container", "properties": { "exec": { "additionalProperties": false, "description": "Exec specifies the action to take.\nMust match value present in workload container", "properties": { "command": { "description": "Must be an exact match to the commands specified in the workload", "items": { "type": "string" }, "type": [ "array", "null" ] } }, "type": [ "object", "null" ] } }, "type": [ "object", "null" ] }, "volumeDevices": { "description": "volumeDevices is the list of block devices to be used by the container.\nThe volumeDevices in a workload’s container may be a subset of the volumeMounts in an allowlist’s container.", "items": { "additionalProperties": false, "description": "VolumeDevice describes a mapping of a raw block device within a container.\nMust be an exact match to value present in the workload", "properties": { "devicePath": { "description": "devicePath is the path inside of the container that the device will be mapped to.\nMust be exact match to devicePath present in the workload", "type": "string" }, "name": { "description": "Must be exact match to name present in the worklaod", "type": "string" } }, "required": [ "devicePath", "name" ], "type": "object" }, "type": [ "array", "null" ] }, "volumeMounts": { "description": "Pod volumes to mount into the container's filesystem.\nThe VolumeMounts in a workload’s container may be a subset of the volumeMounts in an allowlist’s container.", "items": { "additionalProperties": false, "description": "VolumeMount is functionally a subset of core/v1 VolumeMount,\npreserving only fields used for allowlisting.\nOnly name, readOnly, and mountPath subfields required for workload matching.\nAll other sub-fields are ignored.", "properties": { "mountPath": { "description": "Path within the container at which the volume should be mounted. Must\nnot contain ':'.\nMust be exact match to value present in the workload", "type": "string" }, "name": { "description": "This must match the Name of a Volume.\nMust be exact match to a volumeMount name in the workload container", "type": "string" }, "readOnly": { "description": "Mounted read-only if true, read-write otherwise (false or unspecified).\nDefaults to false.\nThe allowlist must have this field omitted or explicitly set to false if the workload does not have readOnly set to true.\nValue is ignored if workload has this set to true", "type": [ "boolean", "null" ] }, "subPath": { "description": "Path within the volume from which the container's volume should be mounted.\nDefaults to \"\" (volume's root).\nIf present in allowlist, workload must have an exact match.", "type": [ "string", "null" ] } }, "required": [ "mountPath", "name" ], "type": "object" }, "type": [ "array", "null" ] } }, "required": [ "name" ], "type": "object" }, "type": [ "array", "null" ] }, "securityContext": { "additionalProperties": false, "description": "PodSecurityContext is a subset of core/v1 PodSecurityContext,\npreserving only fields used for allowlisting.", "properties": { "appArmorProfile": { "additionalProperties": false, "description": "AppArmorProfile defines the minimum level of security for the AppArmorProfile of\nallowlisted workloads. Valid configurations are summarized in this table:\n| Allowlist | Workload |\n| omit | omit, RuntimeDefault |\n| Unconfined | omit,Unconfined,RuntimeDefault,LocalHost |\n| RuntimeDefault | RuntimeDefault |\n| LocalHost | LocalHost (plus exact match of profile name) |", "properties": { "localhostProfile": { "description": "The profile loaded on the node that matching workloads must specify.\nMust be set if and only if type is \"Localhost\".", "type": [ "string", "null" ] }, "type": { "description": "Type indicates which kind of AppArmor profile will be applied.", "type": "string" } }, "required": [ "type" ], "type": [ "object", "null" ] } }, "type": [ "object", "null" ] }, "volumes": { "description": "Each individual volume in the workload must match with a volume present in the allowlist\nThe volumes in a workload may be a subset of the volumes in an allowlist.", "items": { "additionalProperties": false, "description": "Volume is functionally a subset of core/v1 Volume,\npreserving only fields used for allowlisting.", "properties": { "configMap": { "additionalProperties": false, "description": "configMap represents a configMap that should populate this volume.\nAn allowlist only needs to include this field if wants to specify the use\nof a non-default value for the defaultMode subfield.", "properties": { "defaultMode": { "description": "defaultMode is optional: mode bits used to set permissions on created files by default.\nMust be an octal value between 0000 and 0777 or a decimal value between 0 and 511.\nYAML accepts both octal and decimal values, JSON requires decimal values for mode bits.\nIf omitted, any workloads must use the default value (0644) or omit.\nIf included, a workload configMap must have an exactly matching DefaultMode value.", "format": "int32", "type": [ "integer", "null" ] }, "name": { "type": [ "string", "null" ] } }, "type": [ "object", "null" ] }, "gcePersistentDisk": { "additionalProperties": false, "description": "GCEPersistentDiskVolumeSource is functionally a subset of core/v1\nGCEPersistentDiskVolumeSource, preserving only fields used for allowlisting.", "properties": { "fsType": { "description": "fsType is filesystem type of the volume that you want to mount.\nMust be exact match to value present in the workload's volume", "type": [ "string", "null" ] }, "partition": { "description": "partition is the partition in the volume that you want to mount.\nMust be exact match to value present in the workload's volume", "format": "int32", "type": [ "integer", "null" ] }, "readOnly": { "description": "readOnly here will force the ReadOnly setting in VolumeMounts.\nDefaults to false.\nThe allowlist must have this field omitted or explicitly set to false if the workload does not have readOnly set to true.\nValue is ignored if workload has this set to true", "type": [ "boolean", "null" ] } }, "type": [ "object", "null" ] }, "hostPath": { "additionalProperties": false, "description": "HostPathVolumeSource is functionally a subset of core/v1\nHostPathVolumeSource, preserving only fields used for allowlisting.", "properties": { "path": { "description": "path of the directory on the host.\nMust be exact match to value present in the workload's volume", "type": "string" } }, "required": [ "path" ], "type": [ "object", "null" ] }, "name": { "description": "name of the volume.\nMust match name of volume present in the workload", "type": "string" }, "nfs": { "additionalProperties": false, "description": "NFSVolumeSource is functionally a subset of core/v1 NFSVolumeSource,\npreserving only fields used for allowlisting.", "properties": { "path": { "description": "path that is exported by the NFS server.\nMust be exact match to value present in the workload's volume", "type": "string" }, "readOnly": { "description": "readOnly here will force the NFS export to be mounted with read-only permissions.\nDefaults to false.\nThe allowlist must have this field omitted or explicitly set to false if the workload does not have readOnly set to true.\nValue is ignored if workload has this set to true", "type": [ "boolean", "null" ] } }, "required": [ "path" ], "type": [ "object", "null" ] }, "persistentVolumeClaim": { "additionalProperties": false, "description": "PersistentVolumeClaimVolumeSource is functionally a subset of\ncore/v1 PersistentVolumeClaimVolumeSource, preserving only fields\nused for allowlisting.", "properties": { "readOnly": { "description": "readOnly Will force the ReadOnly setting in VolumeMounts.\nDefault false.\nThe allowlist must have this field omitted or explicitly set to false if the workload does not have readOnly set to true.\nValue is ignored if workload has this set to true", "type": [ "boolean", "null" ] } }, "type": [ "object", "null" ] } }, "required": [ "name" ], "type": "object" }, "type": [ "array", "null" ] } }, "required": [ "containers" ], "type": "object" }, "metadata": { "type": [ "object", "null" ] }, "minGKEVersion": { "description": "Minimum GKE Version that this workload allowlist qualifies for.\nShould be set if the workload needing to be allowlisted requires fields\nintroduced in a particular GKE version", "type": [ "string", "null" ] } }, "required": [ "exemptions", "matchingCriteria" ], "type": "object" }