doc: Showcasing a PSS restricred compliant pod

Signed-off-by: Fredrik Klingenberg <[email protected]>
fredrkl · May 8, 2023 · e335e3f · e335e3f
1 parent 4f1b37a
commit e335e3f
Showing 1 changed file with 26 additions and 0 deletions.
diff --git a/demo-pods/valid-tech-lead-label-restricted.yaml b/demo-pods/valid-tech-lead-label-restricted.yaml
@@ -0,0 +1,26 @@
+apiVersion: v1
+kind: Pod
+metadata:
+  namespace: demo-pods
+  labels:
+    run: failing-demo
+    tech-lead: "John"
+  name: valid-tech-lead-demo
+spec:
+  securityContext:
+    runAsUser: 3000
+    runAsGroup: 3000
+    runAsNonRoot: true
+    seccompProfile:
+      type: RuntimeDefault
+  containers:
+  - image: busybox
+    name: failing-demo
+    securityContext:
+      allowPrivilegeEscalation: false
+      capabilities:
+        drop:
+        - ALL
+    command:
+      - sleep
+      - "3600"