init

pod-sec/0-ns.yaml

@@ -0,0 +1,8 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: restricted
+  labels:
+    pod-security.kubernetes.io/enforce: baseline
+    pod-security.kubernetes.io/audit: privileged
+    pod-security.kubernetes.io/warn: restricted

pod-sec/1-pod.yaml

@@ -0,0 +1,42 @@
+apiVersion: v1
+kind: Pod
+metadata:
+  name: safe
+  namespace: restricted
+spec:
+  volumes:
+  - name: data
+    emptyDir: {}
+  initContainers:
+  - name: init
+    image: alpine:3
+    volumeMounts:
+    - name: data
+      mountPath: /data
+    args:
+    - /bin/sh
+    - -c
+    - mkdir /data/nginx; chown -R 1000 /data
+  containers:
+  - name: app
+    image: nginx
+    resources: {}
+    ports:
+      - containerPort: 80
+    volumeMounts:
+    - name: data
+      mountPath: /var/cache
+    - name: data
+      mountPath: /run
+    securityContext:
+      runAsNonRoot: true
+      runAsUser: 1000
+      allowPrivilegeEscalation: false
+      seccompProfile:
+        type: RuntimeDefault
+      capabilities:
+        drop:
+        - ALL
+        add:
+        - BIND_SERVICE
+      

pod-sec/101-pod.yaml

@@ -0,0 +1,13 @@
+apiVersion: v1
+kind: Pod
+metadata:
+  name: demo
+  namespace: restricted
+spec:
+  containers:
+  - name: demo
+    image: ghcr.io/trion-development/echoserver:1
+    resources: {}
+    ports:
+      - containerPort: 3000
+

pod-sec/commands

@@ -0,0 +1,2 @@
+kubectl run --dry-run=client -o yaml --image ghcr.io/trion-development/echoserver:1 echo
+