{{- $pspAvailable := (semverCompare "<1.25-0" (include "common.capabilities.kubeVersion" .)) -}} {{- if and $pspAvailable .Values.curator.enabled .Values.curator.psp.create }} apiVersion: policy/v1beta1 kind: PodSecurityPolicy metadata: name: {{ include "elasticsearch.curator.fullname" . }} labels: {{- include "common.labels.standard" . | nindent 4 }} role: curator spec: privileged: true #requiredDropCapabilities: volumes: - 'configMap' - 'secret' hostNetwork: false hostIPC: false hostPID: false runAsUser: # Require the container to run without root privileges. rule: 'MustRunAsNonRoot' seLinux: rule: 'RunAsAny' supplementalGroups: rule: 'MustRunAs' ranges: - min: 1 max: 65535 fsGroup: rule: 'MustRunAs' ranges: - min: 1 max: 65535 readOnlyRootFilesystem: false {{- end }}