{{- if .Values.podSecurityPolicy.enabled }} apiVersion: {{ template "podSecurityPolicy.apiVersion" . }} kind: PodSecurityPolicy metadata: name: {{ template "nfs-subdir-external-provisioner.fullname" . }} labels: {{- include "nfs-subdir-external-provisioner.labels" . | nindent 4 }} spec: privileged: false allowPrivilegeEscalation: false requiredDropCapabilities: - ALL volumes: - 'secret' - 'nfs' - 'persistentVolumeClaim' hostNetwork: false hostIPC: false hostPID: false runAsUser: rule: 'RunAsAny' seLinux: rule: 'RunAsAny' supplementalGroups: rule: 'RunAsAny' fsGroup: rule: 'RunAsAny' readOnlyRootFilesystem: false {{- end }}