---
apiVersion: policy/v1beta1
kind: PodSecurityPolicy
metadata:
  annotations:
    kubernetes.io/description: 'tailored PSP for fluentd->fluentd'
    seccomp.security.alpha.kubernetes.io/allowedProfileNames: docker/default
    seccomp.security.alpha.kubernetes.io/defaultProfileName: docker/default
  name: fluentd-fluentd
spec:
#  allowedCapabilities:
#    - NET_BIND_SERVICE                             # useful if a workload needs a low port. but by default it's commented out
  allowedHostPaths:
    - pathPrefix: "/run/fluentd/data"               # EXCEPTION: fluentd needs a host-persistent place to store state
      readOnly: false
    - pathPrefix: "/var/lib/docker/containers"      # EXCEPTION: fluentd needs read access to docker container logs
      readOnly: true
    - pathPrefix: "/var/log"                        # EXCEPTION: fluentd needs read access to host logs
      readOnly: true
  allowPrivilegeEscalation: true	                # EXCEPTION: fluentd needs root to read logs
  allowedProcMountTypes:                            # Disallow full /proc mounts, only allow the "default" masked /proc
    - Default
  fsGroup:                                          # EXCEPTION: fluentd runs as privileged, so requires fsGroup 0
    rule: MustRunAs
    ranges:
      - max: 65535
        min: 0
  hostIPC: false                                    # disallow sharing the host IPC namespace
  hostNetwork: false                                # disallow host networking
  hostPID: false                                    # disallow sharing the host process ID namespace
  hostPorts:                                        # disallow low host ports (this seems to only apply to eth0 on EKS)
    - max: 65535
      min: 1025
  privileged: true                                  # EXCEPTION: fluentd needs root
  readOnlyRootFilesystem: true                      # change default from 'false' to 'true'
  requiredDropCapabilities:                         # Drop all privileges in the Linux kernel
    - AUDIT_CONTROL
    - AUDIT_READ
    - AUDIT_WRITE
    - BLOCK_SUSPEND
    - CHOWN
    - DAC_OVERRIDE
    - DAC_READ_SEARCH
    - FOWNER
    - FSETID
    - IPC_LOCK
    - IPC_OWNER
    - KILL
    - LEASE
    - LINUX_IMMUTABLE
    - MAC_ADMIN
    - MAC_OVERRIDE
    - MKNOD
    - NET_ADMIN
    - NET_BROADCAST
    - NET_RAW
    - SETGID
    - SETFCAP
    - SETPCAP
    - SETUID
    - SYS_ADMIN
    - SYS_BOOT
    - SYS_CHROOT
    - SYS_MODULE
    - SYS_NICE
    - SYS_PACCT
    - SYS_PTRACE
    - SYS_RAWIO
    - SYS_RESOURCE
    - SYS_TIME
    - SYS_TTY_CONFIG
    - SYSLOG
    - WAKE_ALARM
  runAsGroup:                                       # EXCEPTION: fluentd runs as privileged, so requires GID 0
    rule: MustRunAs
    ranges:
      - max: 65535
        min: 0
  runAsUser:
    rule: MustRunAs                                 # EXCEPTION: fluentd runs as privileged, so requires UID 0
    ranges:
    - max: 65535
      min: 0
  seLinux:                                          # Harness for SELinux, if we ever engage with it
    rule: RunAsAny
  supplementalGroups:                               # EXCEPTION: fluentd runs as privileged, so requires GID 0
    rule: MustRunAs
    ranges:
    - max: 65535
      min: 0
  volumes:                                          # allow only these volume types
  - configMap
  - downwardAPI
  - emptyDir
  - hostPath                                        # EXCEPTION: Fluentd needs to mount hostPaths
  - projected
  - secret
#   - persistentVolumeClaim                         # If you use statefulsets, you'll need this one.
