Skip to content
API Enriched

Replace Configuration Specification.

PUT
/api/config/namespaces/{metadata.namespace}/k8s_pod_security_policys/{metadata.name}
curl --request PUT \
  --url https://example-corp.console.ves.volterra.io/api/v1/api/production/us-east-1/namespaces/default/api/config/namespaces/example/k8s_pod_security_policys/example \
  --header 'Authorization: <Authorization>' \
  --header 'Content-Type: application/json' \
  --data '{ "metadata": { "annotations": {}, "description": "example", "disable": true, "labels": {}, "name": "example", "namespace": "example" }, "spec": { "psp_spec": { "allow_privilege_escalation": true, "allowed_capabilities": { "capabilities": [ "example" ] }, "allowed_csi_drivers": [ "example" ], "allowed_flex_volumes": [ "example" ], "allowed_host_paths": [ { "path_prefix": "example", "read_only": true } ], "allowed_proc_mounts": [ "example" ], "allowed_unsafe_sysctls": [ "example" ], "default_allow_privilege_escalation": true, "default_capabilities": { "capabilities": [ "example" ] }, "drop_capabilities": { "capabilities": [ "example" ] }, "forbidden_sysctls": [ "example" ], "fs_group_strategy_options": { "id_ranges": [ { "max_id": 1, "min_id": 1 } ], "rule": "example" }, "host_ipc": true, "host_network": true, "host_pid": true, "host_port_ranges": "example", "no_allowed_capabilities": {}, "no_default_capabilities": {}, "no_drop_capabilities": {}, "no_fs_groups": {}, "no_run_as_group": {}, "no_run_as_user": {}, "no_runtime_class": {}, "no_se_linux_options": {}, "no_supplemental_groups": {}, "privileged": true, "read_only_root_filesystem": true, "run_as_group": { "id_ranges": [ { "max_id": 1, "min_id": 1 } ], "rule": "example" }, "run_as_user": { "id_ranges": [ { "max_id": 1, "min_id": 1 } ], "rule": "example" }, "supplemental_groups": { "id_ranges": [ { "max_id": 1, "min_id": 1 } ], "rule": "example" }, "volumes": [ "example" ] }, "yaml": "example" } }'

Replacing an k8s_pod_security_policy object will update the object by replacing the existing spec with the provided one. For read-then-write operations a resourceVersion mismatch will occur if the object was modified between the read and write.

Examples of this operation.

Authorizations

Section titled “Authorizations”

Parameters

Section titled “Parameters”

Path Parameters

Section titled “Path Parameters”
metadata.namespace
required
string

Namespace This defines the workspace within which each the configuration object is to be created. Must be a DNS_LABEL format. For a namespace object itself, namespace value will be ""

metadata.name
required
string

Name The configuration object to be replaced will be looked up by name.

Request Bodyrequired

Section titled “Request Bodyrequired”
Media typeapplication/json
ReplaceRequest is used to replace contents of a k8s_pod_security_policy

This is the input message of the ‘Replace’ RPC.

object
metadata
object
annotations
annotations

Annotations is an unstructured key value map stored with a resource that may be set by external tools to store and retrieve arbitrary metadata. They are not queryable and should be preserved when modifying objects.

object
description
description

Human readable description for the object.

string
>= 21 characters <= 1200 characters
disable
disable

A value of true will administratively disable the object.

boolean format: boolean
labels
labels

Map of string keys and values that can be used to organize and categorize (scope and select) objects as chosen by the user. Values specified here will be used by selector expression.

object
name
name

This is the name of configuration object. It has to be unique within the namespace. It can only be specified during create API and cannot be changed during replace API. The value of name has to follow DNS-1035 format. Required: YES.

string
>= 6 characters <= 1024 characters
namespace
namespace

This defines the workspace within which each the configuration object is to be created. Must be a DNS_LABEL format. For a namespace object itself, namespace value will be ""

string
>= 6 characters <= 1024 characters
spec
object
psp_spec
object
allow_privilege_escalation
Allow Privilege Escalation

Pod can request to privilege escalation.

boolean format: boolean
allowed_capabilities
object
capabilities
Capability List

List of capabilities that docker container has. Required: YES.

Array<string>
>= 1 items <= 64 items
allowed_csi_drivers
Allowed CSI drivers

Restrict the available CSI drivers for POD, default all drivers are available.

Array<string>
<= 8 items
allowed_flex_volumes
Allowed Flex Volumes

Restrict list of Flex volumes, default all volumes are allowed.

Array<string>
<= 8 items
allowed_host_paths
Allowed Host Paths

Restrict list of host paths, default all host paths are allowed.

Array<object>
<= 8 items
Host Path

Host path and read/write or read-only.

object
path_prefix
Host Path Prefix

Host path prefix is the path prefix that the host volume must match. It does not support *. Required: YES.

string
>= 1 characters <= 128 characters
read_only
Read Only

This volume will be allowed to mount read only.

boolean format: boolean
allowed_proc_mounts
Allowed Proc Mounts

Allowed list of proc mounts, empty list allows default proc mounts.

Array<string>
<= 8 items
allowed_unsafe_sysctls
Allowed Unsafe Sysctls

Allowed list of unsafe sysctls, empty list allows none. Supports prefix reg-ex.

Array<string>
<= 16 items
default_allow_privilege_escalation
Default Allow Privilege Escalation

Pod has permission for privilege escalation by default.

boolean format: boolean
default_capabilities
object
capabilities
Capability List

List of capabilities that docker container has. Required: YES.

Array<string>
>= 1 items <= 64 items
drop_capabilities
object
capabilities
Capability List

List of capabilities that docker container has. Required: YES.

Array<string>
>= 1 items <= 64 items
forbidden_sysctls
Forbidden Sysctls

Forbidden list of sysctls, empty list forbids none. Supports prefix reg-ex.

Array<string>
<= 16 items
fs_group_strategy_options
object
id_ranges
ID Ranges

List of range of ID(s)

Array<object>
<= 16 items
IDRangeType
object
max_id
Ending ID

Ending(maximum) ID for for ID range Required: YES.

integer format: int64
min_id
Starting ID

Starting(minimum) ID for for ID range Required: YES.

integer format: int64
rule
Rule

Rule indicated how the FS group ID range is used.

string
>= 1 characters <= 128 characters
host_ipc
Host IPC

Host IPC determines if the policy allows the use of host IPC in the pod spec.

boolean format: boolean
host_network
Host Network

Host Network determines if the policy allows the use of host network in the pod spec.

boolean format: boolean
host_pid
Host PID

Host PID determines if the policy allows the use of host PID in the pod spec.

boolean format: boolean
host_port_ranges
Host Port Ranges

Host port ranges determines which ports ranges are allowed to be exposed.

string
<= 1024 characters
no_allowed_capabilities
object
no_default_capabilities
object
no_drop_capabilities
object
no_fs_groups
object
no_run_as_group
object
no_run_as_user
object
no_runtime_class
object
no_se_linux_options
object
no_supplemental_groups
object
privileged
Privileged

Privileged determines if a pod can request to be run as privileged.

boolean format: boolean
read_only_root_filesystem
Read Only Root Filesystem

Containers can only run with read only root filesystem.

boolean format: boolean
run_as_group
object
id_ranges
ID Ranges

List of range of ID(s)

Array<object>
<= 16 items
IDRangeType
object
max_id
Ending ID

Ending(maximum) ID for for ID range Required: YES.

integer format: int64
min_id
Starting ID

Starting(minimum) ID for for ID range Required: YES.

integer format: int64
rule
Rule

Rule indicated how the FS group ID range is used.

string
>= 1 characters <= 128 characters
run_as_user
object
id_ranges
ID Ranges

List of range of ID(s)

Array<object>
<= 16 items
IDRangeType
object
max_id
Ending ID

Ending(maximum) ID for for ID range Required: YES.

integer format: int64
min_id
Starting ID

Starting(minimum) ID for for ID range Required: YES.

integer format: int64
rule
Rule

Rule indicated how the FS group ID range is used.

string
>= 1 characters <= 128 characters
supplemental_groups
object
id_ranges
ID Ranges

List of range of ID(s)

Array<object>
<= 16 items
IDRangeType
object
max_id
Ending ID

Ending(maximum) ID for for ID range Required: YES.

integer format: int64
min_id
Starting ID

Starting(minimum) ID for for ID range Required: YES.

integer format: int64
rule
Rule

Rule indicated how the FS group ID range is used.

string
>= 1 characters <= 128 characters
volumes
Volumes

Allow List of volume plugins. Empty no volumes are allowed.

Array<string>
<= 8 items
yaml

Exclusive with [psp_spec] K8s YAML for Pod Security Policy.

string
<= 4096 characters
Examplegenerated
{
  "metadata": {
    "annotations": {},
    "description": "example",
    "disable": true,
    "labels": {},
    "name": "example",
    "namespace": "example"
  },
  "spec": {
    "psp_spec": {
      "allow_privilege_escalation": true,
      "allowed_capabilities": {
        "capabilities": [
          "example"
        ]
      },
      "allowed_csi_drivers": [
        "example"
      ],
      "allowed_flex_volumes": [
        "example"
      ],
      "allowed_host_paths": [
        {
          "path_prefix": "example",
          "read_only": true
        }
      ],
      "allowed_proc_mounts": [
        "example"
      ],
      "allowed_unsafe_sysctls": [
        "example"
      ],
      "default_allow_privilege_escalation": true,
      "default_capabilities": {
        "capabilities": [
          "example"
        ]
      },
      "drop_capabilities": {
        "capabilities": [
          "example"
        ]
      },
      "forbidden_sysctls": [
        "example"
      ],
      "fs_group_strategy_options": {
        "id_ranges": [
          {
            "max_id": 1,
            "min_id": 1
          }
        ],
        "rule": "example"
      },
      "host_ipc": true,
      "host_network": true,
      "host_pid": true,
      "host_port_ranges": "example",
      "no_allowed_capabilities": {},
      "no_default_capabilities": {},
      "no_drop_capabilities": {},
      "no_fs_groups": {},
      "no_run_as_group": {},
      "no_run_as_user": {},
      "no_runtime_class": {},
      "no_se_linux_options": {},
      "no_supplemental_groups": {},
      "privileged": true,
      "read_only_root_filesystem": true,
      "run_as_group": {
        "id_ranges": [
          {
            "max_id": 1,
            "min_id": 1
          }
        ],
        "rule": "example"
      },
      "run_as_user": {
        "id_ranges": [
          {
            "max_id": 1,
            "min_id": 1
          }
        ],
        "rule": "example"
      },
      "supplemental_groups": {
        "id_ranges": [
          {
            "max_id": 1,
            "min_id": 1
          }
        ],
        "rule": "example"
      },
      "volumes": [
        "example"
      ]
    },
    "yaml": "example"
  }
}

Responses

Section titled “Responses”

200

Section titled “200”

A successful response.

Media typeapplication/json
object
Examplegenerated
{}

401

Section titled “401”

Returned when operation is not authorized.

Media typeapplication/json
string format: string
Examplegenerated
example

403

Section titled “403”

Returned when there is no permission to access resource.

Media typeapplication/json
string format: string
Examplegenerated
example

404

Section titled “404”

Returned when resource is not found.

Media typeapplication/json
string format: string
Examplegenerated
example

409

Section titled “409”

Returned when operation on resource is conflicting with current value.

Media typeapplication/json
string format: string
Examplegenerated
example

429

Section titled “429”

Returned when operation has been rejected as it is happening too frequently.

Media typeapplication/json
string format: string
Examplegenerated
example

500

Section titled “500”

Returned when server encountered an error in processing API.

Media typeapplication/json
string format: string
Examplegenerated
example

503

Section titled “503”

Returned when service is unavailable temporarily.

Media typeapplication/json
string format: string
Examplegenerated
example

504

Section titled “504”

Returned when server timed out processing request.

Media typeapplication/json
string format: string
Examplegenerated
example