xcsh_k8s_pod_security_policy (Data Source)

Retrieves information about k8s_pod_security_policy will create the object in the storage backend for namespace metadata.namespace in F5 Distributed Cloud. This is a read-only data source.

~> Note: For more information, see the F5 Distributed Cloud API documentation.

Example Usage

# K8SPodSecurityPolicy Data Source Example

terraform {
  required_version = ">= 1.0"

  required_providers {
    xcsh = {
      source  = "f5-sales-demo/xcsh"
      version = ">= 0.1.0"
    }
  }
}

# Look up an existing K8SPodSecurityPolicy by name
data "xcsh_k8s_pod_security_policy" "example" {
  name      = "example-k8s-pod-security-policy"
  namespace = "staging"
}

output "k8s_pod_security_policy_id" {
  value = data.xcsh_k8s_pod_security_policy.example.id
}

Argument Reference

-> Syntax Rule: This provider uses OneOf groups for mutually exclusive options. Fields documented as “Optional Block” use block syntax field_name { ... }. Empty OneOf object attributes use field_name = {}; conditional selection uses condition ? {} : null. Boolean attributes (such as add_hsts and http_redirect) use = true or = false.

🔶 High Risk Operations — Some operations on this resource have high danger level. Destructive operations may require confirmation.

Metadata Argument Reference

• name - Required String
Name of the K8SPodSecurityPolicy

• namespace - Required String
Namespace where the K8SPodSecurityPolicy exists

Attributes Reference

In addition to all arguments above, the following attributes are exported:

• annotations - Optional Map
Annotations applied to this resource

• description - Optional String
Description of the K8SPodSecurityPolicy

• id - Optional String
Unique identifier for the resource

• labels - Optional Map
Labels applied to this resource

• psp_spec - Optional String
Pod Security Policy Specification. Form based pod security specification

• yaml - Optional String
K8S YAML for Pod Security Policy

• allow_privilege_escalation - Optional Bool
Pod can request to privilege escalation

• allowed_capabilities - Optional String
List of capabilities that Docker container has

• allowed_csi_drivers - Optional List
Restrict the available CSI drivers for POD, default all drivers are available

• allowed_flex_volumes - Optional List
Restrict list of Flex volumes, default all volumes are allowed

• allowed_host_paths - Optional List
Restrict list of host paths, default all host paths are allowed

• allowed_proc_mounts - Optional List
Allowed list of proc mounts, empty list allows default proc mounts

• allowed_unsafe_sysctls - Optional List
Allowed list of unsafe sysctls, empty list allows none. Supports prefix reg-ex

• default_allow_privilege_escalation - Optional Bool
Pod has permission for privilege escalation by default

• default_capabilities - Optional String
List of capabilities that Docker container has

• drop_capabilities - Optional String
List of capabilities that Docker container has

• forbidden_sysctls - Optional List
Forbidden list of sysctls, empty list forbids none. Supports prefix reg-ex

• fs_group_strategy_options - Optional String
Configuration parameter for fs group strategy options

• host_ipc - Optional Bool
Host IPC determines if the policy allows the use of host IPC in the pod spec

• host_network - Optional Bool
Host Network determines if the policy allows the use of host network in the pod spec

• host_pid - Optional Bool
Host PID determines if the policy allows the use of host PID in the pod spec

• host_port_ranges - Optional String
Host port ranges determines which ports ranges are allowed to be exposed

• no_allowed_capabilities - Optional Object
Configuration parameter for no allowed capabilities

• no_default_capabilities - Optional Object
Configuration parameter for no default capabilities

• no_drop_capabilities - Optional Object
Configuration parameter for no drop capabilities

• no_fs_groups - Optional Object
Enable this option

• no_run_as_group - Optional Object
Configuration parameter for no run as group

• no_run_as_user - Optional Object
Configuration parameter for no run as user

• no_runtime_class - Optional String
Configuration parameter for no runtime class

• no_se_linux_options - Optional String
Configuration parameter for no se Linux options

• no_supplemental_groups - Optional Object
Enable this option

• privileged - Optional Bool
Privileged determines if a pod can request to be run as privileged

• read_only_root_filesystem - Optional Bool
Containers can only run with read only root filesystem

• run_as_group - Optional String
Configuration parameter for run as group

• run_as_user - Optional String
Configuration parameter for run as user

• supplemental_groups - Optional String
ID(User,Group,FSGroup) Strategy. ID ranges and rules

• volumes - Optional List
Allow List of volume plugins. Empty no volumes are allowed

• capabilities - Optional List
List of capabilities that Docker container has

• path_prefix - Optional String
Host path prefix is the path prefix that the host volume must match. It does not support *

• read_only - Optional Bool
Volume will be allowed to mount read only

• capabilities - Optional List
List of capabilities that Docker container has

• id_ranges - Optional List
ID Ranges. List of range of ID(s)

• rule - Optional String
Rule indicated how the FS group ID range is used

• max_id - Optional Number
Ending ID. Ending(maximum) ID for for ID range

• min_id - Optional Number
Starting ID. Starting(minimum) ID for for ID range