k8s_openapi/v1_30/api/core/v1/
security_context.rs

1// Generated from definition io.k8s.api.core.v1.SecurityContext
2
3/// SecurityContext holds security configuration that will be applied to a container. Some fields are present in both SecurityContext and PodSecurityContext.  When both are set, the values in SecurityContext take precedence.
4#[derive(Clone, Debug, Default, PartialEq)]
5pub struct SecurityContext {
6    /// AllowPrivilegeEscalation controls whether a process can gain more privileges than its parent process. This bool directly controls if the no_new_privs flag will be set on the container process. AllowPrivilegeEscalation is true always when the container is: 1) run as Privileged 2) has CAP_SYS_ADMIN Note that this field cannot be set when spec.os.name is windows.
7    pub allow_privilege_escalation: Option<bool>,
8
9    /// appArmorProfile is the AppArmor options to use by this container. If set, this profile overrides the pod's appArmorProfile. Note that this field cannot be set when spec.os.name is windows.
10    pub app_armor_profile: Option<crate::api::core::v1::AppArmorProfile>,
11
12    /// The capabilities to add/drop when running containers. Defaults to the default set of capabilities granted by the container runtime. Note that this field cannot be set when spec.os.name is windows.
13    pub capabilities: Option<crate::api::core::v1::Capabilities>,
14
15    /// Run container in privileged mode. Processes in privileged containers are essentially equivalent to root on the host. Defaults to false. Note that this field cannot be set when spec.os.name is windows.
16    pub privileged: Option<bool>,
17
18    /// procMount denotes the type of proc mount to use for the containers. The default is DefaultProcMount which uses the container runtime defaults for readonly paths and masked paths. This requires the ProcMountType feature flag to be enabled. Note that this field cannot be set when spec.os.name is windows.
19    pub proc_mount: Option<std::string::String>,
20
21    /// Whether this container has a read-only root filesystem. Default is false. Note that this field cannot be set when spec.os.name is windows.
22    pub read_only_root_filesystem: Option<bool>,
23
24    /// The GID to run the entrypoint of the container process. Uses runtime default if unset. May also be set in PodSecurityContext.  If set in both SecurityContext and PodSecurityContext, the value specified in SecurityContext takes precedence. Note that this field cannot be set when spec.os.name is windows.
25    pub run_as_group: Option<i64>,
26
27    /// Indicates that the container must run as a non-root user. If true, the Kubelet will validate the image at runtime to ensure that it does not run as UID 0 (root) and fail to start the container if it does. If unset or false, no such validation will be performed. May also be set in PodSecurityContext.  If set in both SecurityContext and PodSecurityContext, the value specified in SecurityContext takes precedence.
28    pub run_as_non_root: Option<bool>,
29
30    /// The UID to run the entrypoint of the container process. Defaults to user specified in image metadata if unspecified. May also be set in PodSecurityContext.  If set in both SecurityContext and PodSecurityContext, the value specified in SecurityContext takes precedence. Note that this field cannot be set when spec.os.name is windows.
31    pub run_as_user: Option<i64>,
32
33    /// The SELinux context to be applied to the container. If unspecified, the container runtime will allocate a random SELinux context for each container.  May also be set in PodSecurityContext.  If set in both SecurityContext and PodSecurityContext, the value specified in SecurityContext takes precedence. Note that this field cannot be set when spec.os.name is windows.
34    pub se_linux_options: Option<crate::api::core::v1::SELinuxOptions>,
35
36    /// The seccomp options to use by this container. If seccomp options are provided at both the pod & container level, the container options override the pod options. Note that this field cannot be set when spec.os.name is windows.
37    pub seccomp_profile: Option<crate::api::core::v1::SeccompProfile>,
38
39    /// The Windows specific settings applied to all containers. If unspecified, the options from the PodSecurityContext will be used. If set in both SecurityContext and PodSecurityContext, the value specified in SecurityContext takes precedence. Note that this field cannot be set when spec.os.name is linux.
40    pub windows_options: Option<crate::api::core::v1::WindowsSecurityContextOptions>,
41}
42
43impl crate::DeepMerge for SecurityContext {
44    fn merge_from(&mut self, other: Self) {
45        crate::DeepMerge::merge_from(&mut self.allow_privilege_escalation, other.allow_privilege_escalation);
46        crate::DeepMerge::merge_from(&mut self.app_armor_profile, other.app_armor_profile);
47        crate::DeepMerge::merge_from(&mut self.capabilities, other.capabilities);
48        crate::DeepMerge::merge_from(&mut self.privileged, other.privileged);
49        crate::DeepMerge::merge_from(&mut self.proc_mount, other.proc_mount);
50        crate::DeepMerge::merge_from(&mut self.read_only_root_filesystem, other.read_only_root_filesystem);
51        crate::DeepMerge::merge_from(&mut self.run_as_group, other.run_as_group);
52        crate::DeepMerge::merge_from(&mut self.run_as_non_root, other.run_as_non_root);
53        crate::DeepMerge::merge_from(&mut self.run_as_user, other.run_as_user);
54        crate::DeepMerge::merge_from(&mut self.se_linux_options, other.se_linux_options);
55        crate::DeepMerge::merge_from(&mut self.seccomp_profile, other.seccomp_profile);
56        crate::DeepMerge::merge_from(&mut self.windows_options, other.windows_options);
57    }
58}
59
60impl<'de> crate::serde::Deserialize<'de> for SecurityContext {
61    fn deserialize<D>(deserializer: D) -> Result<Self, D::Error> where D: crate::serde::Deserializer<'de> {
62        #[allow(non_camel_case_types)]
63        enum Field {
64            Key_allow_privilege_escalation,
65            Key_app_armor_profile,
66            Key_capabilities,
67            Key_privileged,
68            Key_proc_mount,
69            Key_read_only_root_filesystem,
70            Key_run_as_group,
71            Key_run_as_non_root,
72            Key_run_as_user,
73            Key_se_linux_options,
74            Key_seccomp_profile,
75            Key_windows_options,
76            Other,
77        }
78
79        impl<'de> crate::serde::Deserialize<'de> for Field {
80            fn deserialize<D>(deserializer: D) -> Result<Self, D::Error> where D: crate::serde::Deserializer<'de> {
81                struct Visitor;
82
83                impl crate::serde::de::Visitor<'_> for Visitor {
84                    type Value = Field;
85
86                    fn expecting(&self, f: &mut core::fmt::Formatter<'_>) -> core::fmt::Result {
87                        f.write_str("field identifier")
88                    }
89
90                    fn visit_str<E>(self, v: &str) -> Result<Self::Value, E> where E: crate::serde::de::Error {
91                        Ok(match v {
92                            "allowPrivilegeEscalation" => Field::Key_allow_privilege_escalation,
93                            "appArmorProfile" => Field::Key_app_armor_profile,
94                            "capabilities" => Field::Key_capabilities,
95                            "privileged" => Field::Key_privileged,
96                            "procMount" => Field::Key_proc_mount,
97                            "readOnlyRootFilesystem" => Field::Key_read_only_root_filesystem,
98                            "runAsGroup" => Field::Key_run_as_group,
99                            "runAsNonRoot" => Field::Key_run_as_non_root,
100                            "runAsUser" => Field::Key_run_as_user,
101                            "seLinuxOptions" => Field::Key_se_linux_options,
102                            "seccompProfile" => Field::Key_seccomp_profile,
103                            "windowsOptions" => Field::Key_windows_options,
104                            _ => Field::Other,
105                        })
106                    }
107                }
108
109                deserializer.deserialize_identifier(Visitor)
110            }
111        }
112
113        struct Visitor;
114
115        impl<'de> crate::serde::de::Visitor<'de> for Visitor {
116            type Value = SecurityContext;
117
118            fn expecting(&self, f: &mut core::fmt::Formatter<'_>) -> core::fmt::Result {
119                f.write_str("SecurityContext")
120            }
121
122            fn visit_map<A>(self, mut map: A) -> Result<Self::Value, A::Error> where A: crate::serde::de::MapAccess<'de> {
123                let mut value_allow_privilege_escalation: Option<bool> = None;
124                let mut value_app_armor_profile: Option<crate::api::core::v1::AppArmorProfile> = None;
125                let mut value_capabilities: Option<crate::api::core::v1::Capabilities> = None;
126                let mut value_privileged: Option<bool> = None;
127                let mut value_proc_mount: Option<std::string::String> = None;
128                let mut value_read_only_root_filesystem: Option<bool> = None;
129                let mut value_run_as_group: Option<i64> = None;
130                let mut value_run_as_non_root: Option<bool> = None;
131                let mut value_run_as_user: Option<i64> = None;
132                let mut value_se_linux_options: Option<crate::api::core::v1::SELinuxOptions> = None;
133                let mut value_seccomp_profile: Option<crate::api::core::v1::SeccompProfile> = None;
134                let mut value_windows_options: Option<crate::api::core::v1::WindowsSecurityContextOptions> = None;
135
136                while let Some(key) = crate::serde::de::MapAccess::next_key::<Field>(&mut map)? {
137                    match key {
138                        Field::Key_allow_privilege_escalation => value_allow_privilege_escalation = crate::serde::de::MapAccess::next_value(&mut map)?,
139                        Field::Key_app_armor_profile => value_app_armor_profile = crate::serde::de::MapAccess::next_value(&mut map)?,
140                        Field::Key_capabilities => value_capabilities = crate::serde::de::MapAccess::next_value(&mut map)?,
141                        Field::Key_privileged => value_privileged = crate::serde::de::MapAccess::next_value(&mut map)?,
142                        Field::Key_proc_mount => value_proc_mount = crate::serde::de::MapAccess::next_value(&mut map)?,
143                        Field::Key_read_only_root_filesystem => value_read_only_root_filesystem = crate::serde::de::MapAccess::next_value(&mut map)?,
144                        Field::Key_run_as_group => value_run_as_group = crate::serde::de::MapAccess::next_value(&mut map)?,
145                        Field::Key_run_as_non_root => value_run_as_non_root = crate::serde::de::MapAccess::next_value(&mut map)?,
146                        Field::Key_run_as_user => value_run_as_user = crate::serde::de::MapAccess::next_value(&mut map)?,
147                        Field::Key_se_linux_options => value_se_linux_options = crate::serde::de::MapAccess::next_value(&mut map)?,
148                        Field::Key_seccomp_profile => value_seccomp_profile = crate::serde::de::MapAccess::next_value(&mut map)?,
149                        Field::Key_windows_options => value_windows_options = crate::serde::de::MapAccess::next_value(&mut map)?,
150                        Field::Other => { let _: crate::serde::de::IgnoredAny = crate::serde::de::MapAccess::next_value(&mut map)?; },
151                    }
152                }
153
154                Ok(SecurityContext {
155                    allow_privilege_escalation: value_allow_privilege_escalation,
156                    app_armor_profile: value_app_armor_profile,
157                    capabilities: value_capabilities,
158                    privileged: value_privileged,
159                    proc_mount: value_proc_mount,
160                    read_only_root_filesystem: value_read_only_root_filesystem,
161                    run_as_group: value_run_as_group,
162                    run_as_non_root: value_run_as_non_root,
163                    run_as_user: value_run_as_user,
164                    se_linux_options: value_se_linux_options,
165                    seccomp_profile: value_seccomp_profile,
166                    windows_options: value_windows_options,
167                })
168            }
169        }
170
171        deserializer.deserialize_struct(
172            "SecurityContext",
173            &[
174                "allowPrivilegeEscalation",
175                "appArmorProfile",
176                "capabilities",
177                "privileged",
178                "procMount",
179                "readOnlyRootFilesystem",
180                "runAsGroup",
181                "runAsNonRoot",
182                "runAsUser",
183                "seLinuxOptions",
184                "seccompProfile",
185                "windowsOptions",
186            ],
187            Visitor,
188        )
189    }
190}
191
192impl crate::serde::Serialize for SecurityContext {
193    fn serialize<S>(&self, serializer: S) -> Result<S::Ok, S::Error> where S: crate::serde::Serializer {
194        let mut state = serializer.serialize_struct(
195            "SecurityContext",
196            self.allow_privilege_escalation.as_ref().map_or(0, |_| 1) +
197            self.app_armor_profile.as_ref().map_or(0, |_| 1) +
198            self.capabilities.as_ref().map_or(0, |_| 1) +
199            self.privileged.as_ref().map_or(0, |_| 1) +
200            self.proc_mount.as_ref().map_or(0, |_| 1) +
201            self.read_only_root_filesystem.as_ref().map_or(0, |_| 1) +
202            self.run_as_group.as_ref().map_or(0, |_| 1) +
203            self.run_as_non_root.as_ref().map_or(0, |_| 1) +
204            self.run_as_user.as_ref().map_or(0, |_| 1) +
205            self.se_linux_options.as_ref().map_or(0, |_| 1) +
206            self.seccomp_profile.as_ref().map_or(0, |_| 1) +
207            self.windows_options.as_ref().map_or(0, |_| 1),
208        )?;
209        if let Some(value) = &self.allow_privilege_escalation {
210            crate::serde::ser::SerializeStruct::serialize_field(&mut state, "allowPrivilegeEscalation", value)?;
211        }
212        if let Some(value) = &self.app_armor_profile {
213            crate::serde::ser::SerializeStruct::serialize_field(&mut state, "appArmorProfile", value)?;
214        }
215        if let Some(value) = &self.capabilities {
216            crate::serde::ser::SerializeStruct::serialize_field(&mut state, "capabilities", value)?;
217        }
218        if let Some(value) = &self.privileged {
219            crate::serde::ser::SerializeStruct::serialize_field(&mut state, "privileged", value)?;
220        }
221        if let Some(value) = &self.proc_mount {
222            crate::serde::ser::SerializeStruct::serialize_field(&mut state, "procMount", value)?;
223        }
224        if let Some(value) = &self.read_only_root_filesystem {
225            crate::serde::ser::SerializeStruct::serialize_field(&mut state, "readOnlyRootFilesystem", value)?;
226        }
227        if let Some(value) = &self.run_as_group {
228            crate::serde::ser::SerializeStruct::serialize_field(&mut state, "runAsGroup", value)?;
229        }
230        if let Some(value) = &self.run_as_non_root {
231            crate::serde::ser::SerializeStruct::serialize_field(&mut state, "runAsNonRoot", value)?;
232        }
233        if let Some(value) = &self.run_as_user {
234            crate::serde::ser::SerializeStruct::serialize_field(&mut state, "runAsUser", value)?;
235        }
236        if let Some(value) = &self.se_linux_options {
237            crate::serde::ser::SerializeStruct::serialize_field(&mut state, "seLinuxOptions", value)?;
238        }
239        if let Some(value) = &self.seccomp_profile {
240            crate::serde::ser::SerializeStruct::serialize_field(&mut state, "seccompProfile", value)?;
241        }
242        if let Some(value) = &self.windows_options {
243            crate::serde::ser::SerializeStruct::serialize_field(&mut state, "windowsOptions", value)?;
244        }
245        crate::serde::ser::SerializeStruct::end(state)
246    }
247}
248
249#[cfg(feature = "schemars")]
250impl crate::schemars::JsonSchema for SecurityContext {
251    fn schema_name() -> std::borrow::Cow<'static, str> {
252        "io.k8s.api.core.v1.SecurityContext".into()
253    }
254
255    fn json_schema(__gen: &mut crate::schemars::SchemaGenerator) -> crate::schemars::Schema {
256        crate::schemars::json_schema!({
257            "description": "SecurityContext holds security configuration that will be applied to a container. Some fields are present in both SecurityContext and PodSecurityContext.  When both are set, the values in SecurityContext take precedence.",
258            "type": "object",
259            "properties": {
260                "allowPrivilegeEscalation": {
261                    "description": "AllowPrivilegeEscalation controls whether a process can gain more privileges than its parent process. This bool directly controls if the no_new_privs flag will be set on the container process. AllowPrivilegeEscalation is true always when the container is: 1) run as Privileged 2) has CAP_SYS_ADMIN Note that this field cannot be set when spec.os.name is windows.",
262                    "type": "boolean",
263                },
264                "appArmorProfile": ({
265                    let mut schema_obj = __gen.subschema_for::<crate::api::core::v1::AppArmorProfile>();
266                    schema_obj.ensure_object().insert("description".into(), "appArmorProfile is the AppArmor options to use by this container. If set, this profile overrides the pod's appArmorProfile. Note that this field cannot be set when spec.os.name is windows.".into());
267                    schema_obj
268                }),
269                "capabilities": ({
270                    let mut schema_obj = __gen.subschema_for::<crate::api::core::v1::Capabilities>();
271                    schema_obj.ensure_object().insert("description".into(), "The capabilities to add/drop when running containers. Defaults to the default set of capabilities granted by the container runtime. Note that this field cannot be set when spec.os.name is windows.".into());
272                    schema_obj
273                }),
274                "privileged": {
275                    "description": "Run container in privileged mode. Processes in privileged containers are essentially equivalent to root on the host. Defaults to false. Note that this field cannot be set when spec.os.name is windows.",
276                    "type": "boolean",
277                },
278                "procMount": {
279                    "description": "procMount denotes the type of proc mount to use for the containers. The default is DefaultProcMount which uses the container runtime defaults for readonly paths and masked paths. This requires the ProcMountType feature flag to be enabled. Note that this field cannot be set when spec.os.name is windows.",
280                    "type": "string",
281                },
282                "readOnlyRootFilesystem": {
283                    "description": "Whether this container has a read-only root filesystem. Default is false. Note that this field cannot be set when spec.os.name is windows.",
284                    "type": "boolean",
285                },
286                "runAsGroup": {
287                    "description": "The GID to run the entrypoint of the container process. Uses runtime default if unset. May also be set in PodSecurityContext.  If set in both SecurityContext and PodSecurityContext, the value specified in SecurityContext takes precedence. Note that this field cannot be set when spec.os.name is windows.",
288                    "type": "integer",
289                    "format": "int64",
290                },
291                "runAsNonRoot": {
292                    "description": "Indicates that the container must run as a non-root user. If true, the Kubelet will validate the image at runtime to ensure that it does not run as UID 0 (root) and fail to start the container if it does. If unset or false, no such validation will be performed. May also be set in PodSecurityContext.  If set in both SecurityContext and PodSecurityContext, the value specified in SecurityContext takes precedence.",
293                    "type": "boolean",
294                },
295                "runAsUser": {
296                    "description": "The UID to run the entrypoint of the container process. Defaults to user specified in image metadata if unspecified. May also be set in PodSecurityContext.  If set in both SecurityContext and PodSecurityContext, the value specified in SecurityContext takes precedence. Note that this field cannot be set when spec.os.name is windows.",
297                    "type": "integer",
298                    "format": "int64",
299                },
300                "seLinuxOptions": ({
301                    let mut schema_obj = __gen.subschema_for::<crate::api::core::v1::SELinuxOptions>();
302                    schema_obj.ensure_object().insert("description".into(), "The SELinux context to be applied to the container. If unspecified, the container runtime will allocate a random SELinux context for each container.  May also be set in PodSecurityContext.  If set in both SecurityContext and PodSecurityContext, the value specified in SecurityContext takes precedence. Note that this field cannot be set when spec.os.name is windows.".into());
303                    schema_obj
304                }),
305                "seccompProfile": ({
306                    let mut schema_obj = __gen.subschema_for::<crate::api::core::v1::SeccompProfile>();
307                    schema_obj.ensure_object().insert("description".into(), "The seccomp options to use by this container. If seccomp options are provided at both the pod & container level, the container options override the pod options. Note that this field cannot be set when spec.os.name is windows.".into());
308                    schema_obj
309                }),
310                "windowsOptions": ({
311                    let mut schema_obj = __gen.subschema_for::<crate::api::core::v1::WindowsSecurityContextOptions>();
312                    schema_obj.ensure_object().insert("description".into(), "The Windows specific settings applied to all containers. If unspecified, the options from the PodSecurityContext will be used. If set in both SecurityContext and PodSecurityContext, the value specified in SecurityContext takes precedence. Note that this field cannot be set when spec.os.name is linux.".into());
313                    schema_obj
314                }),
315            },
316        })
317    }
318}
k8s_openapi/v1_30/api/core/v1/security_context.rs

k8s_openapi/v1_30/api/core/v1/
security_context.rs
