diff --git a/docs/api-reference/extensions/v1beta1/definitions.html b/docs/api-reference/extensions/v1beta1/definitions.html index 06498488ad9..5888e3b085f 100644 --- a/docs/api-reference/extensions/v1beta1/definitions.html +++ b/docs/api-reference/extensions/v1beta1/definitions.html @@ -532,28 +532,28 @@ span.icon > [class^="icon-"], span.icon > [class*=" icon-"] { cursor: default; }

user

-

User is a SELinux user label that applies to the container. More info: http://releases.k8s.io/HEAD/docs/user-guide/labels.md

+

User is a SELinux user label that applies to the container.

false

string

role

-

Role is a SELinux role label that applies to the container. More info: http://releases.k8s.io/HEAD/docs/user-guide/labels.md

+

Role is a SELinux role label that applies to the container.

false

string

type

-

Type is a SELinux type label that applies to the container. More info: http://releases.k8s.io/HEAD/docs/user-guide/labels.md

+

Type is a SELinux type label that applies to the container.

false

string

level

-

Level is SELinux level label that applies to the container. More info: http://releases.k8s.io/HEAD/docs/user-guide/labels.md

+

Level is SELinux level label that applies to the container.

false

string

@@ -1891,6 +1891,27 @@ Both these may change in the future. Incoming requests are matched against the h

[integer] array

+ +

seLinuxOptions

+

SELinuxOptions is the SELinux context to be applied to all containers If unspecified, the container runtime will allocate a random SELinux context for each container. May also be set in SecurityContext. If set in both SecurityContext and PodSecurityContext, the value specified in SecurityContext takes precedence for that container.

+

false

+

v1.SELinuxOptions

+ + + +

runAsUser

+

The UID to run the entrypoint of the container process. Defaults to user specified in image metadata if unspecified. May also be set in SecurityContext. If set in both SecurityContext and PodSecurityContext, the value specified in SecurityContext takes precedence for that container.

+

false

+

integer (int64)

+ + + +

runAsNonRoot

+

Indicates that the container must run as a non-root user. If true, the Kubelet will validate the image at runtime to ensure that it does not run as UID 0 (root) and fail to start the container if it does. If unset or false, no such validation will be performed. May also be set in SecurityContext. If set in both SecurityContext and PodSecurityContext, the value specified in SecurityContext takes precedence.

+

false

+

boolean

+

false

+ @@ -2368,7 +2389,7 @@ Populated by the system when a graceful deletion is requested. Read-only. More i

v1.SecurityContext

-

SecurityContext holds security configuration that will be applied to a container.

+

SecurityContext holds security configuration that will be applied to a container. Some fields are present in both SecurityContext and PodSecurityContext. When both are set, the values in SecurityContext take precedence.

@@ -2390,35 +2411,35 @@ Populated by the system when a graceful deletion is requested. Read-only. More i - + - + - + - + - + @@ -3688,7 +3709,7 @@ Populated by the system when a graceful deletion is requested. Read-only. More i - + @@ -4217,7 +4238,7 @@ Populated by the system when a graceful deletion is requested. Read-only. More i diff --git a/docs/api-reference/extensions/v1beta1/operations.html b/docs/api-reference/extensions/v1beta1/operations.html index 6efb3c95dc1..d99f63e865c 100644 --- a/docs/api-reference/extensions/v1beta1/operations.html +++ b/docs/api-reference/extensions/v1beta1/operations.html @@ -4975,7 +4975,7 @@ span.icon > [class^="icon-"], span.icon > [class*=" icon-"] { cursor: default; } diff --git a/docs/api-reference/v1/definitions.html b/docs/api-reference/v1/definitions.html index a87286fbc67..0d3965ff3ce 100644 --- a/docs/api-reference/v1/definitions.html +++ b/docs/api-reference/v1/definitions.html @@ -655,28 +655,28 @@ span.icon > [class^="icon-"], span.icon > [class*=" icon-"] { cursor: default; } - + - + - + - + @@ -3443,7 +3443,7 @@ The resulting set of endpoints can be viewed as:
- + @@ -4873,6 +4873,27 @@ The resulting set of endpoints can be viewed as:
+ + + + + + + + + + + + + + + + + + + + +

capabilities

The linux kernel capabilites that should be added or removed. Default to Container.Capabilities if left unset. More info: http://releases.k8s.io/HEAD/docs/design/security_context.md#security-context

The capabilities to add/drop when running containers. Defaults to the default set of capabilities granted by the container runtime.

false

v1.Capabilities

privileged

Run the container in privileged mode. Default to Container.Privileged if left unset. More info: http://releases.k8s.io/HEAD/docs/design/security_context.md#security-context

Run container in privileged mode. Processes in privileged containers are essentially equivalent to root on the host. Defaults to false.

false

boolean

false

seLinuxOptions

SELinuxOptions are the labels to be applied to the container and volumes. Options that control the SELinux labels applied. More info: http://releases.k8s.io/HEAD/docs/design/security_context.md#security-context

The SELinux context to be applied to the container. If unspecified, the container runtime will allocate a random SELinux context for each container. May also be set in PodSecurityContext. If set in both SecurityContext and PodSecurityContext, the value specified in SecurityContext takes precedence.

false

v1.SELinuxOptions

runAsUser

RunAsUser is the UID to run the entrypoint of the container process. The user id that runs the first process in the container. More info: http://releases.k8s.io/HEAD/docs/design/security_context.md#security-context

The UID to run the entrypoint of the container process. Defaults to user specified in image metadata if unspecified. May also be set in PodSecurityContext. If set in both SecurityContext and PodSecurityContext, the value specified in SecurityContext takes precedence.

false

integer (int64)

runAsNonRoot

RunAsNonRoot indicates that the container should be run as a non-root user. If the RunAsUser field is not explicitly set then the kubelet may check the image for a specified user or perform defaulting to specify a user.

Indicates that the container must run as a non-root user. If true, the Kubelet will validate the image at runtime to ensure that it does not run as UID 0 (root) and fail to start the container if it does. If unset or false, no such validation will be performed. May also be set in PodSecurityContext. If set in both SecurityContext and PodSecurityContext, the value specified in SecurityContext takes precedence.

false

boolean

false

securityContext

SecurityContext holds pod-level security attributes and common container settings

SecurityContext holds pod-level security attributes and common container settings. Optional: Defaults to empty. See type description for default values of each field.

false

v1.PodSecurityContext

user

User is a SELinux user label that applies to the container. More info: http://releases.k8s.io/HEAD/docs/user-guide/labels.md

User is a SELinux user label that applies to the container.

false

string

role

Role is a SELinux role label that applies to the container. More info: http://releases.k8s.io/HEAD/docs/user-guide/labels.md

Role is a SELinux role label that applies to the container.

false

string

type

Type is a SELinux type label that applies to the container. More info: http://releases.k8s.io/HEAD/docs/user-guide/labels.md

Type is a SELinux type label that applies to the container.

false

string

level

Level is SELinux level label that applies to the container. More info: http://releases.k8s.io/HEAD/docs/user-guide/labels.md

Level is SELinux level label that applies to the container.

false

string

securityContext

SecurityContext holds pod-level security attributes and common container settings

SecurityContext holds pod-level security attributes and common container settings. Optional: Defaults to empty. See type description for default values of each field.

false

v1.PodSecurityContext

[integer] array

seLinuxOptions

SELinuxOptions is the SELinux context to be applied to all containers If unspecified, the container runtime will allocate a random SELinux context for each container. May also be set in SecurityContext. If set in both SecurityContext and PodSecurityContext, the value specified in SecurityContext takes precedence for that container.

false

v1.SELinuxOptions

runAsUser

The UID to run the entrypoint of the container process. Defaults to user specified in image metadata if unspecified. May also be set in SecurityContext. If set in both SecurityContext and PodSecurityContext, the value specified in SecurityContext takes precedence for that container.

false

integer (int64)

runAsNonRoot

Indicates that the container must run as a non-root user. If true, the Kubelet will validate the image at runtime to ensure that it does not run as UID 0 (root) and fail to start the container if it does. If unset or false, no such validation will be performed. May also be set in SecurityContext. If set in both SecurityContext and PodSecurityContext, the value specified in SecurityContext takes precedence.

false

boolean

false
@@ -5348,7 +5369,7 @@ The resulting set of endpoints can be viewed as:

v1.SecurityContext

-

SecurityContext holds security configuration that will be applied to a container.

+

SecurityContext holds security configuration that will be applied to a container. Some fields are present in both SecurityContext and PodSecurityContext. When both are set, the values in SecurityContext take precedence.

@@ -5370,35 +5391,35 @@ The resulting set of endpoints can be viewed as:
- + - + - + - + - + @@ -6836,7 +6857,7 @@ The resulting set of endpoints can be viewed as:
diff --git a/docs/api-reference/v1/operations.html b/docs/api-reference/v1/operations.html index f14210bb13e..1c2adc4455d 100644 --- a/docs/api-reference/v1/operations.html +++ b/docs/api-reference/v1/operations.html @@ -23144,7 +23144,7 @@ span.icon > [class^="icon-"], span.icon > [class*=" icon-"] { cursor: default; }

capabilities

The linux kernel capabilites that should be added or removed. Default to Container.Capabilities if left unset. More info: http://releases.k8s.io/HEAD/docs/design/security_context.md#security-context

The capabilities to add/drop when running containers. Defaults to the default set of capabilities granted by the container runtime.

false

v1.Capabilities

privileged

Run the container in privileged mode. Default to Container.Privileged if left unset. More info: http://releases.k8s.io/HEAD/docs/design/security_context.md#security-context

Run container in privileged mode. Processes in privileged containers are essentially equivalent to root on the host. Defaults to false.

false

boolean

false

seLinuxOptions

SELinuxOptions are the labels to be applied to the container and volumes. Options that control the SELinux labels applied. More info: http://releases.k8s.io/HEAD/docs/design/security_context.md#security-context

The SELinux context to be applied to the container. If unspecified, the container runtime will allocate a random SELinux context for each container. May also be set in PodSecurityContext. If set in both SecurityContext and PodSecurityContext, the value specified in SecurityContext takes precedence.

false

v1.SELinuxOptions

runAsUser

RunAsUser is the UID to run the entrypoint of the container process. The user id that runs the first process in the container. More info: http://releases.k8s.io/HEAD/docs/design/security_context.md#security-context

The UID to run the entrypoint of the container process. Defaults to user specified in image metadata if unspecified. May also be set in PodSecurityContext. If set in both SecurityContext and PodSecurityContext, the value specified in SecurityContext takes precedence.

false

integer (int64)

runAsNonRoot

RunAsNonRoot indicates that the container should be run as a non-root user. If the RunAsUser field is not explicitly set then the kubelet may check the image for a specified user or perform defaulting to specify a user.

Indicates that the container must run as a non-root user. If true, the Kubelet will validate the image at runtime to ensure that it does not run as UID 0 (root) and fail to start the container if it does. If unset or false, no such validation will be performed. May also be set in PodSecurityContext. If set in both SecurityContext and PodSecurityContext, the value specified in SecurityContext takes precedence.

false

boolean

false