{{- if .Values.rbac.pspEnabled }}
{{- if .Capabilities.APIVersions.Has "policy/v1beta1" }}
apiVersion: policy/v1beta1
{{- else }}
apiVersion: extensions/v1beta1
{{- end }}
kind: PodSecurityPolicy
metadata:
  name: {{ template "fluentd-cloudwatch.fullname" . }}
  labels:
    app: {{ template "fluentd-cloudwatch.name" . }}
    chart: "{{ .Chart.Name }}-{{ .Chart.Version }}"
    heritage: "{{ .Release.Service }}"
    release: "{{ .Release.Name }}"
spec:
  allowedCapabilities:
  - '*'
  fsGroup:
    rule: RunAsAny
  privileged: true
  runAsUser:
    rule: RunAsAny
  seLinux:
    rule: RunAsAny
  supplementalGroups:
    rule: RunAsAny
  volumes:
  - '*'
  hostPID: true
  hostIPC: true
  hostNetwork: true
  hostPorts:
  - min: 1
    max: 65536
{{- end }}
