# Code generated by KubeVela templates. DO NOT EDIT. Please edit the original cue file.
# Definition source cue file: vela-templates/definitions/internal/podsecuritycontext.cue
apiVersion: core.oam.dev/v1beta1
kind: TraitDefinition
metadata:
  annotations:
    definition.oam.dev/description: Adds security context to the pod spec in path 'spec.template.spec.securityContext'.
  name: podsecuritycontext
  namespace: {{ include "systemDefinitionNamespace" . }}
spec:
  appliesToWorkloads:
    - deployments.apps
    - statefulsets.apps
    - daemonsets.apps
    - jobs.batch
  podDisruptive: true
  schematic:
    cue:
      template: |
        patch: spec: template: spec: securityContext: {
        	if parameter.appArmorProfile != _|_ {
        		appArmorProfile: parameter.appArmorProfile
        	}
        	if parameter.fsGroup != _|_ {
        		fsGroup: parameter.fsGroup
        	}
        	if parameter.runAsGroup != _|_ {
        		runAsGroup: parameter.runAsGroup
        	}
        	if parameter.runAsUser != _|_ {
        		runAsUser: parameter.runAsUser
        	}
        	if parameter.seccompProfile != _|_ {
        		seccompProfile: parameter.seccompProfile
        	}
        	runAsNonRoot: parameter.runAsNonRoot
        }

        parameter: {
        	// +usage=Specify the AppArmor profile for the pod
        	appArmorProfile?: {
        		type: "RuntimeDefault" | "Unconfined" | "Localhost"
        		// +usage:  localhostProfile is required when type is 'Localhost'
        		localhostProfile?: string
        	}
        	fsGroup?:    int
        	runAsGroup?: int
        	// +usage=Specify the UID to run the entrypoint of the container process
        	runAsUser?: int
        	// +usage=Specify if the container runs as a non-root user
        	runAsNonRoot: *true | bool
        	// +usage=Specify the seccomp profile for the pod
        	seccompProfile?: {
        		type: "RuntimeDefault" | "Unconfined" | "Localhost"
        		// +usage:  localhostProfile is required when type is 'Localhost'
        		localhostProfile?: string
        	}
        }

