rule: RunAsAny volumes: - emptyDir Hardening Guide v2.3.5 10 - secret - persistentVolumeClaim - downwardAPI - configMap - projected --- apiVersion: rbac.authorization supplementalGroups: rule: RunAsAny volumes: - emptyDir - secret - persistentVolumeClaim - downwardAPI - configMap - projected --- apiVersion: rbac

supplementalGroups: rule: RunAsAny volumes: - emptyDir - secret - persistentVolumeClaim - downwardAPI - configMap - projected --- apiVersion: rbac.authorization supplementalGroups: rule: RunAsAny volumes: - emptyDir - secret - persistentVolumeClaim - downwardAPI - configMap - projected --- apiVersion: rbac

supplementalGroups: rule: RunAsAny volumes: - emptyDir - secret - persistentVolumeClaim - downwardAPI - configMap - projected --- apiVersion: rbac.authorization supplementalGroups: rule: RunAsAny volumes: - emptyDir - secret - persistentVolumeClaim - downwardAPI - configMap - projected --- apiVersion: rbac.authorization

storage-vc-template templates: volumeClaimTemplates: - name: storage-vc-template persistentVolumeClaim: spec: accessModes: - ReadWriteOnce resources:

storage-vc-template templates: volumeClaimTemplates: - name: storage-vc-template persistentVolumeClaim: spec: accessModes: - ReadWriteOnce resources:

Pipeline / Stage / Task Dockerfile / Scripts Common Configuration ConfigMap/Secret Data Volume PVC Task Template Task created from template Tasks in same stage can run sequentially or in parallel environment variables image information - volumes Storage Service rbd / nfs / glisters pvc pvc pvc registry credential using secret - resources Memory / CPU / GPU Data cache CI/CD Examples

Domain Name MDM Meta Data Manager OVA Open Virtualization Appliance PV Persistent Volume PVC Persistent Volume Claim RKE SUSE Rancher Kubernetes Engine RMT Repository Mirroring Tool SAN Velero pod to backup metadata and stage to target storage in bare-metal environments. It performs PVC snapshot and metadata backup for a VMware cloud native storage. • PowerProtect: This namespace contains the PowerProtect namespace. • Get, List, and Watch for all the namespaces in the cluster and PV, PVC, storageclass, deployments, and pods in all the namespaces. Note: The admin-user service account

seLinux: rule: RunAsAny supplementalGroups: rule: RunAsAny volumes: - emptyDir - secret - persistentVolumeClaim - downwardAPI - configMap - projected --- apiVersion: rbac.authorization.k8s.io/v1 kind:

is assigned to a node. • nfs: mounts an existing NFS(Network File System) into a pod. • persistentVolumeClaim: mounts a PersistentVolume into a pod. Note: Please see the Security section of this document

is assigned to a node. • nfs: mounts an existing NFS(Network File System) into a pod. • persistentVolumeClaim: mounts a PersistentVolume into a pod. Note: Please see the Security section of this document