{{- if eq (include "mimir.rbac.usePodSecurityPolicy" .) "true" }}
apiVersion: policy/v1beta1
kind: PodSecurityPolicy
metadata:
  name: {{ include "mimir.resourceName" (dict "ctx" .) }}
  labels:
    {{- include "mimir.labels" (dict "ctx" .) | nindent 4 }}
  annotations:
    "seccomp.security.alpha.kubernetes.io/allowedProfileNames": {{ .Values.rbac.podSecurityPolicy.seccompProfile }}
spec:
  privileged: {{ .Values.rbac.podSecurityPolicy.privileged }}
  allowPrivilegeEscalation: {{ .Values.rbac.podSecurityPolicy.allowPrivilegeEscalation }}
  volumes:
    - 'configMap'
    - 'emptyDir'
    - 'persistentVolumeClaim'
    - 'secret'
    {{- range $volumes := .Values.rbac.podSecurityPolicy.additionalVolumes }}
    - '{{ $volumes }}'
    {{- end }}
  hostNetwork: {{ .Values.rbac.podSecurityPolicy.hostNetwork }}
  hostIPC: {{ .Values.rbac.podSecurityPolicy.hostIPC }}
  hostPID: {{ .Values.rbac.podSecurityPolicy.hostPID }}
  runAsUser:
    rule: {{ .Values.rbac.podSecurityPolicy.runAsUser.rule }}
  seLinux:
    rule: {{ .Values.rbac.podSecurityPolicy.seLinux.rule }}
  supplementalGroups:
    rule: {{ .Values.rbac.podSecurityPolicy.supplementalGroups.rule }}
    ranges:
    {{- range $range := .Values.rbac.podSecurityPolicy.supplementalGroups.ranges }}
    - min: {{ $range.min }}
      max: {{ $range.max }}
    {{- end }}
  fsGroup:
    rule: {{ .Values.rbac.podSecurityPolicy.fsGroup.rule }}
    ranges:
    {{- range $range := .Values.rbac.podSecurityPolicy.fsGroup.ranges }}
    - min: {{ $range.min }}
      max: {{ $range.max }}
    {{- end }}
  readOnlyRootFilesystem: {{ .Values.rbac.podSecurityPolicy.readOnlyRootFilesystem }}
  requiredDropCapabilities:
    - ALL
{{- end }}