Pod Container

// A single application container that you want to run within a pod.
type Container struct {
    // Name of the container specified as a DNS_LABEL.
    // Each container in a pod must have a unique name (DNS_LABEL).
    // Cannot be updated.
    Name string `json:"name" protobuf:"bytes,1,opt,name=name"`
    // Docker image name.
    // More info: https://kubernetes.io/docs/concepts/containers/images
    // This field is optional to allow higher level config management to default or override
    // container images in workload controllers like Deployments and StatefulSets.
    // +optional
    Image string `json:"image,omitempty" protobuf:"bytes,2,opt,name=image"`
    // Entrypoint array. Not executed within a shell.
    // The docker image's ENTRYPOINT is used if this is not provided.
    // Variable references $(VAR_NAME) are expanded using the container's environment. If a variable
    // cannot be resolved, the reference in the input string will be unchanged. Double $$ are reduced
    // to a single $, which allows for escaping the $(VAR_NAME) syntax: i.e. "$$(VAR_NAME)" will
    // produce the string literal "$(VAR_NAME)". Escaped references will never be expanded, regardless
    // of whether the variable exists or not. Cannot be updated.
    // More info: https://kubernetes.io/docs/tasks/inject-data-application/define-command-argument-container/#running-a-command-in-a-shell
    // +optional
    Command []string `json:"command,omitempty" protobuf:"bytes,3,rep,name=command"`
    // Arguments to the entrypoint.
    // The docker image's CMD is used if this is not provided.
    // Variable references $(VAR_NAME) are expanded using the container's environment. If a variable
    // cannot be resolved, the reference in the input string will be unchanged. Double $$ are reduced
    // to a single $, which allows for escaping the $(VAR_NAME) syntax: i.e. "$$(VAR_NAME)" will
    // produce the string literal "$(VAR_NAME)". Escaped references will never be expanded, regardless
    // of whether the variable exists or not. Cannot be updated.
    // More info: https://kubernetes.io/docs/tasks/inject-data-application/define-command-argument-container/#running-a-command-in-a-shell
    // +optional
    Args []string `json:"args,omitempty" protobuf:"bytes,4,rep,name=args"`
    // Container's working directory.
    // If not specified, the container runtime's default will be used, which
    // might be configured in the container image.
    // Cannot be updated.
    // +optional
    WorkingDir string `json:"workingDir,omitempty" protobuf:"bytes,5,opt,name=workingDir"`
    // List of ports to expose from the container. Exposing a port here gives
    // the system additional information about the network connections a
    // container uses, but is primarily informational. Not specifying a port here
    // DOES NOT prevent that port from being exposed. Any port which is
    // listening on the default "0.0.0.0" address inside a container will be
    // accessible from the network.
    // Cannot be updated.
    // +optional
    // +patchMergeKey=containerPort
    // +patchStrategy=merge
    // +listType=map
    // +listMapKey=containerPort
    // +listMapKey=protocol
    Ports []ContainerPort `json:"ports,omitempty" patchStrategy:"merge" patchMergeKey:"containerPort" protobuf:"bytes,6,rep,name=ports"`
    // List of sources to populate environment variables in the container.
    // The keys defined within a source must be a C_IDENTIFIER. All invalid keys
    // will be reported as an event when the container is starting. When a key exists in multiple
    // sources, the value associated with the last source will take precedence.
    // Values defined by an Env with a duplicate key will take precedence.
    // Cannot be updated.
    // +optional
    EnvFrom []EnvFromSource `json:"envFrom,omitempty" protobuf:"bytes,19,rep,name=envFrom"`
    // List of environment variables to set in the container.
    // Cannot be updated.
    // +optional
    // +patchMergeKey=name
    // +patchStrategy=merge
    Env []EnvVar `json:"env,omitempty" patchStrategy:"merge" patchMergeKey:"name" protobuf:"bytes,7,rep,name=env"`
    // Compute Resources required by this container.
    // Cannot be updated.
    // More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
    // +optional
    Resources ResourceRequirements `json:"resources,omitempty" protobuf:"bytes,8,opt,name=resources"`
    // Pod volumes to mount into the container's filesystem.
    // Cannot be updated.
    // +optional
    // +patchMergeKey=mountPath
    // +patchStrategy=merge
    VolumeMounts []VolumeMount `json:"volumeMounts,omitempty" patchStrategy:"merge" patchMergeKey:"mountPath" protobuf:"bytes,9,rep,name=volumeMounts"`
    // volumeDevices is the list of block devices to be used by the container.
    // +patchMergeKey=devicePath
    // +patchStrategy=merge
    // +optional
    VolumeDevices []VolumeDevice `json:"volumeDevices,omitempty" patchStrategy:"merge" patchMergeKey:"devicePath" protobuf:"bytes,21,rep,name=volumeDevices"`

    // Periodic probe of container liveness.
    // Container will be restarted if the probe fails.
    // Cannot be updated.
    // More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes
    // +optional
    // 存活探测，如果探测失败，则容器会被重启
    LivenessProbe *Probe `json:"livenessProbe,omitempty" protobuf:"bytes,10,opt,name=livenessProbe"`

    // Periodic probe of container service readiness.
    // Container will be removed from service endpoints if the probe fails.
    // Cannot be updated.
    // More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes
    // +optional
    // 可用探测，如果探测失败，则会把地址从 ipvs 移除
    ReadinessProbe *Probe `json:"readinessProbe,omitempty" protobuf:"bytes,11,opt,name=readinessProbe"`

    // StartupProbe indicates that the Pod has successfully initialized.
    // If specified, no other probes are executed until this completes successfully.
    // If this probe fails, the Pod will be restarted, just as if the livenessProbe failed.
    // This can be used to provide different probe parameters at the beginning of a Pod's lifecycle,
    // when it might take a long time to load data or warm a cache, than during steady-state operation.
    // This cannot be updated.
    // More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes
    // +optional
    // 启动探测，成功之后才会继续执行 LivenessProbe 与 ReadinessProbe 探测
    StartupProbe *Probe `json:"startupProbe,omitempty" protobuf:"bytes,22,opt,name=startupProbe"`

    // Actions that the management system should take in response to container lifecycle events.
    // Cannot be updated.
    // +optional
    Lifecycle *Lifecycle `json:"lifecycle,omitempty" protobuf:"bytes,12,opt,name=lifecycle"`
    // Optional: Path at which the file to which the container's termination message
    // will be written is mounted into the container's filesystem.
    // Message written is intended to be brief final status, such as an assertion failure message.
    // Will be truncated by the node if greater than 4096 bytes. The total message length across
    // all containers will be limited to 12kb.
    // Defaults to /dev/termination-log.
    // Cannot be updated.
    // +optional
    TerminationMessagePath string `json:"terminationMessagePath,omitempty" protobuf:"bytes,13,opt,name=terminationMessagePath"`
    // Indicate how the termination message should be populated. File will use the contents of
    // terminationMessagePath to populate the container status message on both success and failure.
    // FallbackToLogsOnError will use the last chunk of container log output if the termination
    // message file is empty and the container exited with an error.
    // The log output is limited to 2048 bytes or 80 lines, whichever is smaller.
    // Defaults to File.
    // Cannot be updated.
    // +optional
    TerminationMessagePolicy TerminationMessagePolicy `json:"terminationMessagePolicy,omitempty" protobuf:"bytes,20,opt,name=terminationMessagePolicy,casttype=TerminationMessagePolicy"`
    // Image pull policy.
    // One of Always, Never, IfNotPresent.
    // Defaults to Always if :latest tag is specified, or IfNotPresent otherwise.
    // Cannot be updated.
    // More info: https://kubernetes.io/docs/concepts/containers/images#updating-images
    // +optional
    ImagePullPolicy PullPolicy `json:"imagePullPolicy,omitempty" protobuf:"bytes,14,opt,name=imagePullPolicy,casttype=PullPolicy"`
    // SecurityContext defines the security options the container should be run with.
    // If set, the fields of SecurityContext override the equivalent fields of PodSecurityContext.
    // More info: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/
    // +optional
    SecurityContext *SecurityContext `json:"securityContext,omitempty" protobuf:"bytes,15,opt,name=securityContext"`
    // Variables for interactive containers, these have very specialized use-cases (e.g. debugging)
    // and shouldn't be used for general purpose containers.
    // Whether this container should allocate a buffer for stdin in the container runtime. If this
    // is not set, reads from stdin in the container will always result in EOF.
    // Default is false.
    // +optional
    Stdin bool `json:"stdin,omitempty" protobuf:"varint,16,opt,name=stdin"`
    // Whether the container runtime should close the stdin channel after it has been opened by
    // a single attach. When stdin is true the stdin stream will remain open across multiple attach
    // sessions. If stdinOnce is set to true, stdin is opened on container start, is empty until the
    // first client attaches to stdin, and then remains open and accepts data until the client disconnects,
    // at which time stdin is closed and remains closed until the container is restarted. If this
    // flag is false, a container processes that reads from stdin will never receive an EOF.
    // Default is false
    // +optional
    StdinOnce bool `json:"stdinOnce,omitempty" protobuf:"varint,17,opt,name=stdinOnce"`
    // Whether this container should allocate a TTY for itself, also requires 'stdin' to be true.
    // Default is false.
    // +optional
    TTY bool `json:"tty,omitempty" protobuf:"varint,18,opt,name=tty"`
}

// ContainerPort represents a network port in a single container.
type ContainerPort struct {
    // If specified, this must be an IANA_SVC_NAME and unique within the pod. Each
    // named port in a pod must have a unique name. Name for the port that can be
    // referred to by services.
    // +optional
    Name string `json:"name,omitempty" protobuf:"bytes,1,opt,name=name"`
    // Number of port to expose on the host.
    // If specified, this must be a valid port number, 0 < x < 65536.
    // If HostNetwork is specified, this must match ContainerPort.
    // Most containers do not need this.
    // +optional
    HostPort int32 `json:"hostPort,omitempty" protobuf:"varint,2,opt,name=hostPort"`
    // Number of port to expose on the pod's IP address.
    // This must be a valid port number, 0 < x < 65536.
    ContainerPort int32 `json:"containerPort" protobuf:"varint,3,opt,name=containerPort"`
    // Protocol for port. Must be UDP, TCP, or SCTP.
    // Defaults to "TCP".
    // +optional
    // +default="TCP"
    Protocol Protocol `json:"protocol,omitempty" protobuf:"bytes,4,opt,name=protocol,casttype=Protocol"`
    // What host IP to bind the external port to.
    // +optional
    HostIP string `json:"hostIP,omitempty" protobuf:"bytes,5,opt,name=hostIP"`
}

// EnvFromSource represents the source of a set of ConfigMaps
type EnvFromSource struct {
    // An optional identifier to prepend to each key in the ConfigMap. Must be a C_IDENTIFIER.
    // +optional
    Prefix string `json:"prefix,omitempty" protobuf:"bytes,1,opt,name=prefix"`
    // The ConfigMap to select from
    // +optional
    ConfigMapRef *ConfigMapEnvSource `json:"configMapRef,omitempty" protobuf:"bytes,2,opt,name=configMapRef"`
    // The Secret to select from
    // +optional
    SecretRef *SecretEnvSource `json:"secretRef,omitempty" protobuf:"bytes,3,opt,name=secretRef"`
}

// EnvVar represents an environment variable present in a Container.
type EnvVar struct {
    // Name of the environment variable. Must be a C_IDENTIFIER.
    Name string `json:"name" protobuf:"bytes,1,opt,name=name"`

    // Optional: no more than one of the following may be specified.

    // Variable references $(VAR_NAME) are expanded
    // using the previously defined environment variables in the container and
    // any service environment variables. If a variable cannot be resolved,
    // the reference in the input string will be unchanged. Double $$ are reduced
    // to a single $, which allows for escaping the $(VAR_NAME) syntax: i.e.
    // "$$(VAR_NAME)" will produce the string literal "$(VAR_NAME)".
    // Escaped references will never be expanded, regardless of whether the variable
    // exists or not.
    // Defaults to "".
    // +optional
    Value string `json:"value,omitempty" protobuf:"bytes,2,opt,name=value"`
    // Source for the environment variable's value. Cannot be used if value is not empty.
    // +optional
    ValueFrom *EnvVarSource `json:"valueFrom,omitempty" protobuf:"bytes,3,opt,name=valueFrom"`
}

// ResourceRequirements describes the compute resource requirements.
type ResourceRequirements struct {
    // Limits describes the maximum amount of compute resources allowed.
    // More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
    // +optional
    Limits ResourceList `json:"limits,omitempty" protobuf:"bytes,1,rep,name=limits,casttype=ResourceList,castkey=ResourceName"`
    // Requests describes the minimum amount of compute resources required.
    // If Requests is omitted for a container, it defaults to Limits if that is explicitly specified,
    // otherwise to an implementation-defined value.
    // More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
    // +optional
    Requests ResourceList `json:"requests,omitempty" protobuf:"bytes,2,rep,name=requests,casttype=ResourceList,castkey=ResourceName"`
}

// VolumeMount describes a mounting of a Volume within a container.
type VolumeMount struct {
    // This must match the Name of a Volume.
    Name string `json:"name" protobuf:"bytes,1,opt,name=name"`
    // Mounted read-only if true, read-write otherwise (false or unspecified).
    // Defaults to false.
    // +optional
    ReadOnly bool `json:"readOnly,omitempty" protobuf:"varint,2,opt,name=readOnly"`
    // Path within the container at which the volume should be mounted.  Must
    // not contain ':'.
    MountPath string `json:"mountPath" protobuf:"bytes,3,opt,name=mountPath"`
    // Path within the volume from which the container's volume should be mounted.
    // Defaults to "" (volume's root).
    // +optional
    SubPath string `json:"subPath,omitempty" protobuf:"bytes,4,opt,name=subPath"`
    // mountPropagation determines how mounts are propagated from the host
    // to container and the other way around.
    // When not set, MountPropagationNone is used.
    // This field is beta in 1.10.
    // +optional
    MountPropagation *MountPropagationMode `json:"mountPropagation,omitempty" protobuf:"bytes,5,opt,name=mountPropagation,casttype=MountPropagationMode"`
    // Expanded path within the volume from which the container's volume should be mounted.
    // Behaves similarly to SubPath but environment variable references $(VAR_NAME) are expanded using the container's environment.
    // Defaults to "" (volume's root).
    // SubPathExpr and SubPath are mutually exclusive.
    // +optional
    SubPathExpr string `json:"subPathExpr,omitempty" protobuf:"bytes,6,opt,name=subPathExpr"`
}

// volumeDevice describes a mapping of a raw block device within a container.
type VolumeDevice struct {
    // name must match the name of a persistentVolumeClaim in the pod
    Name string `json:"name" protobuf:"bytes,1,opt,name=name"`
    // devicePath is the path inside of the container that the device will be mapped to.
    DevicePath string `json:"devicePath" protobuf:"bytes,2,opt,name=devicePath"`
}

// Probe describes a health check to be performed against a container to determine whether it is
// alive or ready to receive traffic.
type Probe struct {
    // The action taken to determine the health of a container
    Handler `json:",inline" protobuf:"bytes,1,opt,name=handler"`
    // Number of seconds after the container has started before liveness probes are initiated.
    // More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes
    // +optional
    InitialDelaySeconds int32 `json:"initialDelaySeconds,omitempty" protobuf:"varint,2,opt,name=initialDelaySeconds"`
    // Number of seconds after which the probe times out.
    // Defaults to 1 second. Minimum value is 1.
    // More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes
    // +optional
    TimeoutSeconds int32 `json:"timeoutSeconds,omitempty" protobuf:"varint,3,opt,name=timeoutSeconds"`
    // How often (in seconds) to perform the probe.
    // Default to 10 seconds. Minimum value is 1.
    // +optional
    PeriodSeconds int32 `json:"periodSeconds,omitempty" protobuf:"varint,4,opt,name=periodSeconds"`
    // Minimum consecutive successes for the probe to be considered successful after having failed.
    // Defaults to 1. Must be 1 for liveness and startup. Minimum value is 1.
    // +optional
    SuccessThreshold int32 `json:"successThreshold,omitempty" protobuf:"varint,5,opt,name=successThreshold"`
    // Minimum consecutive failures for the probe to be considered failed after having succeeded.
    // Defaults to 3. Minimum value is 1.
    // +optional
    FailureThreshold int32 `json:"failureThreshold,omitempty" protobuf:"varint,6,opt,name=failureThreshold"`
    // Optional duration in seconds the pod needs to terminate gracefully upon probe failure.
    // The grace period is the duration in seconds after the processes running in the pod are sent
    // a termination signal and the time when the processes are forcibly halted with a kill signal.
    // Set this value longer than the expected cleanup time for your process.
    // If this value is nil, the pod's terminationGracePeriodSeconds will be used. Otherwise, this
    // value overrides the value provided by the pod spec.
    // Value must be non-negative integer. The value zero indicates stop immediately via
    // the kill signal (no opportunity to shut down).
    // This is a beta field and requires enabling ProbeTerminationGracePeriod feature gate.
    // Minimum value is 1. spec.terminationGracePeriodSeconds is used if unset.
    // +optional
    TerminationGracePeriodSeconds *int64 `json:"terminationGracePeriodSeconds,omitempty" protobuf:"varint,7,opt,name=terminationGracePeriodSeconds"`
}

// Handler defines a specific action that should be taken
// TODO: pass structured data to these actions, and document that data here.
type Handler struct {
    // One and only one of the following should be specified.
    // Exec specifies the action to take.
    // +optional
    Exec *ExecAction `json:"exec,omitempty" protobuf:"bytes,1,opt,name=exec"`
    // HTTPGet specifies the http request to perform.
    // +optional
    HTTPGet *HTTPGetAction `json:"httpGet,omitempty" protobuf:"bytes,2,opt,name=httpGet"`
    // TCPSocket specifies an action involving a TCP port.
    // TCP hooks not yet supported
    // TODO: implement a realistic TCP lifecycle hook
    // +optional
    TCPSocket *TCPSocketAction `json:"tcpSocket,omitempty" protobuf:"bytes,3,opt,name=tcpSocket"`
}

// TCPSocketAction describes an action based on opening a socket
type TCPSocketAction struct {
    // Number or name of the port to access on the container.
    // Number must be in the range 1 to 65535.
    // Name must be an IANA_SVC_NAME.
    Port intstr.IntOrString `json:"port" protobuf:"bytes,1,opt,name=port"`
    // Optional: Host name to connect to, defaults to the pod IP.
    // +optional
    Host string `json:"host,omitempty" protobuf:"bytes,2,opt,name=host"`
}

// ExecAction describes a "run in container" action.
type ExecAction struct {
    // Command is the command line to execute inside the container, the working directory for the
    // command  is root ('/') in the container's filesystem. The command is simply exec'd, it is
    // not run inside a shell, so traditional shell instructions ('|', etc) won't work. To use
    // a shell, you need to explicitly call out to that shell.
    // Exit status of 0 is treated as live/healthy and non-zero is unhealthy.
    // +optional
    Command []string `json:"command,omitempty" protobuf:"bytes,1,rep,name=command"`
}

// HTTPHeader describes a custom header to be used in HTTP probes
type HTTPHeader struct {
    // The header field name
    Name string `json:"name" protobuf:"bytes,1,opt,name=name"`
    // The header field value
    Value string `json:"value" protobuf:"bytes,2,opt,name=value"`
}

// URIScheme identifies the scheme used for connection to a host for Get actions
type URIScheme string

const (
    // URISchemeHTTP means that the scheme used will be http://
    URISchemeHTTP URIScheme = "HTTP"
    // URISchemeHTTPS means that the scheme used will be https://
    URISchemeHTTPS URIScheme = "HTTPS"
)

// HTTPGetAction describes an action based on HTTP Get requests.
type HTTPGetAction struct {
    // Path to access on the HTTP server.
    // +optional
    Path string `json:"path,omitempty" protobuf:"bytes,1,opt,name=path"`
    // Name or number of the port to access on the container.
    // Number must be in the range 1 to 65535.
    // Name must be an IANA_SVC_NAME.
    Port intstr.IntOrString `json:"port" protobuf:"bytes,2,opt,name=port"`
    // Host name to connect to, defaults to the pod IP. You probably want to set
    // "Host" in httpHeaders instead.
    // +optional
    Host string `json:"host,omitempty" protobuf:"bytes,3,opt,name=host"`
    // Scheme to use for connecting to the host.
    // Defaults to HTTP.
    // +optional
    Scheme URIScheme `json:"scheme,omitempty" protobuf:"bytes,4,opt,name=scheme,casttype=URIScheme"`
    // Custom headers to set in the request. HTTP allows repeated headers.
    // +optional
    HTTPHeaders []HTTPHeader `json:"httpHeaders,omitempty" protobuf:"bytes,5,rep,name=httpHeaders"`
}

// Lifecycle describes actions that the management system should take in response to container lifecycle
// events. For the PostStart and PreStop lifecycle handlers, management of the container blocks
// until the action is complete, unless the container process fails, in which case the handler is aborted.
type Lifecycle struct {
    // PostStart is called immediately after a container is created. If the handler fails,
    // the container is terminated and restarted according to its restart policy.
    // Other management of the container blocks until the hook completes.
    // More info: https://kubernetes.io/docs/concepts/containers/container-lifecycle-hooks/#container-hooks
    // +optional
    PostStart *Handler `json:"postStart,omitempty" protobuf:"bytes,1,opt,name=postStart"`
    // PreStop is called immediately before a container is terminated due to an
    // API request or management event such as liveness/startup probe failure,
    // preemption, resource contention, etc. The handler is not called if the
    // container crashes or exits. The reason for termination is passed to the
    // handler. The Pod's termination grace period countdown begins before the
    // PreStop hooked is executed. Regardless of the outcome of the handler, the
    // container will eventually terminate within the Pod's termination grace
    // period. Other management of the container blocks until the hook completes
    // or until the termination grace period is reached.
    // More info: https://kubernetes.io/docs/concepts/containers/container-lifecycle-hooks/#container-hooks
    // +optional
    PreStop *Handler `json:"preStop,omitempty" protobuf:"bytes,2,opt,name=preStop"`
}

// TerminationMessagePolicy describes how termination messages are retrieved from a container.
type TerminationMessagePolicy string

const (
    // TerminationMessageReadFile is the default behavior and will set the container status message to
    // the contents of the container's terminationMessagePath when the container exits.
    TerminationMessageReadFile TerminationMessagePolicy = "File"
    // TerminationMessageFallbackToLogsOnError will read the most recent contents of the container logs
    // for the container status message when the container exits with an error and the
    // terminationMessagePath has no contents.
    TerminationMessageFallbackToLogsOnError TerminationMessagePolicy = "FallbackToLogsOnError"
)

// PullPolicy describes a policy for if/when to pull a container image
type PullPolicy string

const (
    // PullAlways means that kubelet always attempts to pull the latest image. Container will fail If the pull fails.
    PullAlways PullPolicy = "Always"
    // PullNever means that kubelet never pulls an image, but only uses a local image. Container will fail if the image isn't present
    PullNever PullPolicy = "Never"
    // PullIfNotPresent means that kubelet pulls if the image isn't present on disk. Container will fail if the image isn't present and the pull fails.
    PullIfNotPresent PullPolicy = "IfNotPresent"
)

// SecurityContext holds security configuration that will be applied to a container.
// Some fields are present in both SecurityContext and PodSecurityContext.  When both
// are set, the values in SecurityContext take precedence.
type SecurityContext struct {
    // The capabilities to add/drop when running containers.
    // Defaults to the default set of capabilities granted by the container runtime.
    // +optional
    Capabilities *Capabilities `json:"capabilities,omitempty" protobuf:"bytes,1,opt,name=capabilities"`
    // Run container in privileged mode.
    // Processes in privileged containers are essentially equivalent to root on the host.
    // Defaults to false.
    // +optional
    Privileged *bool `json:"privileged,omitempty" protobuf:"varint,2,opt,name=privileged"`
    // The SELinux context to be applied to the container.
    // If unspecified, the container runtime will allocate a random SELinux context for each
    // container.  May also be set in PodSecurityContext.  If set in both SecurityContext and
    // PodSecurityContext, the value specified in SecurityContext takes precedence.
    // +optional
    SELinuxOptions *SELinuxOptions `json:"seLinuxOptions,omitempty" protobuf:"bytes,3,opt,name=seLinuxOptions"`
    // The Windows specific settings applied to all containers.
    // If unspecified, the options from the PodSecurityContext will be used.
    // If set in both SecurityContext and PodSecurityContext, the value specified in SecurityContext takes precedence.
    // +optional
    WindowsOptions *WindowsSecurityContextOptions `json:"windowsOptions,omitempty" protobuf:"bytes,10,opt,name=windowsOptions"`
    // The UID to run the entrypoint of the container process.
    // Defaults to user specified in image metadata if unspecified.
    // May also be set in PodSecurityContext.  If set in both SecurityContext and
    // PodSecurityContext, the value specified in SecurityContext takes precedence.
    // +optional
    RunAsUser *int64 `json:"runAsUser,omitempty" protobuf:"varint,4,opt,name=runAsUser"`
    // The GID to run the entrypoint of the container process.
    // Uses runtime default if unset.
    // May also be set in PodSecurityContext.  If set in both SecurityContext and
    // PodSecurityContext, the value specified in SecurityContext takes precedence.
    // +optional
    RunAsGroup *int64 `json:"runAsGroup,omitempty" protobuf:"varint,8,opt,name=runAsGroup"`
    // Indicates that the container must run as a non-root user.
    // If true, the Kubelet will validate the image at runtime to ensure that it
    // does not run as UID 0 (root) and fail to start the container if it does.
    // If unset or false, no such validation will be performed.
    // May also be set in PodSecurityContext.  If set in both SecurityContext and
    // PodSecurityContext, the value specified in SecurityContext takes precedence.
    // +optional
    RunAsNonRoot *bool `json:"runAsNonRoot,omitempty" protobuf:"varint,5,opt,name=runAsNonRoot"`
    // Whether this container has a read-only root filesystem.
    // Default is false.
    // +optional
    ReadOnlyRootFilesystem *bool `json:"readOnlyRootFilesystem,omitempty" protobuf:"varint,6,opt,name=readOnlyRootFilesystem"`
    // AllowPrivilegeEscalation controls whether a process can gain more
    // privileges than its parent process. This bool directly controls if
    // the no_new_privs flag will be set on the container process.
    // AllowPrivilegeEscalation is true always when the container is:
    // 1) run as Privileged
    // 2) has CAP_SYS_ADMIN
    // +optional
    AllowPrivilegeEscalation *bool `json:"allowPrivilegeEscalation,omitempty" protobuf:"varint,7,opt,name=allowPrivilegeEscalation"`
    // procMount denotes the type of proc mount to use for the containers.
    // The default is DefaultProcMount which uses the container runtime defaults for
    // readonly paths and masked paths.
    // This requires the ProcMountType feature flag to be enabled.
    // +optional
    ProcMount *ProcMountType `json:"procMount,omitempty" protobuf:"bytes,9,opt,name=procMount"`
    // The seccomp options to use by this container. If seccomp options are
    // provided at both the pod & container level, the container options
    // override the pod options.
    // +optional
    SeccompProfile *SeccompProfile `json:"seccompProfile,omitempty" protobuf:"bytes,11,opt,name=seccompProfile"`
}