{
  "$schema": "http://json-schema.org/schema#", 
  "required": [
    "seLinux", 
    "runAsUser", 
    "supplementalGroups", 
    "fsGroup"
  ], 
  "type": "object", 
  "description": "Pod Security Policy Spec defines the policy enforced.", 
  "properties": {
    "allowedCapabilities": {
      "items": {
        "type": [
          "string", 
          "null"
        ]
      }, 
      "type": [
        "array", 
        "null"
      ], 
      "description": "AllowedCapabilities is a list of capabilities that can be requested to add to the container. Capabilities in this field may be added at the pod author's discretion. You must not list a capability in both AllowedCapabilities and RequiredDropCapabilities."
    }, 
    "runAsUser": {
      "description": "runAsUser is the strategy that will dictate the allowable RunAsUser values that may be set.", 
      "$ref": "_definitions.json#/definitions/io.k8s.kubernetes.pkg.apis.extensions.v1beta1.RunAsUserStrategyOptions"
    }, 
    "supplementalGroups": {
      "description": "SupplementalGroups is the strategy that will dictate what supplemental groups are used by the SecurityContext.", 
      "$ref": "_definitions.json#/definitions/io.k8s.kubernetes.pkg.apis.extensions.v1beta1.SupplementalGroupsStrategyOptions"
    }, 
    "fsGroup": {
      "description": "FSGroup is the strategy that will dictate what fs group is used by the SecurityContext.", 
      "$ref": "_definitions.json#/definitions/io.k8s.kubernetes.pkg.apis.extensions.v1beta1.FSGroupStrategyOptions"
    }, 
    "hostNetwork": {
      "type": "boolean", 
      "description": "hostNetwork determines if the policy allows the use of HostNetwork in the pod spec."
    }, 
    "hostPorts": {
      "items": {
        "$ref": "_definitions.json#/definitions/io.k8s.kubernetes.pkg.apis.extensions.v1beta1.HostPortRange"
      }, 
      "type": [
        "array", 
        "null"
      ], 
      "description": "hostPorts determines which host port ranges are allowed to be exposed."
    }, 
    "seLinux": {
      "description": "seLinux is the strategy that will dictate the allowable labels that may be set.", 
      "$ref": "_definitions.json#/definitions/io.k8s.kubernetes.pkg.apis.extensions.v1beta1.SELinuxStrategyOptions"
    }, 
    "volumes": {
      "items": {
        "type": [
          "string", 
          "null"
        ]
      }, 
      "type": [
        "array", 
        "null"
      ], 
      "description": "volumes is a white list of allowed volume plugins.  Empty indicates that all plugins may be used."
    }, 
    "hostIPC": {
      "type": "boolean", 
      "description": "hostIPC determines if the policy allows the use of HostIPC in the pod spec."
    }, 
    "defaultAddCapabilities": {
      "items": {
        "type": [
          "string", 
          "null"
        ]
      }, 
      "type": [
        "array", 
        "null"
      ], 
      "description": "DefaultAddCapabilities is the default set of capabilities that will be added to the container unless the pod spec specifically drops the capability.  You may not list a capabiility in both DefaultAddCapabilities and RequiredDropCapabilities."
    }, 
    "requiredDropCapabilities": {
      "items": {
        "type": [
          "string", 
          "null"
        ]
      }, 
      "type": [
        "array", 
        "null"
      ], 
      "description": "RequiredDropCapabilities are the capabilities that will be dropped from the container.  These are required to be dropped and cannot be added."
    }, 
    "readOnlyRootFilesystem": {
      "type": "boolean", 
      "description": "ReadOnlyRootFilesystem when set to true will force containers to run with a read only root file system.  If the container specifically requests to run with a non-read only root file system the PSP should deny the pod. If set to false the container may run with a read only root file system if it wishes but it will not be forced to."
    }, 
    "privileged": {
      "type": "boolean", 
      "description": "privileged determines if a pod can request to be run as privileged."
    }, 
    "hostPID": {
      "type": "boolean", 
      "description": "hostPID determines if the policy allows the use of HostPID in the pod spec."
    }
  }
}