psp_windows.yaml

apiVersion: policy/v1beta1
kind: PodSecurityPolicy
metadata:
  name: csi-gce-pd-node-psp-win
spec:
  supplementalGroups:
    rule: RunAsAny
  runAsUser:
    rule: RunAsAny
  fsGroup:
    rule: RunAsAny
  seLinux:
    rule: RunAsAny
  volumes:
  - '*'
  hostNetwork: true
  allowedHostPaths:
  - pathPrefix: \var\lib\kubelet
  - pathPrefix: \var\lib\kubelet\plugins_registry
  - pathPrefix: \var\lib\kubelet\plugins\pd.csi.storage.gke.io
  - pathPrefix: \\.\pipe\csi-proxy-disk-v1
  - pathPrefix: \\.\pipe\csi-proxy-volume-v1
  - pathPrefix: \\.\pipe\csi-proxy-filesystem-v1
  # these paths are allowed only for compatibility mode if the PD CSI driver
  # is using the CSI Proxy v1 client and the node is still using the
  # beta version of the CSI proxy
  - pathPrefix: \\.\pipe\csi-proxy-disk-v1beta2
  - pathPrefix: \\.\pipe\csi-proxy-volume-v1beta1
  - pathPrefix: \\.\pipe\csi-proxy-filesystem-v1beta1