{{- if and .Values.querier.enabled .Values.querier.pspEnabled .Values.querier.rbac.create -}}
apiVersion: policy/v1beta1
kind: PodSecurityPolicy
metadata:
  name: {{ include "thanos.fullname" . }}-querier
  labels: {{- include "thanos.labels" . | nindent 4 }}
    app.kubernetes.io/component: querier
spec:
  fsGroup:
    rule: RunAsAny
  runAsUser:
    ranges:
    - max: 1001
      min: 1001
    rule: MustRunAs
  seLinux:
    rule: RunAsAny
  supplementalGroups:
    rule: RunAsAny
  volumes:
  - secret
{{- end -}}
