Skip to content

Commit c19cdfe

Browse files
authored
fix(helm): use same scc as olm (#449)
1 parent da6f3f7 commit c19cdfe

File tree

1 file changed

+1
-47
lines changed

1 file changed

+1
-47
lines changed
Lines changed: 1 addition & 47 deletions
Original file line numberDiff line numberDiff line change
@@ -1,49 +1,3 @@
1-
{{ if .Capabilities.APIVersions.Has "security.openshift.io/v1" }}
2-
---
3-
apiVersion: security.openshift.io/v1
4-
kind: SecurityContextConstraints
5-
metadata:
6-
name: spark-k8s-scc
7-
labels:
8-
{{- include "operator.labels" . | nindent 4 }}
9-
annotations:
10-
kubernetes.io/description: |-
11-
This resource is derived from hostmount-anyuid. It provides all the features of the
12-
restricted SCC but allows host mounts and any UID by a pod. This is primarily
13-
used by the persistent volume recycler. WARNING: this SCC allows host file
14-
system access as any UID, including UID 0. Grant with caution.
15-
release.openshift.io/create-only: "true"
16-
allowHostDirVolumePlugin: true
17-
allowHostIPC: false
18-
allowHostNetwork: false
19-
allowHostPID: false
20-
allowHostPorts: false
21-
allowPrivilegeEscalation: true
22-
allowPrivilegedContainer: false
23-
allowedCapabilities: null
24-
defaultAddCapabilities: null
25-
fsGroup:
26-
type: RunAsAny
27-
groups: []
28-
priority: null
29-
readOnlyRootFilesystem: false
30-
runAsUser:
31-
type: RunAsAny
32-
seLinuxContext:
33-
type: MustRunAs
34-
supplementalGroups:
35-
type: RunAsAny
36-
volumes:
37-
- configMap
38-
- downwardAPI
39-
- emptyDir
40-
- hostPath
41-
- nfs
42-
- persistentVolumeClaim
43-
- projected
44-
- secret
45-
- ephemeral
46-
{{ end }}
471
---
482
apiVersion: rbac.authorization.k8s.io/v1
493
kind: ClusterRole
@@ -82,7 +36,7 @@ rules:
8236
resources:
8337
- securitycontextconstraints
8438
resourceNames:
85-
- spark-k8s-scc
39+
- nonroot-v2
8640
verbs:
8741
- use
8842
{{ end }}

0 commit comments

Comments
 (0)