3b016841da
* Add support for SPIRE deployment on OpenShift 4.13 Signed-off-by: Mariusz Sabath <[email protected]> Co-authored-by: Trilok Geer <[email protected]> Co-authored-by: Andrew Block <[email protected]> * Render README Signed-off-by: Mariusz Sabath <[email protected]> * Fix tornjak HTTP/HTTPS port values Signed-off-by: Mariusz Sabath <[email protected]> * Update Frontend README Signed-off-by: Mariusz Sabath <[email protected]> * Add env. variable to Agent to inject node name Signed-off-by: Mariusz Sabath <[email protected]> * Implement Marco's suggestion on CSI CSS version Signed-off-by: Mariusz Sabath <[email protected]> * Add MY_NODE_NAME env. variable to agent for openshift example Signed-off-by: Mariusz Sabath <[email protected]> * Move Openshift examples to dedicated directory Signed-off-by: Mariusz Sabath <[email protected]> * Simplified the install instructions Signed-off-by: Mariusz Sabath <[email protected]> * Suggested changes Signed-off-by: Kevin Fox <[email protected]> * Apply suggestions from code review Co-authored-by: Andrew Block <[email protected]> Signed-off-by: kfox1111 <[email protected]> * Update docs, fix default for backwards compat Signed-off-by: Kevin Fox <[email protected]> * Don't recommend experimental features by default, dont debug helm install by default and explain how to add additional features Signed-off-by: Kevin Fox <[email protected]> * Add notes about openshift to the project for other reviewers. Signed-off-by: Kevin Fox <[email protected]> * Fix incorrectly reverted change Signed-off-by: Kevin Fox <[email protected]> * Correct notes Signed-off-by: Kevin Fox <[email protected]> * Update default Signed-off-by: Kevin Fox <[email protected]> * Fix issue created from bad merge conflict resolution Signed-off-by: kfox1111 <[email protected]> * Update examples/openshift/openshift-values.yaml Co-authored-by: kfox1111 <[email protected]> Signed-off-by: Mariusz Sabath <[email protected]> * Update examples/openshift/openshift-values.yaml Co-authored-by: kfox1111 <[email protected]> Signed-off-by: Mariusz Sabath <[email protected]> * Update examples/openshift/openshift-values.yaml Co-authored-by: kfox1111 <[email protected]> Signed-off-by: Mariusz Sabath <[email protected]> * Update examples/openshift/openshift-values.yaml Co-authored-by: kfox1111 <[email protected]> Signed-off-by: Mariusz Sabath <[email protected]> --------- Signed-off-by: Mariusz Sabath <[email protected]> Signed-off-by: Kevin Fox <[email protected]> Signed-off-by: kfox1111 <[email protected]> Co-authored-by: Trilok Geer <[email protected]> Co-authored-by: Andrew Block <[email protected]> Co-authored-by: Kevin Fox <[email protected]>
62 lines
2.0 KiB
YAML
62 lines
2.0 KiB
YAML
{{- if and .Values.global.openshift .Values.restrictedScc.enabled }}
|
|
{{- $name := default (printf "restricted-%scsi" (eq (.Values.restrictedScc.version | toString) "2" | ternary "v2-" "")) .Values.restrictedScc.name -}}
|
|
{{- $v2Description := "This is the most restrictive SCC and it is used by default for authenticated users. On top of the legacy 'restricted' SCC, it also requires to drop ALL capabilities and does not allow privilege escalation binaries. It will also default the seccomp profile to runtime/default if unset, otherwise this seccomp profile is required." -}}
|
|
apiVersion: security.openshift.io/v1
|
|
kind: SecurityContextConstraints
|
|
allowHostPorts: false
|
|
priority: null
|
|
requiredDropCapabilities:
|
|
{{- if eq (.Values.restrictedScc.version | toString) "2" }}
|
|
- ALL
|
|
{{- else }}
|
|
- KILL
|
|
- MKNOD
|
|
- SETUID
|
|
- SETGID
|
|
{{- end }}
|
|
allowPrivilegedContainer: false
|
|
runAsUser:
|
|
type: MustRunAsRange
|
|
users: []
|
|
allowHostDirVolumePlugin: false
|
|
{{- if eq (.Values.restrictedScc.version | toString) "2" }}
|
|
seccompProfiles:
|
|
- runtime/default
|
|
{{- end }}
|
|
allowHostIPC: false
|
|
seLinuxContext:
|
|
type: MustRunAs
|
|
readOnlyRootFilesystem: false
|
|
metadata:
|
|
name: {{ $name }}
|
|
annotations:
|
|
kubernetes.io/description: >-
|
|
{{ $name }} denies access to all host features and requires pods to be
|
|
run with a UID, and SELinux context that are allocated to the namespace.
|
|
{{ eq (.Values.restrictedScc.version | toString) "2" | ternary $v2Description "" }}
|
|
fsGroup:
|
|
type: MustRunAs
|
|
groups: []
|
|
defaultAddCapabilities: null
|
|
supplementalGroups:
|
|
type: RunAsAny
|
|
volumes:
|
|
- configMap
|
|
- csi
|
|
- downwardAPI
|
|
- emptyDir
|
|
- ephemeral
|
|
- persistentVolumeClaim
|
|
- projected
|
|
- secret
|
|
allowHostPID: false
|
|
allowHostNetwork: false
|
|
allowPrivilegeEscalation: {{ eq (.Values.restrictedScc.version | toString) "2" | ternary false true }}
|
|
{{- if eq (.Values.restrictedScc.version | toString) "2" }}
|
|
allowedCapabilities:
|
|
- NET_BIND_SERVICE
|
|
{{ else}}
|
|
allowedCapabilities: null
|
|
{{- end }}
|
|
{{- end }}
|