Skip to content

Commit a517f5f

Browse files
authored
fix(helm): use same scc as olm (#573)
1 parent d5c1d09 commit a517f5f

File tree

1 file changed

+1
-45
lines changed

1 file changed

+1
-45
lines changed

deploy/helm/hdfs-operator/templates/roles.yaml

Lines changed: 1 addition & 45 deletions
Original file line numberDiff line numberDiff line change
@@ -141,50 +141,6 @@ rules:
141141
- bind
142142
resourceNames:
143143
- {{ include "operator.name" . }}-clusterrole
144-
{{ if .Capabilities.APIVersions.Has "security.openshift.io/v1" }}
145-
---
146-
apiVersion: security.openshift.io/v1
147-
kind: SecurityContextConstraints
148-
metadata:
149-
name: hdfs-scc
150-
labels:
151-
{{- include "operator.labels" . | nindent 4 }}
152-
annotations:
153-
kubernetes.io/description: |-
154-
This resource is derived from hostmount-anyuid. It provides all the features of the
155-
restricted SCC but allows host mounts and any UID by a pod. This is primarily
156-
used by the persistent volume recycler. WARNING: this SCC allows host file
157-
system access as any UID, including UID 0. Grant with caution.
158-
release.openshift.io/create-only: "true"
159-
allowHostDirVolumePlugin: true
160-
allowHostIPC: false
161-
allowHostNetwork: false
162-
allowHostPID: false
163-
allowHostPorts: false
164-
allowPrivilegeEscalation: true
165-
allowPrivilegedContainer: false
166-
allowedCapabilities: null
167-
defaultAddCapabilities: null
168-
fsGroup:
169-
type: RunAsAny
170-
readOnlyRootFilesystem: false
171-
runAsUser:
172-
type: RunAsAny
173-
seLinuxContext:
174-
type: MustRunAs
175-
supplementalGroups:
176-
type: RunAsAny
177-
volumes:
178-
- configMap
179-
- downwardAPI
180-
- emptyDir
181-
- hostPath
182-
- nfs
183-
- persistentVolumeClaim
184-
- projected
185-
- secret
186-
- ephemeral
187-
{{ end }}
188144
---
189145
apiVersion: rbac.authorization.k8s.io/v1
190146
kind: ClusterRole
@@ -220,7 +176,7 @@ rules:
220176
resources:
221177
- securitycontextconstraints
222178
resourceNames:
223-
- hdfs-scc
179+
- nonroot-v2
224180
verbs:
225181
- use
226182
{{ end }}

0 commit comments

Comments
 (0)