|
1 | 1 | {{ if .Capabilities.APIVersions.Has "security.openshift.io/v1" }}
|
2 | 2 | ---
|
3 |
| - apiVersion: security.openshift.io/v1 |
4 |
| - kind: SecurityContextConstraints |
5 |
| - metadata: |
6 |
| - name: stackable-secret-operator-scc |
7 |
| - annotations: |
8 |
| - kubernetes.io/description: SCC for Stackable secret operator |
9 |
| - allowHostDirVolumePlugin: true |
10 |
| - allowHostIPC: false |
11 |
| - allowHostNetwork: false |
12 |
| - allowHostPID: false |
13 |
| - allowHostPorts: false |
14 |
| - allowPrivilegeEscalation: true |
15 |
| - allowPrivilegedContainer: true # Needed because otherwise we get spec.template.spec.containers[0].volumeMounts.mountPropagation: Forbidden: Bidirectional mount propagation is available only to privileged containers |
16 |
| - allowedCapabilities: null |
17 |
| - defaultAddCapabilities: null |
18 |
| - fsGroup: |
19 |
| - type: RunAsAny |
20 |
| - groups: [] |
21 |
| - priority: null |
22 |
| - readOnlyRootFilesystem: false |
23 |
| - requiredDropCapabilities: |
24 |
| - - MKNOD |
25 |
| - runAsUser: |
26 |
| - type: RunAsAny |
27 |
| - seLinuxContext: |
28 |
| - type: MustRunAs |
29 |
| - supplementalGroups: |
30 |
| - type: RunAsAny |
31 |
| - users: [] |
32 |
| - volumes: |
33 |
| - - downwardAPI |
34 |
| - - projected |
35 |
| - - hostPath |
36 |
| - - emptyDir |
| 3 | +apiVersion: security.openshift.io/v1 |
| 4 | +kind: SecurityContextConstraints |
| 5 | +metadata: |
| 6 | + name: stackable-secret-operator-scc |
| 7 | + annotations: |
| 8 | + kubernetes.io/description: SCC for Stackable secret operator |
| 9 | +allowHostDirVolumePlugin: true |
| 10 | +allowHostIPC: false |
| 11 | +allowHostNetwork: false |
| 12 | +allowHostPID: false |
| 13 | +allowHostPorts: false |
| 14 | +allowPrivilegeEscalation: true |
| 15 | +allowPrivilegedContainer: true # Needed because otherwise we get spec.template.spec.containers[0].volumeMounts.mountPropagation: Forbidden: Bidirectional mount propagation is available only to privileged containers |
| 16 | +allowedCapabilities: null |
| 17 | +defaultAddCapabilities: null |
| 18 | +fsGroup: |
| 19 | + type: RunAsAny |
| 20 | +groups: [] |
| 21 | +priority: null |
| 22 | +readOnlyRootFilesystem: false |
| 23 | +requiredDropCapabilities: |
| 24 | +- MKNOD |
| 25 | +runAsUser: |
| 26 | + type: RunAsAny |
| 27 | +seLinuxContext: |
| 28 | + type: MustRunAs |
| 29 | +supplementalGroups: |
| 30 | + type: RunAsAny |
| 31 | +users: [] |
| 32 | +volumes: |
| 33 | +- downwardAPI |
| 34 | +- projected |
| 35 | +- hostPath |
| 36 | +- emptyDir |
37 | 37 | {{ end }}
|
38 | 38 | ---
|
39 | 39 | apiVersion: rbac.authorization.k8s.io/v1
|
|
0 commit comments