{"type":"doc","content":[{"type":"heading","attrs":{"level":2},"content":[{"text":"What is Security Context?","type":"text"}]},{"type":"paragraph","content":[{"text":"A security context (SC), defined at the pod level, enables a deployer to specify a container’s permissions to access protected functions. When the pod creates the container, it configures the container to allow these permissions and block all others. The cluster will only deploy the pod if the permissions it requests are allowed by a corresponding Security Context Constraint (SCC).","type":"text"}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"What Can Be Configured in Security Context?","type":"text"}]},{"type":"paragraph","content":[{"text":"A security context defines privilege and access control settings for a Pod or Container. Security context settings include, but are not limited to:","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Discretionary Access Control","type":"text","marks":[{"type":"strong"}]},{"text":": Permission to access an object, like a file, based on user ID (UID) and group ID (GID).","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Security Enhanced Linux (SELinux)","type":"text","marks":[{"type":"strong"}]},{"text":": Objects are assigned security labels.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Running as privileged or unprivileged.","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Linux Capabilities","type":"text","marks":[{"type":"strong"}]},{"text":": Give a process some privileges, but not all the privileges of the root user.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"AppArmor","type":"text","marks":[{"type":"strong"}]},{"text":": Use program profiles to restrict the capabilities of individual programs.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Seccomp","type":"text","marks":[{"type":"strong"}]},{"text":": Filter a process's system calls.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"allowPrivilegeEscalation","type":"text","marks":[{"type":"strong"}]},{"text":": Controls whether a process can gain more privileges than its parent process. This boolean directly controls whether the ","type":"text"},{"text":"no_new_privs","type":"text","marks":[{"type":"code"}]},{"text":" flag gets set on the container process. ","type":"text"},{"text":"allowPrivilegeEscalation","type":"text","marks":[{"type":"code"}]},{"text":" is always true when the container:","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"is run as privileged, or","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"has ","type":"text"},{"text":"CAP_SYS_ADMIN","type":"text","marks":[{"type":"code"}]}]}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"readOnlyRootFilesystem","type":"text","marks":[{"type":"strong"}]},{"text":": Mounts the container's root filesystem as read-only.","type":"text"}]}]}]},{"type":"paragraph","content":[{"text":"For more security context parameters, please refer to the ","type":"text"},{"text":"Kubernetes documentation","type":"text","marks":[{"type":"link","attrs":{"href":"https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.30/#securitycontext-v1-core"}}]},{"text":".","type":"text"}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"What is Security Context Constraint (SCC)?","type":"text"}]},{"type":"paragraph","content":[{"text":"A security context constraint (SCC), defined at the cluster level, enables an administrator to control permissions for pods, permissions that manage containers’ access to protected Linux functions. Similarly to how role-based access control (RBAC) manages users’ access to a cluster’s resources, an SCC manages pods’ access to Linux functions. By default, a pod is assigned an SCC named ","type":"text"},{"text":"restricted","type":"text","marks":[{"type":"code"}]},{"text":" that blocks access to protected functions. For an application to access protected functions, the cluster must make an SCC that allows it to be available to the pod.","type":"text"},{"type":"hardBreak"},{"type":"hardBreak"},{"text":"How security context constraints works on Openshift? ","type":"text","marks":[{"type":"strong"}]},{"type":"hardBreak"}]},{"type":"mediaSingle","attrs":{"layout":"center","width":760,"widthType":"pixel"},"content":[{"type":"media","attrs":{"width":1440,"alt":"openshift_sa_zoomed.png","id":"e065fbbb-4b54-4c54-b503-05cfb3f1fe32","collection":"contentId-2515238931","type":"file","height":1090}}]},{"type":"paragraph","content":[{"text":" ","type":"text"}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"Default Security Context Constraints on OpenShift","type":"text"}]},{"type":"table","attrs":{"layout":"default","width":760.0,"localId":"04cf664f-2335-45d0-95cd-073ef6d2a095"},"content":[{"type":"tableRow","content":[{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"SCC","type":"text"}]}]},{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"Description","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"anyuid","type":"text","marks":[{"type":"strong"}]},{"text":" ","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"Provides all features of the restricted SCC, but allows users to run with any UID and any GID. ","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"hostaccess","type":"text","marks":[{"type":"strong"}]},{"text":" ","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"Allows access to all host namespaces but still requires pods to be run with a UID and SELinux context that are allocated to the namespace. This SCC allows host access to namespaces, file systems, and PIDs. Should only be used by trusted pods. Grant with caution. ","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"hostmount-anyuid","type":"text","marks":[{"type":"strong"}]},{"text":" ","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"Provides all the features of the restricted SCC, but allows host mounts and running as any UID and any GID on the system. This SCC allows host file system access as any UID, including UID 0. Grant with caution. ","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"hostnetwork","type":"text","marks":[{"type":"strong"}]},{"text":" ","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"Allows using host networking and host ports but still requires pods to be run with a UID and SELinux context that are allocated to the namespace. Use caution when providing access to hostnetwork on control plane hosts (master hosts). A workload that runs hostnetwork on a control plane host is effectively root on the cluster and must be trusted accordingly. ","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"node-exporter","type":"text","marks":[{"type":"strong"}]},{"text":" ","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"Used for the Prometheus node exporter. This SCC allows host file system access as any UID, including UID 0. Grant with caution. ","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"nonroot","type":"text","marks":[{"type":"strong"}]},{"text":" ","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"Provides all features of the restricted SCC, but allows users to run with any non-root UID. The user must specify the UID or it must be specified in the manifest of the container runtime. ","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"privileged","type":"text","marks":[{"type":"strong"}]},{"text":" ","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"Allows access to all privileged and host features and the ability to run as any user, any group, any FSGroup, and with any SELinux context. This is the most relaxed SCC and should be used only for cluster administration. Grant with caution. ","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"restricted","type":"text","marks":[{"type":"strong"}]},{"text":" ","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"Denies access to all host features and requires pods to be run with a UID and SELinux context that are allocated to the namespace. This is the most restrictive SCC provided by a new installation and will be used by default for authenticated users. ","type":"text"}]}]}]}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Privileges of Privileged SCC","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Users can run privileged pods.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Pods can mount host directories as volumes.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Pods can run as any user.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Pods can run with any MCS label.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Pods can use the host’s IPC namespace.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Pods can use the host’s PID namespace.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Pods can use any FSGroup.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Pods can use any supplemental group.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Pods can use any seccomp profiles.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Pods can request any capabilities.","type":"text"}]}]}]},{"type":"paragraph","content":[{"text":"Setting ","type":"text"},{"text":"privileged: true","type":"text","marks":[{"type":"code"}]},{"text":" in the pod specification does not necessarily select the privileged SCC. The SCC that has ","type":"text"},{"text":"allowPrivilegedContainer: true","type":"text","marks":[{"type":"code"}]},{"text":" and has the highest prioritization will be chosen if the user has the permissions to use it.","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Features of Restricted SCC","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Ensures that pods cannot run as privileged.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Ensures that pods cannot mount host directory volumes.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Requires that a pod is run as a user in a pre-allocated range of UIDs.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Requires that a pod is run with a pre-allocated MCS label.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Allows pods to use any FSGroup.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Allows pods to use any supplemental group.","type":"text"}]}]}]},{"type":"paragraph","content":[{"text":"The restricted SCC is the most restrictive of the SCCs that ship by default with the system. However, a custom SCC can be created to be even more restrictive, e.g., restricting ","type":"text"},{"text":"readOnlyRootFS","type":"text","marks":[{"type":"code"}]},{"text":" to true and ","type":"text"},{"text":"allowPrivilegeEscalation","type":"text","marks":[{"type":"code"}]},{"text":" to false.","type":"text"}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"Listing Security Context Constraints","type":"text"}]},{"type":"paragraph","content":[{"text":"To list the existing SCCs, use the following command:","type":"text"}]},{"type":"codeBlock","attrs":{"language":"sh"},"content":[{"text":"oc get scc","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Example Output:","type":"text"}]},{"type":"table","attrs":{"layout":"default","width":760.0,"localId":"be102c83-7d92-4b22-955d-3831924d0986"},"content":[{"type":"tableRow","content":[{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"NAME","type":"text"}]}]},{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"PRIV","type":"text"}]}]},{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"CAPS","type":"text"}]}]},{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"SELINUX","type":"text"}]}]},{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"RUNASUSER","type":"text"}]}]},{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"FSGROUP","type":"text"}]}]},{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"SUPGROUP","type":"text"}]}]},{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"PRIORITY","type":"text"}]}]},{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"READONLYROOTFS","type":"text"}]}]},{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"VOLUMES","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"anyuid ","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"false","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"[] ","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"MustRunAs ","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"RunAsAny ","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"RunAsAny ","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"RunAsAny ","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"10 ","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"false ","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"[configMap downwardAPI emptyDir persistentVolumeClaim projected secret] ","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"hostaccess ","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"false","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"[] ","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"MustRunAs ","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"MustRunAsRange ","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"MustRunAs ","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"RunAsAny ","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":" ","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"false ","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"[configMap downwardAPI emptyDir hostPath persistentVolumeClaim projected secret] ","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"hostmount-anyuid ","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"false","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"[] ","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"MustRunAs ","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"RunAsAny ","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"RunAsAny ","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"RunAsAny ","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":" ","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"false ","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"[configMap downwardAPI emptyDir hostPath nfs persistentVolumeClaim projected secret] ","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"hostnetwork ","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"false","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"[] ","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"MustRunAs ","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"MustRunAsRange ","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"MustRunAs ","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"MustRunAs ","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":" ","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"false ","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"[configMap downwardAPI emptyDir persistentVolumeClaim projected secret] ","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"node-exporter ","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"false","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"[] ","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"RunAsAny ","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"RunAsAny ","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"RunAsAny ","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"RunAsAny ","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":" ","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"false ","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"[*] ","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"nonroot ","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"false","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"[] ","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"MustRunAs ","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"MustRunAsNonRoot ","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"RunAsAny ","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"RunAsAny ","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":" ","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"false ","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"[configMap downwardAPI emptyDir persistentVolumeClaim projected secret] ","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"privileged ","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"true ","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"[*] ","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"RunAsAny ","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"RunAsAny ","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"RunAsAny ","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"RunAsAny ","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":" ","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"false ","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"[*] ","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"restricted ","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"false","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"[] ","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"MustRunAs ","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"MustRunAsRange ","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"MustRunAs ","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"RunAsAny ","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":" ","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"false ","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"[configMap downwardAPI emptyDir persistentVolumeClaim projected secret] ","type":"text"}]}]}]}]},{"type":"heading","attrs":{"level":1},"content":[{"text":"Strategy for Managing Security Context Constraints - DIGIT Deployment on OpenShift","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"1. Create a Custom SCC","type":"text"}]},{"type":"paragraph","content":[{"text":"If you don't have an SCC that allows privileged containers, you need to create one.","type":"text"}]},{"type":"codeBlock","attrs":{"language":"yaml"},"content":[{"text":"apiVersion: security.openshift.io/v1\nkind: SecurityContextConstraints\nmetadata:\n name: custom-privileged-scc\nallowPrivilegedContainer: true\nallowedCapabilities:\n- '*'\nallowHostDirVolumePlugin: true\nallowHostIPC: true\nallowHostNetwork: true\nallowHostPID: true\nallowHostPorts: true\nallowPrivilegeEscalation: true\nrunAsUser:\n type: RunAsAny\nseLinuxContext:\n type: RunAsAny\nfsGroup:\n type: RunAsAny\nsupplementalGroups:\n type: RunAsAny\nvolumes:\n- '*'","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"2. Apply the Custom SCC","type":"text"}]},{"type":"codeBlock","attrs":{"language":"sh"},"content":[{"text":"oc apply -f custom-privileged-scc.yaml","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"3. Assign the Custom SCC to Your Service Account","type":"text"}]},{"type":"paragraph","content":[{"text":"Replace ","type":"text"},{"text":"","type":"text","marks":[{"type":"code"}]},{"text":" and ","type":"text"},{"text":"","type":"text","marks":[{"type":"code"}]},{"text":" with the appropriate values.","type":"text"}]},{"type":"codeBlock","attrs":{"language":"sh"},"content":[{"text":"oc adm policy add-scc-to-user custom-privileged-scc -z -n ","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"4. Retry Creating the StatefulSet or Deployment","type":"text"}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"Sample SCC Files Configured for Elasticsearch and Kafka Deployment","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"custom-elasticsearch-scc.yaml","type":"text"}]},{"type":"codeBlock","attrs":{"language":"yaml"},"content":[{"text":"apiVersion: security.openshift.io/v1\nkind: SecurityContextConstraints\nmetadata:\n \n\n name: custom-elasticsearch-scc\nallowPrivilegedContainer: true\nallowedCapabilities:\n- '*'\nallowHostDirVolumePlugin: true\nallowHostIPC: true\nallowHostNetwork: true\nallowHostPID: true\nallowHostPorts: true\nallowHostVolumeDir: true\nfsGroup:\n type: RunAsAny\nrunAsUser:\n type: RunAsAny\nseLinuxContext:\n type: MustRunAs\nsupplementalGroups:\n type: RunAsAny\nusers:\n- system:serviceaccount:backbone:elasticsearch-sa","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"custom-kafka-scc.yaml","type":"text"}]},{"type":"codeBlock","attrs":{"language":"yaml"},"content":[{"text":"apiVersion: security.openshift.io/v1\nkind: SecurityContextConstraints\nmetadata:\n name: custom-kafka-scc\nallowHostDirVolumePlugin: false\nallowHostIPC: false\nallowHostNetwork: false\nallowHostPID: false\nallowHostPorts: false\nallowPrivilegeEscalation: true\nallowPrivilegedContainer: false\nallowedCapabilities: []\ndefaultAddCapabilities: []\nfsGroup:\n type: MustRunAs\n ranges:\n - max: 1001\n min: 1001\ngroups: []\npriority: 10\nreadOnlyRootFilesystem: false\nrequiredDropCapabilities:\n- KILL\n- MKNOD\n- SETUID\n- SETGID\nrunAsUser:\n type: MustRunAs\n uid: 1001\nseLinuxContext:\n type: MustRunAs\nseccompProfiles:\n- docker/default\nsupplementalGroups:\n type: MustRunAs\n ranges:\n - max: 1001\n min: 1001\nusers:\n- system:serviceaccount:backbone:kafka-kraft\nvolumes:\n- configMap\n- downwardAPI\n- emptyDir\n- persistentVolumeClaim\n- projected\n- secret","type":"text"}]},{"type":"paragraph","content":[{"text":"This document provides a comprehensive overview of Security Context Constraints (SCC) in OpenShift, along with a detailed guide on creating and applying custom SCCs for specific deployments. Ensure to review and tailor the SCC configurations as per your specific requirements and security policies.","type":"text"}]}],"version":1}

Browser not supported