diff options
Diffstat (limited to 'roles/openshift_cfme/files/miq-scc-httpd.yaml')
-rw-r--r-- | roles/openshift_cfme/files/miq-scc-httpd.yaml | 38 |
1 files changed, 38 insertions, 0 deletions
diff --git a/roles/openshift_cfme/files/miq-scc-httpd.yaml b/roles/openshift_cfme/files/miq-scc-httpd.yaml new file mode 100644 index 000000000..0817b4908 --- /dev/null +++ b/roles/openshift_cfme/files/miq-scc-httpd.yaml @@ -0,0 +1,38 @@ +allowHostDirVolumePlugin: false +allowHostIPC: false +allowHostNetwork: false +allowHostPID: false +allowHostPorts: false +allowPrivilegedContainer: false +allowedCapabilities: +apiVersion: v1 +defaultAddCapabilities: +- SYS_ADMIN +fsGroup: + type: RunAsAny +groups: +- system:cluster-admins +kind: SecurityContextConstraints +metadata: + annotations: + kubernetes.io/description: miq-httpd provides all features of the anyuid SCC but allows users to have SYS_ADMIN capabilities. This is the required scc for Pods requiring to run with systemd and the message bus. + creationTimestamp: + name: miq-httpd +priority: 10 +readOnlyRootFilesystem: false +requiredDropCapabilities: +- MKNOD +- SYS_CHROOT +runAsUser: + type: RunAsAny +seLinuxContext: + type: MustRunAs +supplementalGroups: + type: RunAsAny +users: +volumes: +- configMap +- downwardAPI +- emptyDir +- persistentVolumeClaim +- secret |