diff options
| author | Matt Bruzek <mbruzek@gmail.com> | 2018-01-18 15:27:13 -0600 |
|---|---|---|
| committer | Matt Bruzek <mbruzek@gmail.com> | 2018-01-18 15:27:13 -0600 |
| commit | cb581bfb67a53f887c4705d45fc7b0024a6816f9 (patch) | |
| tree | 9c351ddd9282f5d3d37c1189af0ac2ad444c0125 /roles/contiv/templates/etcd-scc.yml.j2 | |
| parent | c7a1c448cbd64de98e1f097d14b58ee9f6ccf511 (diff) | |
| parent | 1a2a895356df638756d2117e3d324710167737db (diff) | |
| download | openshift-cb581bfb67a53f887c4705d45fc7b0024a6816f9.tar.gz openshift-cb581bfb67a53f887c4705d45fc7b0024a6816f9.tar.bz2 openshift-cb581bfb67a53f887c4705d45fc7b0024a6816f9.tar.xz openshift-cb581bfb67a53f887c4705d45fc7b0024a6816f9.zip | |
Merge branch 'master' into mbruzek-openshift-openstack
Diffstat (limited to 'roles/contiv/templates/etcd-scc.yml.j2')
| -rw-r--r-- | roles/contiv/templates/etcd-scc.yml.j2 | 42 |
1 files changed, 42 insertions, 0 deletions
diff --git a/roles/contiv/templates/etcd-scc.yml.j2 b/roles/contiv/templates/etcd-scc.yml.j2 new file mode 100644 index 000000000..6c4bb1d1e --- /dev/null +++ b/roles/contiv/templates/etcd-scc.yml.j2 @@ -0,0 +1,42 @@ +allowHostDirVolumePlugin: true +allowHostIPC: false +allowHostNetwork: true +allowHostPID: false +allowHostPorts: false +allowPrivilegedContainer: false +allowedCapabilities: [] +allowedFlexVolumes: [] +apiVersion: v1 +defaultAddCapabilities: [] +fsGroup: + ranges: + - max: "{{ contiv_etcd_system_gid }}" + min: "{{ contiv_etcd_system_gid }}" + type: MustRunAs +groups: [] +kind: SecurityContextConstraints +metadata: + annotations: + kubernetes.io/description: 'For contiv-etcd only.' + creationTimestamp: null + name: contiv-etcd +priority: null +readOnlyRootFilesystem: true +requiredDropCapabilities: +- KILL +- MKNOD +- SETUID +- SETGID +runAsUser: + type: MustRunAs + uid: "{{ contiv_etcd_system_uid }}" +seLinuxContext: + type: MustRunAs +supplementalGroups: + type: MustRunAs +users: +- system:serviceaccount:kube-system:contiv-etcd +volumes: +- emptyDir +- hostPath +- secret |