diff options
| author | OpenShift Merge Robot <openshift-merge-robot@users.noreply.github.com> | 2018-01-24 09:17:57 -0800 |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2018-01-24 09:17:57 -0800 |
| commit | 9a2bf772cc5a54bb3461ee1947f2885c69e95239 (patch) | |
| tree | 7056c977f13776c341ed077900cfed10fad134aa /roles/openshift_examples/files/examples/v3.9/cfme-templates/cfme-scc-sysadmin.yaml | |
| parent | 362a248d5d09707625070f158022fa7e3be00df0 (diff) | |
| parent | e96a2afb1a1993349c69adcb9b76f91177bdb48e (diff) | |
| download | openshift-9a2bf772cc5a54bb3461ee1947f2885c69e95239.tar.gz openshift-9a2bf772cc5a54bb3461ee1947f2885c69e95239.tar.bz2 openshift-9a2bf772cc5a54bb3461ee1947f2885c69e95239.tar.xz openshift-9a2bf772cc5a54bb3461ee1947f2885c69e95239.zip | |
Merge pull request #6786 from simaishi/cf_46_beta
Automatic merge from submit-queue.
CF 4.6 Beta templates for OpenShift v3.7 and v3.9
cc @sdodson @Loicavenel
Diffstat (limited to 'roles/openshift_examples/files/examples/v3.9/cfme-templates/cfme-scc-sysadmin.yaml')
| -rw-r--r-- | roles/openshift_examples/files/examples/v3.9/cfme-templates/cfme-scc-sysadmin.yaml | 38 |
1 files changed, 38 insertions, 0 deletions
diff --git a/roles/openshift_examples/files/examples/v3.9/cfme-templates/cfme-scc-sysadmin.yaml b/roles/openshift_examples/files/examples/v3.9/cfme-templates/cfme-scc-sysadmin.yaml new file mode 100644 index 000000000..d2ece9298 --- /dev/null +++ b/roles/openshift_examples/files/examples/v3.9/cfme-templates/cfme-scc-sysadmin.yaml @@ -0,0 +1,38 @@ +allowHostDirVolumePlugin: false +allowHostIPC: false +allowHostNetwork: false +allowHostPID: false +allowHostPorts: false +allowPrivilegedContainer: false +allowedCapabilities: +apiVersion: v1 +defaultAddCapabilities: +- SYS_ADMIN +fsGroup: + type: RunAsAny +groups: +- system:cluster-admins +kind: SecurityContextConstraints +metadata: + annotations: + kubernetes.io/description: cfme-sysadmin provides all features of the anyuid SCC but allows users to have SYS_ADMIN capabilities. This is the required scc for Pods requiring to run with systemd and the message bus. + creationTimestamp: + name: cfme-sysadmin +priority: 10 +readOnlyRootFilesystem: false +requiredDropCapabilities: +- MKNOD +- SYS_CHROOT +runAsUser: + type: RunAsAny +seLinuxContext: + type: MustRunAs +supplementalGroups: + type: RunAsAny +users: +volumes: +- configMap +- downwardAPI +- emptyDir +- persistentVolumeClaim +- secret |