Skip to content

Commit 40a89a6

Browse files
tchaptchap
committed
helm: Enable user namespaces for deployment
Also switch to hostmount-anyuid-v2 SCC instead of privileged.
1 parent bf97f12 commit 40a89a6

9 files changed

+22
-4
lines changed

‎helm/olmv1/templates/deployment-olmv1-system-catalogd-controller-manager.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -28,7 +28,7 @@ spec:
2828
{{- include "olmv1.annotations" . | nindent 8 }}
2929
{{- if .Values.options.openshift.enabled }}
3030
target.workload.openshift.io/management: '{"effect": "PreferredDuringScheduling"}'
31-
openshift.io/required-scc: privileged
31+
openshift.io/required-scc: hostmount-anyuid-v2
3232
{{- end }}
3333
labels:
3434
app.kubernetes.io/name: catalogd

‎helm/olmv1/templates/deployment-olmv1-system-operator-controller-controller-manager.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -27,7 +27,7 @@ spec:
2727
{{- include "olmv1.annotations" . | nindent 8 }}
2828
{{- if .Values.options.openshift.enabled }}
2929
target.workload.openshift.io/management: '{"effect": "PreferredDuringScheduling"}'
30-
openshift.io/required-scc: privileged
30+
openshift.io/required-scc: hostmount-anyuid-v2
3131
{{- end }}
3232
labels:
3333
app.kubernetes.io/name: operator-controller

‎helm/olmv1/templates/rbac/clusterrole-catalogd-manager-role.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -41,7 +41,7 @@ rules:
4141
resources:
4242
- securitycontextconstraints
4343
resourceNames:
44-
- privileged
44+
- hostmount-anyuid-v2
4545
verbs:
4646
- use
4747
{{- end }}

‎helm/olmv1/templates/rbac/clusterrole-operator-controller-manager-role.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -68,7 +68,7 @@ rules:
6868
resources:
6969
- securitycontextconstraints
7070
resourceNames:
71-
- privileged
71+
- hostmount-anyuid-v2
7272
verbs:
7373
- use
7474
{{- end }}

‎helm/olmv1/values.yaml‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -66,8 +66,10 @@ deployments:
6666
nodeSelector:
6767
kubernetes.io/os: linux
6868
node-role.kubernetes.io/control-plane: ""
69+
hostUsers: false
6970
securityContext:
7071
runAsNonRoot: true
72+
runAsUser: 1000
7173
seccompProfile:
7274
type: RuntimeDefault
7375
terminationGracePeriodSeconds: 10

‎manifests/experimental-e2e.yaml‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2125,11 +2125,13 @@ spec:
21252125
operator: In
21262126
values:
21272127
- linux
2128+
hostUsers: false
21282129
nodeSelector:
21292130
kubernetes.io/os: linux
21302131
node-role.kubernetes.io/control-plane: ""
21312132
securityContext:
21322133
runAsNonRoot: true
2134+
runAsUser: 1000
21332135
seccompProfile:
21342136
type: RuntimeDefault
21352137
terminationGracePeriodSeconds: 10
@@ -2284,11 +2286,13 @@ spec:
22842286
operator: In
22852287
values:
22862288
- linux
2289+
hostUsers: false
22872290
nodeSelector:
22882291
kubernetes.io/os: linux
22892292
node-role.kubernetes.io/control-plane: ""
22902293
securityContext:
22912294
runAsNonRoot: true
2295+
runAsUser: 1000
22922296
seccompProfile:
22932297
type: RuntimeDefault
22942298
terminationGracePeriodSeconds: 10

‎manifests/experimental.yaml‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2038,11 +2038,13 @@ spec:
20382038
operator: In
20392039
values:
20402040
- linux
2041+
hostUsers: false
20412042
nodeSelector:
20422043
kubernetes.io/os: linux
20432044
node-role.kubernetes.io/control-plane: ""
20442045
securityContext:
20452046
runAsNonRoot: true
2047+
runAsUser: 1000
20462048
seccompProfile:
20472049
type: RuntimeDefault
20482050
terminationGracePeriodSeconds: 10
@@ -2183,11 +2185,13 @@ spec:
21832185
operator: In
21842186
values:
21852187
- linux
2188+
hostUsers: false
21862189
nodeSelector:
21872190
kubernetes.io/os: linux
21882191
node-role.kubernetes.io/control-plane: ""
21892192
securityContext:
21902193
runAsNonRoot: true
2194+
runAsUser: 1000
21912195
seccompProfile:
21922196
type: RuntimeDefault
21932197
terminationGracePeriodSeconds: 10

‎manifests/standard-e2e.yaml‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1876,11 +1876,13 @@ spec:
18761876
operator: In
18771877
values:
18781878
- linux
1879+
hostUsers: false
18791880
nodeSelector:
18801881
kubernetes.io/os: linux
18811882
node-role.kubernetes.io/control-plane: ""
18821883
securityContext:
18831884
runAsNonRoot: true
1885+
runAsUser: 1000
18841886
seccompProfile:
18851887
type: RuntimeDefault
18861888
terminationGracePeriodSeconds: 10
@@ -2029,11 +2031,13 @@ spec:
20292031
operator: In
20302032
values:
20312033
- linux
2034+
hostUsers: false
20322035
nodeSelector:
20332036
kubernetes.io/os: linux
20342037
node-role.kubernetes.io/control-plane: ""
20352038
securityContext:
20362039
runAsNonRoot: true
2040+
runAsUser: 1000
20372041
seccompProfile:
20382042
type: RuntimeDefault
20392043
terminationGracePeriodSeconds: 10

‎manifests/standard.yaml‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1789,11 +1789,13 @@ spec:
17891789
operator: In
17901790
values:
17911791
- linux
1792+
hostUsers: false
17921793
nodeSelector:
17931794
kubernetes.io/os: linux
17941795
node-role.kubernetes.io/control-plane: ""
17951796
securityContext:
17961797
runAsNonRoot: true
1798+
runAsUser: 1000
17971799
seccompProfile:
17981800
type: RuntimeDefault
17991801
terminationGracePeriodSeconds: 10
@@ -1928,11 +1930,13 @@ spec:
19281930
operator: In
19291931
values:
19301932
- linux
1933+
hostUsers: false
19311934
nodeSelector:
19321935
kubernetes.io/os: linux
19331936
node-role.kubernetes.io/control-plane: ""
19341937
securityContext:
19351938
runAsNonRoot: true
1939+
runAsUser: 1000
19361940
seccompProfile:
19371941
type: RuntimeDefault
19381942
terminationGracePeriodSeconds: 10

0 commit comments

Comments
 (0)